Repository navigation
THRIFT-6314: Publish the Windows Thrift compiler through WinGet - #3897
Merged
Merged
Conversation
mergeable
Bot
added
build and general CI
Jens-G
force-pushed
the
THRIFT-6314
branch
2 times, most recently
from
September 20, 2026 11:02
0ce6327 to
b442a32
Compare
Jens-G
force-pushed
the
THRIFT-6314
branch
4 times, most recently
from
September 20, 2026 12:00
69df8b2 to
3611f75
Compare
fishy
approved these changes
Sep 20, 2026
Jens-G
force-pushed
the
THRIFT-6314
branch
5 times, most recently
from
September 20, 2026 21:10
ba7efd4 to
dd65d1d
Compare
Client: build
Windows has a package manager, and the Thrift compiler is not in it.
winget install Apache.Thrift
Apache.Thrift is free: the whole winget-pkgs manifest tree was swept and
holds no Thrift manifest. Apache is the publisher folder the ASF already
uses there, for Directory Studio, Groovy, NetBeans and OpenOffice. Note
the two decoys in that folder: ApacheFriends is XAMPP and ApacheLounge
is a third party httpd build, and neither is the ASF.
The manifest points at archive.apache.org rather than
downloads.apache.org. The latter only carries the current release, so a
manifest naming it stops resolving at the next release, and takes every
older version in winget-pkgs with it. The archive is permanent.
That makes this a post release step: it cannot run until the release has
been promoted and the archive has picked it up, the same wait the Docker
Official Image update has. The workflow runs when the release is
published and can be run again from the Actions tab once the archive has
the file. ReleaseManagement.md says so.
The checksum is computed from the file downloaded from the very URL that
goes into the manifest, so a manifest cannot claim a checksum the
published file does not have.
The manifest records when the release came out, taken from the release
event, or given on the Actions tab when the workflow is run again later.
Defaulting to today would be wrong on exactly the runs the documentation
asks for: the re-run, days after the release, once the archive has the
file.
The manifest declares Microsoft.VCRedist.2015+.x64 as a dependency. The
compiler links the shared runtime and needs the Visual C++
redistributable, which the ASF cannot ship; WinGet installs it first, so
a "winget install Apache.Thrift" does not end in a compiler that will
not start.
The rendered manifests are validated against the WinGet JSON schemas,
fetched for the schema version each manifest names. Without that a
mistake is only found after the pull request against winget-pkgs has
been opened. test-winget-manifests.ps1 covers the renderer separately:
that values land where they belong, that no placeholder survives into a
file that would be submitted verbatim, that the output is UTF-8 with no
BOM and LF endings, and that a malformed version, checksum or date is
refused.
Submission uses wingetcreate, which forks winget-pkgs itself, so nothing
has to be set up there. It needs a classic personal access token with
the public_repo scope - fine grained tokens are not supported - read
from the environment rather than passed on the command line, which is
what Microsoft's own release workflows do so that it cannot reach a log.
Without the token the manifests are still rendered, validated and
uploaded, and the run says in its summary how to submit them by hand.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows has a package manager and the Thrift compiler is not in it.
The identifier
Apache.Thriftis free. I swept the wholewinget-pkgsmanifest tree — 695k paths — and there is no Thrift manifest anywhere.Apacheis the publisher folder the ASF already uses there, for Directory Studio, Groovy, NetBeans and OpenOffice.Two decoys live in the same folder and are not the ASF:
ApacheFriends(XAMPP) andApacheLounge(third-party httpd builds).Why the manifest points at the archive
InstallerUrlhas to keep resolving for as long as the manifest is inwinget-pkgs— including for old versions, which stay there.downloads.apache.orgonly carries the current release, so a manifest naming it stops working at the next release and takes every older Thrift version with it.archive.apache.orgis permanent.That is what makes this a post-release step: it cannot run until the release is promoted to
dist.apache.organd the archive has picked it up. Same wait the Docker Official Image update already has, anddoc/ReleaseManagement.mdnow says so and how to re-run it.The checksum is computed from the file downloaded from that exact URL, so the manifest cannot claim a checksum the published file does not have.
What is checked, and where
Two different questions, so two different checks:
winget/validate_manifests.py— do the rendered manifests match the WinGet JSON schemas? It reads theManifestType/ManifestVersionout of each file and fetches the matching schema from Microsoft, so it follows the manifests instead of pinning a version here. Without this, a mistake is found only after the PR againstwinget-pkgsis already open.I ran this against the real published schemas: the three manifests validate. I also confirmed it fails properly — a bad
InstallerType, a malformedInstallerSha256and a missingdefaultLocalemanifest are each reported.winget/test-winget-manifests.ps1— does the renderer do its job? Values land where they belong; no placeholder survives into a file that would be submitted verbatim; output is UTF-8 without a BOM and with LF endings; a malformed version, checksum or date is refused. 18 checks, no network needed.Both run in CI, including on pull requests, where the manifests are rendered with an obviously fake checksum so the templates and the schema check are still exercised.
The Visual C++ redistributable
The manifest declares
Microsoft.VCRedist.2015+.x64as aPackageDependency. The compiler links the shared runtime and the ASF cannot ship the redistributable, so WinGet installs it first — awinget install Apache.Thriftdoes not end in a compiler that will not start. The dependency validates against the published installer schema, and a test pins it.Submission
wingetcreate, which forkswinget-pkgsitself — no fork setup on our side. It needs a classic PAT withpublic_reposcope; fine-grained tokens are not supported. It is read fromWINGET_CREATE_GITHUB_TOKENrather than passed as--token, which is what Microsoft's own release workflows do so it cannot land in a log.Needed before the first release: a secret
WINGET_TOKENin thereleaseenvironment.Without it nothing breaks: the manifests are still rendered, validated and uploaded as an artifact, and the run prints a warning plus the exact command to submit them by hand. I chose that over failing the release workflow over a missing secret.
Notes
ubuntu-latest; only the submission needs Windows, becausewingetcreateis Windows-only.Scope: user— the installer is per-user by default. A machine-scope entry using/ALLUSERScan be added later if wanted.ProductCodeis{AppId}_is1, Inno Setup's uninstall key. TheAppIdis fixed inthrift.issand must never change; both files say so.zizmoris clean on the new workflow.JIRA: THRIFT-6314
Merge note. #3897 (WinGet) and #3898 (Chocolatey) are siblings off #3895 and both append a subsection to
doc/ReleaseManagement.mdat the same anchor. Whichever merges second will conflict there; the resolution is to keep both subsections. Nothing else overlaps.🤖 Generated with Claude Code