VCLib URLs are going to expire, breaking WinGet items

[mdanish-kh]

Summary

VCLibs is a dependency for AppInstaller as well as some packages in the community repository.

From official download page:

The following package download links are now deprecated, and may no longer work in the future. Make sure to use the method described above to obtain the framework packages.

What's going to break?

Items that I'm aware of:

• Repair-WinGetPackageManager cmdlet, and other parts of codebase that use the download URLs Resolved by Fix Repair-WinGetPackageManager cmdlet by retrieving dependencies from GitHub assets #4923
• Packages in community repo that take VCLibs as dependency. At the time of writing, these are currently 3 PackgeIdentifiers. Telegram.Unigram, TheBrowserCompany.Arc, CharlesMilette.TranslucentTB We can use the Dependencies zip published in WinGet releases to update the Microsoft.VCLibs.Desktop.14 package (see New version: Microsoft.VCLibs.Desktop.14 version 14.0.33728.0 winget-pkgs#191581)
• Sandbox bootstrapping script at MSFT Learn Resolved by Update WinGet sandbox script to use Repair-WinGetPackageManager cmdlet MicrosoftDocs/windows-dev-docs#5178
• Sandbox manifest PR test script at winget-pkgs Resolved by Refactor SandboxTest winget-pkgs#188570

Options?

For WinGet packages, since AppInstaller itself depends on VCLibs, if a user already has winget installed, they should be able to install package without any issue 🤷? Testing it in microsoft/winget-pkgs#170793, microsoft/winget-pkgs#170781, microsoft/winget-pkgs#170721 (one passed validation) Packages can continue to specify VCLibs dependency, the package will be upgraded and maintained by the dependencies zip that WinGet team publishes in the release assets

[denelon]

We're working on an alternate publishing mechanism for the Desktop Framework package with unique durable URLs per version.

[mdanish-kh]

All noted points have been addressed. I've listed the resolutions for all points in front of them above