{"action":"created","issue":{"url":"https://api.github.com/repos/chocolatey/choco/issues/382","labels_url":"https://api.github.com/repos/chocolatey/choco/issues/382/labels{/name}","comments_url":"https://api.github.com/repos/chocolatey/choco/issues/382/comments","events_url":"https://api.github.com/repos/chocolatey/choco/issues/382/events","html_url":"https://github.com/chocolatey/choco/issues/382","id":99258175,"number":382,"title":"Move towards prohibiting sourceforge URLs","user":{"login":"alexchandel","id":637714,"avatar_url":"https://avatars.githubusercontent.com/u/637714?v=3","gravatar_id":"","url":"https://api.github.com/users/alexchandel","html_url":"https://github.com/alexchandel","followers_url":"https://api.github.com/users/alexchandel/followers","following_url":"https://api.github.com/users/alexchandel/following{/other_user}","gists_url":"https://api.github.com/users/alexchandel/gists{/gist_id}","starred_url":"https://api.github.com/users/alexchandel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexchandel/subscriptions","organizations_url":"https://api.github.com/users/alexchandel/orgs","repos_url":"https://api.github.com/users/alexchandel/repos","events_url":"https://api.github.com/users/alexchandel/events{/privacy}","received_events_url":"https://api.github.com/users/alexchandel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chocolatey/choco/labels/0%20-%20_Triaging","name":"0 - _Triaging","color":"eeeeee"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-08-05T17:31:40Z","updated_at":"2015-08-06T22:27:36Z","closed_at":null,"body":"SourceForge has recently taken to bundling trojans and adware in the downloads of packages they claim are \"unmaintained\" (regardless of whether this is actually true, as was the case for GIMP).\r\n\r\nWhile I personally think that downloading executables from non-Chocolatey (and non-Microsoft) websites ought to be avoided for security reasons unless a license forbids redistribution, and that those downloads should be MD5-validated, this goes a step further. There's simply no telling whether SourceForge will decide to slip malware into a particular installer, or when this will happen. Nor can we, nor should we rely on package maintainers to constantly monitor their URLs and guarantee they remain malware-free. The only path that provides forward security is to treat **all** SourceForge URLs as currently hosting malware.\r\n\r\nWhat can we do? I would say that new packages and updates to existing packages that download from SourceForge should not be accepted. It is conceivable that special exemptions might have to be made for packages that are hosted nowhere else and cannot be redistributed, but those should be few and far between."},"comment":{"url":"https://api.github.com/repos/chocolatey/choco/issues/comments/128528166","html_url":"https://github.com/chocolatey/choco/issues/382#issuecomment-128528166","issue_url":"https://api.github.com/repos/chocolatey/choco/issues/382","id":128528166,"user":{"login":"ferventcoder","id":63502,"avatar_url":"https://avatars.githubusercontent.com/u/63502?v=3","gravatar_id":"","url":"https://api.github.com/users/ferventcoder","html_url":"https://github.com/ferventcoder","followers_url":"https://api.github.com/users/ferventcoder/followers","following_url":"https://api.github.com/users/ferventcoder/following{/other_user}","gists_url":"https://api.github.com/users/ferventcoder/gists{/gist_id}","starred_url":"https://api.github.com/users/ferventcoder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ferventcoder/subscriptions","organizations_url":"https://api.github.com/users/ferventcoder/orgs","repos_url":"https://api.github.com/users/ferventcoder/repos","events_url":"https://api.github.com/users/ferventcoder/events{/privacy}","received_events_url":"https://api.github.com/users/ferventcoder/received_events","type":"User","site_admin":false},"created_at":"2015-08-06T22:27:36Z","updated_at":"2015-08-06T22:27:36Z","body":"@alexchandel if there were two zips in the package and only one is unzipped based on the architecture you choose, then not sure if there is a need for naming like the above. Trying to stay out of the complexity until it is required. And hopefully by then we will have a better answer in the package names "}}