Allow usage of portable files that are not .exe (such as .jar).

[seppeon]

• I have signed the Contributor License Agreement.
• This pull request is related to an issue.

---

This is related to allowing support for this:
microsoft/winget-pkgs#110767

The issue for this is:
#3386

Microsoft Reviewers: codeflow:open?pullrequest=https://github.com/microsoft/winget-cli/pull/3385&drop=dogfoodAlpha

[seppeon]

I believe I need to change in PortableFlow.cpp too/instead, will make that change then report results :)

[vedantmgoyal9]

We also need to add a supported JDK/JRE as Dependencies in the manifests, and also, the command will be java -jar <path-to-jar> <parameters-of-jar-by-user>, but java -jar should be configured internally so that users can run it like normal EXEs.

[seppeon]

That would also mean that documentation given by vendors like PlantUML would not match usage after installing a jar package.

For example, PlantUML tell users to run their application like this:
java -jar plantuml.jar sequenceDiagram.txt source

If this was wrapped, the doco from these authors may not match.

PS. Ignore branch close/open, I was pressing tab and pressed enter on the wrong button it seems (I think, not really positive lol).

[Trenly]

I don’t think this should be merged, as it would allow things like .ps1 scripts to be injected as portable packages, which is something that should be disallowed.

Having any file extension be available as part of the portable flow is a bad idea in my opinion. If support for Jar files is needed, it should be added as an entirely separate installer type for jar

[seppeon]

Right, that's true. I don't mind adding .jar specifically. What are the concerns about ps1 scripts? An executable can presumably achieve the same thing as that script?

[Trenly]

Right, that's true. I don't mind adding .jar specifically. What are the concerns about ps1 scripts? An executable can presumably achieve the same thing as that script?

Presumably, yes, but if an EXE is malicious, it is generally easier to detect than a .ps1 or .bat script executing arbitrary code

[seppeon]

An installer can already package and install scripts which end up very similar to this outcome though?
Additionally, chocolatey, apt, pacman all allow scripts afaik.

[Trenly]

An installer can already package and install scripts which end up very similar to this outcome though?

Yes, they could, but then it isn't arbitrary code execution - it is packed code execution.

Additionally, chocolatey, apt, pacman all allow scripts afaik.

Yes, but WinGet is not those. In fact, it is one of the core principles of WinGet not to allow scripts during install. You can read more about it in the Scripts discussion

[denelon]

The "Installation Notes" displayed after an install "could" help the user understand the special case for a Java Archive as a portable package.