Cannot override installer hash as admin. Even if EnableLua = 0 (UAC OFF)

[MarcoPeraza]

Cannot override installer hash when running as admin, even if EnableLua = 0 (UAC OFF)

I want to install the package. Please let me install the package.

Steps to reproduce

Try to install a package with a mismatched hash while running as administrator.

Expected behavior

It allows you to install.

Actual behavior

It does not allow you to install.

---

Edited:

This feature is to track the work to have an administrator required setting to enable the ability to override a hash mismatch.
It would be something like winget settings --enable ignore-security-hash-argument.
The group policy on "--force" will need to be evaluated and potentially modified or a new one added for this use case.
There should be a separate argument required for "--ignore-security-hash" rather than "--force" which would work in both user and admin modes if the setting is enabled.

[jedieaston]

Did you run it with --force?

[denelon]

@MarcoPeraza were you able to use --force?

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 7 days. It will be closed if no further activity occurs within 7 days of this comment.

[MarcoPeraza]

Yes, when I use --force I get the following error still: "Installer hash does not match; this cannot be overridden when running as admin"

Note that when using an admin account and running Windows with EnableLua=0, all applications run with full privileges. This turns UAC off. It would be nice if the hash override would remain available to users running with this configuration. Fwiw, I have never encountered a feature in any Microsoft product that did not work with this configuration, except as a bug.

[MarcoPeraza]

Hi, is there any reason why this feature is disabled at all for users running as admin? This seems to be upside-down. Usually, running as administrator gives you more privileges, not less.

I also just want to reiterate that when you turn UAC off on a machine, it's impossible to not run as admin, so the hash override feature becomes completely unavailable.

[jedieaston]

If you are running as administrator and the installer on the other end is compromised, it can do whatever it wants to your system once winget runs it. If you aren't running as administrator and do --force, UAC should pop up and say "hey, this application wasn't signed by a vendor. run anyway?"

It should be configurable via winget settings, but by default winget shouldn't be allowing people to easily run unverified binaries (since if there is a hash mismatch, it means that the version that winget downloaded wasn't verified through the community repo and therefore could be a virus or something).

I also just want to reiterate that when you turn UAC off on a machine, it's impossible to not run as admin, so the hash override feature becomes completely unavailable.

This is good default behavior. The only reason hash overrides are really needed right now are because the manifest update time is so long, but once the bots get better and we have other repos to choose from this shouldn't be much of an issue.

[denelon]

We're looking at several options to deal with this scenario. There have been several concerns about having command-line overrides that could potentially result in malicious code getting installed by the Windows Package Manager (eg. copy-paste this command from some "bad actor").

A few options have been suggested:

Have a setting requirement to enable the capability (enables a Group Policy to block behavior by IT administrators).
Change the value to something other than --force (something more akin to --IgnoreSecuritysha256).

Generally, it is preferred not to ignore security checks. Are there any other suggestions here?