File tree Expand file tree Collapse file tree 2 files changed +41
-0
lines changed Expand file tree Collapse file tree 2 files changed +41
-0
lines changed Original file line number Diff line number Diff line change
1
+ ---
2
+
3
+ ---
4
+ import Callout from ' @choco/components/Callout.astro' ;
5
+ import Iframe from ' @choco/components/Iframe.astro' ;
6
+ import Xref from ' @components/Xref.astro' ;
7
+
8
+ <Callout type = " warning" >
9
+ This rule has not been implemented in Package Validator, and is only available in the Chocolatey Community Validation extension.
10
+
11
+ Once it has been implemented in Package Validator, the severity or behavior may be changed in the Chocolatey Community Validation extension.
12
+ </Callout >
Original file line number Diff line number Diff line change
1
+ ---
2
+ order : 76
3
+ xref : cpmr0076
4
+ title : CPMR0076 - Raw GitHub Icon URL Is Used (nuspec)
5
+ description : Information on how to remediate the Chocolatey Package Moderation Rule 0076
6
+ ruleType : Requirement
7
+ ---
8
+ import Callout from ' @choco/components/Callout.astro'
9
+ import Iframe from ' @choco/components/Iframe.astro' ;
10
+ import Xref from ' @components/Xref.astro' ;
11
+ import PackageValidatorRuleRequirement from ' @components/docs/PackageValidatorRuleRequirement.mdx' ;
12
+ import PackageValidatorNotImplemented from ' @components/docs/PackageValidatorNotImplemented.mdx' ;
13
+
14
+ <PackageValidatorRuleRequirement />
15
+ <PackageValidatorNotImplemented />
16
+
17
+ ## Issue
18
+
19
+ In the nuspec, the Icon URL has been specified as coming from GitHub or RawGit.
20
+
21
+ ## Recommended Solution
22
+
23
+ Please update the Icon URL to use an Icon that is coming from a proper CDN instead of GitHub or RawGit.
24
+ There are CDN providers for GitHub links that can be used, like [ JSDelivr] ( https://www.jsdelivr.com/ ) and [ Statically] ( https://statically.io/ ) .
25
+
26
+ ## Reasoning
27
+
28
+ GitHub has made it clear that hotlinking to _ raw_ files on GitHub should be avoided, as these are not static assets, and RawGit has shut down.
29
+ See the [ GitHub Blog] ( https://github.blog/2013-04-24-heads-up-nosniff-header-support-coming-to-chrome-and-firefox/ ) for more information.
You can’t perform that action at this time.
0 commit comments