{"action":"created","issue":{"url":"https://api.github.com/repos/chocolatey/choco/issues/384","labels_url":"https://api.github.com/repos/chocolatey/choco/issues/384/labels{/name}","comments_url":"https://api.github.com/repos/chocolatey/choco/issues/384/comments","events_url":"https://api.github.com/repos/chocolatey/choco/issues/384/events","html_url":"https://github.com/chocolatey/choco/issues/384","id":99557872,"number":384,"title":"Bundle archives/installers directly with packages","user":{"login":"alexchandel","id":637714,"avatar_url":"https://avatars.githubusercontent.com/u/637714?v=3","gravatar_id":"","url":"https://api.github.com/users/alexchandel","html_url":"https://github.com/alexchandel","followers_url":"https://api.github.com/users/alexchandel/followers","following_url":"https://api.github.com/users/alexchandel/following{/other_user}","gists_url":"https://api.github.com/users/alexchandel/gists{/gist_id}","starred_url":"https://api.github.com/users/alexchandel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexchandel/subscriptions","organizations_url":"https://api.github.com/users/alexchandel/orgs","repos_url":"https://api.github.com/users/alexchandel/repos","events_url":"https://api.github.com/users/alexchandel/events{/privacy}","received_events_url":"https://api.github.com/users/alexchandel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chocolatey/choco/labels/0%20-%20_Triaging","name":"0 - _Triaging","color":"eeeeee"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2015-08-07T01:38:26Z","updated_at":"2015-08-10T19:36:36Z","closed_at":null,"body":"Continuing the tangent from #382, packages should directly bundle archives in their `nupkg` instead of downloading it from the internet when possible. This avoids the risk of a remote download site getting hacked/hosting malware, which is especially relevant since most packages currently don't verify checksums. It also means that chocolatey packages are self-contained, and will continue to work even if a project has intermittent hosting.\r\n\r\nThis applies to both `.portable` and `.install` packages, as long as they aren't too large (~25MB was suggested).\r\n\r\nIt's also necessary for self-contained packages to be redistributable. For CC/public domain software there are no other caveats. For BSD/MIT/Apache licensed packages, the license (and any NOTICE file) should be included in the package. For GPL packages, the `projectSourceUrl` key in the package's nupkg should satisfy the \"written request\" requirement (in addition to including the license/NOTICE files). Etc. Most archives probably contain all these files already.\r\n\r\nArchives could be either extracted and repacked into the nupkg, or stored directly within. The latter has the advantage that the `chocolateyInstall.ps1` script can prove and verify the archive's checksum at installation.\r\n\r\nThe issue of multiple zipfiles for different architectures taking up space on the user's hard drive was also mentioned; I think the resolution might be simply to delete the archives after installation."},"comment":{"url":"https://api.github.com/repos/chocolatey/choco/issues/comments/129577916","html_url":"https://github.com/chocolatey/choco/issues/384#issuecomment-129577916","issue_url":"https://api.github.com/repos/chocolatey/choco/issues/384","id":129577916,"user":{"login":"ferventcoder","id":63502,"avatar_url":"https://avatars.githubusercontent.com/u/63502?v=3","gravatar_id":"","url":"https://api.github.com/users/ferventcoder","html_url":"https://github.com/ferventcoder","followers_url":"https://api.github.com/users/ferventcoder/followers","following_url":"https://api.github.com/users/ferventcoder/following{/other_user}","gists_url":"https://api.github.com/users/ferventcoder/gists{/gist_id}","starred_url":"https://api.github.com/users/ferventcoder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ferventcoder/subscriptions","organizations_url":"https://api.github.com/users/ferventcoder/orgs","repos_url":"https://api.github.com/users/ferventcoder/repos","events_url":"https://api.github.com/users/ferventcoder/events{/privacy}","received_events_url":"https://api.github.com/users/ferventcoder/received_events","type":"User","site_admin":false},"created_at":"2015-08-10T19:36:36Z","updated_at":"2015-08-10T19:36:36Z","body":"@aronovgj All good points. :)"}}