Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(docs) Add documentation for new rule CPMR0076 #1107

Merged
merged 2 commits into from
Feb 14, 2025
Merged

(docs) Add documentation for new rule CPMR0076 #1107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
913756c
(docs) Add notice for rules in Community extension
AdmiringWorm Dec 5, 2024
255b5aa
(docs) Add new CPMR0076 rule for Icon URLs
AdmiringWorm Dec 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions src/components/docs/PackageValidatorNotImplemented.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---

---
import Callout from '@choco/components/Callout.astro';
import Iframe from '@choco/components/Iframe.astro';
import Xref from '@components/Xref.astro';

<Callout type="warning">
This rule has not been implemented in Package Validator, and is only available in the Chocolatey Community Validation extension.

Once it has been implemented in Package Validator, the severity or behavior may be changed in the Chocolatey Community Validation extension.
</Callout>
29 changes: 29 additions & 0 deletions ...docs/en-us/community-repository/moderation/package-validator/rules/cpmr0076.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
---
order: 76
xref: cpmr0076
title: CPMR0076 - Raw GitHub Icon URL Is Used (nuspec)
description: Information on how to remediate the Chocolatey Package Moderation Rule 0076
ruleType: Requirement
---
import Callout from '@choco/components/Callout.astro'
import Iframe from '@choco/components/Iframe.astro';
import Xref from '@components/Xref.astro';
import PackageValidatorRuleRequirement from '@components/docs/PackageValidatorRuleRequirement.mdx';
import PackageValidatorNotImplemented from '@components/docs/PackageValidatorNotImplemented.mdx';

<PackageValidatorRuleRequirement />
<PackageValidatorNotImplemented />

## Issue

In the nuspec, the Icon URL has been specified as coming from GitHub or RawGit.

## Recommended Solution

Please update the Icon URL to use an Icon that is coming from a proper CDN instead of GitHub or RawGit.
There are CDN providers for GitHub links that can be used, like [JSDelivr](https://www.jsdelivr.com/) and [Statically](https://statically.io/).

## Reasoning

GitHub has made it clear that hotlinking to _raw_ files on GitHub should be avoided, as these are not static assets, and RawGit has shut down.
See the [GitHub Blog](https://github.blog/2013-04-24-heads-up-nosniff-header-support-coming-to-chrome-and-firefox/) for more information.
Loading