[New Feature]: Verified Developer for WinGet Community Repository

[denelon]

Description of the new feature/enhancement

I want to know the package I'm considering installing comes from the developer.

Initially, this will be implemented for Microsoft packages in the WinGet Community Repository. These packages will be submitted for validation and will be subject to the same policies other manifests in the community repository, but when the PR is made to GitHub it will not require an additional validation. Instead, these PRs will be merged as approved and will not require community moderation. Changes or submissions will not be allowed by PRs from other contributors.

Once the end-to-end flows have been implemented and the WinGet client can provide the appropriate indication, we will begin work on the processes for other developers/publishers.

Important

The technical implementation for this has not been the reason for delay. The larger concern is how a developer is verified.

Note

This was implemented but due to the lack of business processes it has not been enabled:

• Restrict access to manifests for packages #100

Proposed technical implementation details (optional)

No response

[DandelionSprout]

If it was to be applied universally for all Microsoft.(...) packages, then I'm not sure if it's a particularly good idea, as there are a fair few Microsoft packages that at the time of writing are not covered by any auto-update bots and whose Microsoft divisions don't submit any new versions to this repo either. "Media Creation Tool" and "Malicious Software Removal Tool" are the biggest examples I know of.

I do however know first-hand that at least Microsoft.PowerToys and (IIRC) Microsoft.PowerShell would like the proposed idea (and I know of at least 2 non-Microsoft packages that would like it too, but that's a different story). But if it's implemented incorrectly, this repo could end up with well over 100 Microsoft packages that lag behind on updates because community contributors wouldn't be able to submit new versions for those packages.

[DuckDuckStudio]

Changes or submissions will not be allowed by PRs from other contributors.

For me, I would allow community members to update the manifests as long as I am aware of and agree to it.

The technical implementation for this has not been the reason for delay. The larger concern is how a developer is verified.

For me, I really hope the verification process isn’t too complicated.
I don’t want to provide my ID information or a Microsoft work account... I believe my GitHub account (where the repositories for my software are under my account) and the software copyright registration can prove my ownership.