commit 5898d09203409d08742d97f8eb54e249316695e8
parent 2e3fc154e3fd149846224159dc9922bd3784a606
Author: Kevin Larkin (MS) <kevinla@microsoft.com>
Date: Sun, 23 May 2021 11:51:21 -0700
Labels (#974)
* Updated Submission docs and added policy
* added strings to expect and added placeholder troubleshooter
* fixed a couple of typos
* Fixed typo and added missing page
* removed language folder in URL
* Add PCs
* Update repository.md
Co-authored-by: denelon <denelon@microsoft.com>
Diffstat:
8 files changed, 448 insertions(+), 43 deletions(-)
diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
@@ -51,6 +51,8 @@ certmgr
certs
Cfg
cgmanifest
+cfr
+cgi
chcp
ci
cinq
@@ -65,6 +67,7 @@ contosa
contosainstaller
contoso
count'th
+countryregion
createmanifestmetadata
cstdint
ctc
@@ -79,16 +82,20 @@ dnld
dustojnikhummer
dvinns
dw
+ecfr
+ecfrbrowse
endian
enr
enums
EQU
ERANGE
errno
+ESRB
etest
execustom
EXEHASH
experimentalfeatures
+fcb
fd
fedorapeople
fintimes
@@ -100,6 +107,7 @@ foldcase
FOLDERID
ftp
FULLWIDTH
+fundraiser
fuzzer
gcpi
GES
@@ -119,10 +127,12 @@ HRESULTs
htm
IAttachment
IConfiguration
+idx
IHelp
IHost
IID
IInstalled
+img
IName
INET
inor
@@ -172,10 +182,12 @@ malware
MBH
megamorf
memcpy
+middleware
minexample
minschema
MMmmbbbb
monicka
+MPNS
msdownload
MSFT
msftrubengu
@@ -203,6 +215,8 @@ oss
Packagedx
pathparts
pathpaths
+PCs
+PEGI
pfn
pfxpath
Pherson
@@ -223,6 +237,7 @@ qb
qword
rbegin
readonly
+redirector
regexes
REGSAM
REINSTALLMODE
@@ -273,6 +288,7 @@ testexampleinstaller
thiscouldbeapc
threehundred
tombstoned
+tpl
transitioning
UCase
ucasemap
diff --git a/doc/windows/package-manager/package/binary-validation-errors.md b/doc/windows/package-manager/package/binary-validation-errors.md
@@ -0,0 +1,21 @@
+# Binary-Validation-Error
+
+The Windows Package Manager goes to great lengths to create an excellent user experience when installing applications. In order to do this, we must ensure that all applications install on PCs without errors regardless of environment.
+
+To that end, a key test we use for the Windows Package Manager is to ensure that all installers will install without warnings on a variety of popular antivirus configurations. While Windows provides Defender as a built-in antivirus program, many enterprise customers and users employ a wide range of antivirus software.
+
+Therefore, each submission to the Windows Package Manager will be run through several antivirus programs. These programs all have different virus detection algorithms for identifying [Potentially unwanted application (PUA)](https://docs.microsoft.com/windows/security/threat-protection/intelligence/criteria) and malware.
+
+## Application failures
+
+If an application fails validation, Microsoft will first attempt to verify that the flagged software is not a false positive with the antivirus vendors. In many cases, after notification and validation, the antivirus vendor will update their algorithm and the application will pass.
+
+In some cases, however, the code anomaly detected is not able to be determined to be a false positive by the antivirus vendors. In this case the application cannot be added to the Windows Package Manager repository, and the Pull Request will be rejected with a **Binary-Validation-Error** label.
+
+## Responding to Binary-Validation-Error
+
+A previously mentioned, the Windows Package Manager repository is not allowed applications that fail with a **Binary-Validation-Error**. The next step is for the ISV to update their software to remove the code detected as PUA.
+
+### What if I cannot remove that code?
+
+Occasionally, genuine tools used for debugging and low-level activities, will appear as PUA to the antivirus vendors. This is because the code necessary to do the debugging will have a similar signature to unwanted software. Even though this is a legitimate use of that coding practice, unfortunately we are unable to allow those applications into the Windows Package Manager repository.+
\ No newline at end of file
diff --git a/doc/windows/package-manager/package/manifest.md b/doc/windows/package-manager/package/manifest.md
@@ -215,7 +215,7 @@ by the Windows Package Manager client (winget.exe). For example, the `AppMoniker
* The "Publisher" should match the entry made in Add / Remove Programs to help the correlation with manifests to support **export**, and **upgrade**.
-* Package installers in MSI format use [Product Codes](https://docs.microsoft.com/en-us/windows/win32/msi/product-codes) to uniquely identify applications. The product code for a given version of a package should be included in the manifest to help ensure the best **upgrade** experience.
+* Package installers in MSI format use [Product Codes](https://docs.microsoft.com/windows/win32/msi/product-codes) to uniquely identify applications. The product code for a given version of a package should be included in the manifest to help ensure the best **upgrade** experience.
* Limit the length of strings in your manifest to 100 characters before a line break.
* When more than one installer type exists for the specified version of the package, an instance of `InstallerType` can be placed under each of the `Installers`.
diff --git a/doc/windows/package-manager/package/repository.md b/doc/windows/package-manager/package/repository.md
@@ -12,7 +12,7 @@ ms.localizationpriority: medium
After you create a [package manifest](manifest.md) that describes your application, you're ready to submit your manifest to the Windows Package Manager repository. This a public-facing repository that contains a collection of manifests that the **winget** tool can access. To submit your manifest, you'll upload it to the open source [https://github.com/microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs) repository on GitHub.
-After you submit a pull request to add a new manifest to the GitHub repository, an automated process will validate your manifest file and check to make sure the package is not known to be malicious. If this validation is successful, your package will be added to the public-facing Windows Package Manager repository so it can be discovered by the **winget** client tool. Note the distinction between the manifests in the open source GitHub repository and the public-facing Windows Package Manager repository.
+After you submit a **pull request** to add a new manifest to the GitHub repository, an automated process will validate your manifest file and check to make sure the package complies with the [Windows Package Manager polices](.\windows-package-manager-policies.md) and is not known to be malicious. If this validation is successful, your package will be added to the public-facing Windows Package Manager repository so it can be discovered by the **winget** client tool. Note the distinction between the manifests in the open source GitHub repository and the public-facing Windows Package Manager repository.
> [!IMPORTANT]
> Microsoft reserves the right to refuse a submission for any reason.
@@ -25,6 +25,8 @@ There are currently no known third party repositories. Microsoft is working with
When you submit a manifest to the [https://github.com/microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs) repository on GitHub, your manifest will be automatically validated and evaluated for the safety of the Windows ecosystem. Manifests may also be reviewed manually.
+For information on the validation process, see [Windows Package Manager validation](.\winget-validation.md)
+
## How to submit your manifest
To submit a manifest to the repository, follow these steps.
@@ -60,15 +62,16 @@ Next, create a fork of the repository and clone it.
You must add your manifest file to the repository in the following folder structure:
-**manifests** / **publisher** / **application** / **version.yaml**
+**manifests** / **letter** / **publisher** / **application** / **version** / **Yaml file**
* The **manifests** folder is the root folder for all manifests in the repository.
+* The **letter** folder is the first letter of the publisher name.
* The **publisher** folder is the name of the company that publishes the software. For example, **Microsoft**.
* The **application** folder is the name of the application or tool. For example, **VSCode**.
-* **version.yaml** is the file name of the manifest. The file name must be set to the current version of the application. For example, **1.0.0.yaml**.
+* The **version** folder is the version of the application or tool. For example, **1.0.0**.
+* **Yaml File** is the file name of the manifest. The file name must be set to the name and publisher of the application. For example, **Contoso.ContosoApp.yaml**.
->[!IMPORTANT]
-> The `PackageIdentifier` value in the manifest must match the publisher and application names in the manifest folder path, and the `PackageVersion` value in the manifest must match the version in the file name. For more information, see [Create your package manifest](manifest.md#tips-and-best-practices).
+The `PackageIdentifier` value in the manifest must match the publisher and application names in the manifest folder path, and the `PackageVersion` value in the manifest must match the version in the file name. For more information, see [Create your package manifest](manifest.md#tips-and-best-practices).
### Step 4: Submit your manifest to the remote repository
@@ -76,12 +79,12 @@ You're now ready to push your new manifest to the remote repository.
1. Use the `add` command to prepare for submission.
```CMD
- git add manifests\Contoso\ContosoApp\1.0.0.yaml
+ git add manifests\C\Contoso\ContosoApp\1.0.0\Contoso.ContosoApp.yaml
```
2. Use the `commit` command to commit the change and provide information on the submission.
```CMD
- git commit -m "Submitting ContosoApp version 1.0.0.yaml"
+ git commit -m "Submitting ContosoApp version 1.0.0"
```
3. Use the `push` command to push the changes to the remote repository.
@@ -91,38 +94,16 @@ You're now ready to push your new manifest to the remote repository.
### Step 5: Create a pull request
-After you push your changes, return to [https://github.com/microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs) and create a pull request to merge your fork or branch to the main branch.
+After you push your changes, return to [https://github.com/microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs) and create a **pull request** to merge your fork or branch to the main branch.
-## Validation process
-
-When you create a pull request, this will start an automation process that validates the manifest and processes your pull request. We add labels to your pull request so you can track progress.
-
-### Submission expectations
-
-All application submissions to the Windows Package Manager repository should be well-behaved. Here are some expectations for submissions:
+## Submission process
-* The manifest complies with the [schema requirements](manifest.md#manifest-contents).
-* All URLs in the manifest lead to safe websites.
-* The installer and application are virus free. The package may be identified as malware by mistake. If you believe it's a false positive you can submit the installer to the defender team for analysis from [here](https://www.microsoft.com/wdsi/filesubmission).
-* The application installs and uninstalls correctly for both administrators and non-administrators.
-* The installer supports non-interactive modes.
-* All manifest entries are accurate and not misleading.
-* The installer comes directly from the publisher's website.
+When you create a **pull request**, this will start an automated process that validates the manifests and verifies your **pull request**. During this process we will run tests against the installer and installed binaries to validate the submission.
-### Pull request labels
+We add labels to your **pull request** so you can track its progress. For more information on labels and the process see [Windows Package Manager validation](.\winget-validation.md).
-During validation, we apply a series of labels to our pull request to communicate progress.
+Once complete, the submission will be automatically merged and the application will get added to the Windows Package Manager catalog.
-* **Needs: author feedback**: There is a failure with the submission. We will reassign pull request back to you. If you do not address the issue within 10 days, we will close the pull request.
-* **Manifest-Validation-Error**: The submitted manifest contains a syntax error.
-* **URL-Validation-Error**: One or more URLs in the submission failed [SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview) validation.
-* **Binary-Validation-Error**: The submitted application installer failed virus scan testing or there is a hash mismatch.
-* **Pull-Request-Error**: There is a problem with the pull request. For example, the folder structure does not have the [required format](#step-3-add-your-manifest-to-the-local-repository).
-* **Validation-Error**: The submitted application failed a general validation test.
-* **Validation-Installation-Error**: The submitted application failed install testing.
-* **Validation-Uninstall-Error**: The submitted application failed uninstall testing.
-* **Validation-Virus-Scan-Error**: The submitted application failed virus scan testing.
-* **Azure-Pipeline-Passed**: The manifest has completed the first portion of validation. After this step, your pull request is assigned to our test team for final validation.
-* **Validation-Completed**: The validation is complete and your pull request will be merged.-
\ No newline at end of file
+If there is ever an error during the process, you will be notified and our labels and bot will assist you in fixing your submission. For the list of common errors, see [Windows Package Manager validation](.\winget-validation.md).
diff --git a/doc/windows/package-manager/package/windows-package-manager-policies-change-history.md b/doc/windows/package-manager/package/windows-package-manager-policies-change-history.md
@@ -0,0 +1,5 @@
+# Change history for Microsoft Store Policies
+
+| Date | Document Version | Change Description |
+|------|------------------|--------------------|
+| 5/25/2021 | 1.0 | Initial publishing of Windows Package Manager Policies|
diff --git a/doc/windows/package-manager/package/windows-package-manager-policies.md b/doc/windows/package-manager/package/windows-package-manager-policies.md
@@ -6,19 +6,277 @@
**Effective date: May 22, 2021**
-Thank you for your interest in providing a product to the Windows Package Manager repository.
+Thank you for your interest in providing a Product to the Windows Package Manager repository.
-"Product" means content in whatever form including, but not limited to, apps, games, titles, and any additional content sold or offered from within a Product.
-"Submission" means Pull Request of manifest files and includes but is not limited to the product and metadata about the product.
+"Product" means content in whatever form including, but not limited to, apps, games, titles, and any additional content sold or offered from within a Product.
+"Submission" means [**Pull Request**](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request)
+ of manifest files and includes but is not limited to the "Product" and metadata about the "Product".
-Coming soon ...
+A few principles to get you started:
+- Offer unique and distinct value within your Submission. Provide a compelling reason to download the Product from [Windows Package Manager repository](https://www.github.com/microsoft/winget-pkgs).
+- Don’t mislead our customers about what your Submission can do, who is offering it, etc.
+- Don’t attempt to cheat customers, the system or the ecosystem. There is no place in the repository for any kind of fraud, be it ratings and review manipulation, credit card fraud or other fraudulent activity.
----
+Adhering to these policies should help you make choices that enhance your Submission’s appeal and audience.
+
+Your Submissions are crucial to the experience of hundreds of millions of customers. We can’t wait to see what you create and are thrilled to help deliver your Submissions to the world.
+
+If you have feedback on the policies or the Windows Package Manager, please let us know by commenting in our [GitHub issues forum](https://www.github.com/microsoft/winget-cli/issues)
+
+## Table of Contents
+
+**Product Policies:**
+
+- [1.1 Distinct Function & Value; Accurate Representation](#11-distinct-function--value-accurate-representation)
+- [1.2 Security](#12-security)
+- [1.3 Product is Testable](#13-product-is-testable)
+- [1.4 Usability](#14-usability)
+- [1.5 Personal Information](#15-personal-information)
+- [1.6 Capabilities](#16-capabilities)
+- [1.7 Localization](#17-localization)
+- [1.8 Financial Transactions](#18-financial-transactions)
+- [1.9 Notifications](#19-notifications)
+- [1.10 Advertising Conduct and Content](#110-advertising-conduct-and-content)
+
+**Content Policies:**
+
+- [2.1 General Content Requirements](#21-general-content-requirements)
+- [2.2 Content Including Names, Logos, Original and Third Party](#22-content-including-names-logos-original-and-third-party)
+- [2.3 Risk of Harm](#23-risk-of-harm)
+- [2.4 Defamatory, Libelous, Slanderous and Threatening](#24-defamatory-libelous-slanderous-and-threatening)
+- [2.5 Offensive Content](#25-offensive-content)
+- [2.6 Alcohol, Tobacco, Weapons and Drugs](#26-alcohol-tobacco-weapons-and-drugs)
+- [2.7 Adult Content](#27-adult-content)
+- [2.8 Illegal Activity](#28-illegal-activity)
+- [2.9 Excessive Profanity and Inappropriate Content](#29-excessive-profanity-and-inappropriate-content)
+- [2.10 Country/Region Specific Requirements](#210-countryregion-specific-requirements)
+- [2.11 Age Ratings](#211-age-ratings)
+- [2.12 User Generated Content](#212-user-generated-content)
+
+## Product Policies
+
+### 1.1 Distinct Function & Value; Accurate Representation
+
+The Product and its associated metadata, including but not limited to the app title, description, screenshots, trailers, content rating and Product category, must accurately and clearly reflect the source, functionality, and features of the Product.
+
+### 1.1.1
+
+All aspects of the Product should accurately describe the functions, features and any important limitations of the Product.
+
+### 1.1.2
+
+[Tags](https://github.com/microsoft/winget-cli/blob/master/schemas/JSON/manifests/v1.0.0/manifest.defaultLocale.1.0.0.json) may not exceed 16 unique tags and should be relevant to the Product.
+
+### 1.1.3
+
+The Product must have distinct and informative metadata and must provide a valuable and quality user experience.
+
+### 1.1.4
+The [InstallerUrl](https://github.com/microsoft/winget-cli/blob/master/schemas/JSON/manifests/v1.0.0/manifest.defaultLocale.1.0.0.json) must be the ISVs release location for the Product. Products from download websites will not be allowed.
+
+### 1.2 Security
+
+The Product must not jeopardize or compromise user security, or the security or functionality of the device, system or related systems.
+
+### 1.2.1
+
+The Product must not attempt to change or extend its described functionality through any form of dynamic inclusion of code that is in violation of Windows Package Manager Policies. The Product should not, for example, download a remote script and subsequently execute that script in a manner that is not consistent with the described functionality.
+
+### 1.2.2
+
+The Product must not contain or enable malware as defined by the Microsoft criteria for [Unwanted and Malicious Software](/windows/security/threat-protection/intelligence/criteria).
+
+### 1.2.3
+
+The Product may contain fully integrated middleware (such as third-party cross-platform engines and third-party analytics services).
+
+The Product may depend on non-integrated software (such as another Product, module, or service) to deliver its primary functionality, subject to the following requirements:
+
+### 1.3 Product is Testable
+
+The Product must be testable. If it is not possible to test your submitted Product for any reason your Product may fail this requirement.
+
+### 1.4 Usability
+
+The Product should meet usability standards, including, but not limited to, those listed in the subsections below.
+
+### 1.4.1
+
+The Product should support the devices and platforms on which they are downloaded, including compatibility with the software, hardware and screen resolution requirements specified by the Product. If the Product is downloaded on a device with which it is not compatible, it should detect that at launch and display a message to the customer detailing the requirements.
+
+### 1.4.2
+
+The Product should continue to run and remain responsive to user input. Products should shut down gracefully and not close unexpectedly. The Product should handle exceptions raised by any of the managed or native system APIs and remain responsive to user input after the exception is handled.
+
+### 1.4.3
+
+The Product should start up promptly and must stay responsive to user input.
+
+### 1.5 Personal Information
+
+The following requirements apply to Products that access Personal Information. Personal Information includes all information or data that identifies or could be used to identify a person, or that is associated with such information or data.
+
+### 1.5.1
+
+If the Product accesses, collects or transmits Personal Information, or if otherwise required by law, it should maintain a privacy policy. The submission, should include the [PrivacyUrl](https://github.com/microsoft/winget-cli/blob/master/schemas/JSON/manifests/v1.0.0/manifest.defaultLocale.1.0.0.json) which links to the privacy policy of the Product.
+
+### 1.5.2
+
+If the Product publishes the Personal Information of customers of the Product to an outside service or third party, the Product should only do so after obtaining opt-in consent from those customers. Opt-in consent means the customer gives their express permission in the Product user interface for the requested activity, after the Product has:
+
+- described to the customer how the information will be accessed, used or shared, indicating the types of parties to whom it is disclosed, and
+- provided the customer a mechanism in the Product user interface through which they can later rescind this permission and opt-out.
+
+### 1.5.3
+
+If the Product publishes a person’s Personal Information to an outside service or third party through the Product or its metadata, but the person whose information is being shared is not a customer of the Product, the Product must obtain express written consent to publish that Personal Information, and must permit the person whose information is shared to withdraw that consent at any time. If the Product provides a customer with access to another person’s Personal Information, this requirement would also apply.
+
+### 1.5.4
+
+If the Product collects, stores or transmits Personal Information, it must do so securely, by using modern cryptography methods.
+
+### 1.5.5
+
+The Product must not collect, store or transmit highly sensitive personal information, such as health or financial data, unless the information is related to the Product’s functionality. The Product must also obtain express user consent before collecting, storing or transmitting such information. The Product’s privacy policy must clearly tell the user when and why it is collecting Personal Information and how it will be used.
+
+### 1.5.6
+
+If the Product supports Microsoft identity authentication it must do so only by using Microsoft-approved methods.
+
+### 1.5.7
+
+Products that receive device location must provide settings that allow the user to enable and disable the Product's access to and use of location from the Location Service API.
+
+### 1.6 Capabilities
+
+If the Product declares the use of capabilities, then the capabilities the Product declares must legitimately relate to the functions of the Product. The Product must not circumvent operating system checks for capability usage.
+
+### 1.7 Localization
+
+If the Product you should provide localized all languages that it supports. The experience provided by a product must be reasonably similar in all languages that it supports.
+
+### 1.8 Financial Transactions
+
+If your product includes in-product purchase, subscriptions, virtual currency, billing functionality or captures financial information, the following requirements apply:
+
+### 1.8.1
+
+In-product offerings sold in your product cannot be converted to any legally valid currency (for example, USD, Euro, etc.) or any physical goods or services.
+
+### 1.8.2
+
+The Product must use a secure purchase API for purchases of physical goods or services, and a secure purchase API for payments made in connection with real world gambling or charitable contributions. If the Product is used to facilitate or collect charitable contributions or to conduct a promotional sweepstakes or contest, it must do so in compliance with applicable law. The Product must also state clearly that Microsoft is not the fundraiser or sponsor of the promotion.
+
+The Product must use a secure purchase API to receive voluntary donations from users.
+
+The following requirements apply to your use of a secure purchase API:
+
+- At the time of the transaction or when the Product collects any payment or financial information from the customer, the Product must identify the commerce transaction provider, authenticate the user, and obtain user confirmation for the transaction.
+- The product can offer the user the ability to save this authentication, but the user must have the ability to either require an authentication on every transaction or to turn off in-product transactions.
+- If the product collects credit card information or uses a third-party payment processor that collects credit card information, the payment processing must meet the current PCI Data Security Standard (PCI DSS).
+
+### 1.8.3
+
+The product and its associated metadata must provide information about the types of in-product purchases offered and the range of prices. The Product not mislead customers and must be clear about the nature of the in-product promotions and offerings including the scope and terms of any trial experiences. If the Product restricts access to user-created content during or after a trial, it must notify users in advance. In addition, the Product must make it clear to users that they are initiating a purchase option in the Product.
+
+If your game offers “loot boxes” or other mechanisms that provide randomized virtual items, then you must disclose the odds of receiving each item to customers prior to purchase. These disclosures may appear: in-product, such as in an in-app store, on the Microsoft Store Product Description Page (PDP), and/or on a developer or publisher website, with a link from the Store Product Description Page (PDP) and/or in-app.
+
+### 10.8.4
+
+All pricing, including sales or discounting, for your digital products or services shall comply with all applicable laws, regulations and regulatory guidelines, including without limitation, the Federal Trade Commission [Guides Against Deceptive Pricing](https://www.ecfr.gov/cgi-bin/text-idx?SID=676bd39fe43a808fcb417973b3d0247e&mc=true&tpl=/ecfrbrowse/Title16/16cfr233_main_02.tpl).
+
+### 1.9 Notifications
+
+If the Product supports notifications, then the Product must respect system settings for notifications and remain functional when they are disabled. This includes the presentation of ads and notifications to the customer, which must also be consistent with the customer’s preferences, whether the notifications are provided by the Microsoft Push Notification Service (MPNS), Windows Push Notification Service (WNS) or any other service. If the customer disables notifications, either on an Product-specific or system-wide basis, the Product must remain functional.
+
+### 1.10 Advertising Conduct and Content
+
+For all advertising related activities, the following requirements apply:
+
+### 1.10.1
+
+- The primary purpose of the Product should not be to get users to click ads.
+- The Product may not do anything that interferes with or diminishes the visibility, value, or quality of any ads it displays.
+- The Product must respect advertising ID settings that the user has selected.
+- All advertising must be truthful, non-misleading and comply with all applicable laws, regulations, and regulatory guidelines.
+
+## Content Policies
+
+The following policies apply to content and metadata (including publisher name, Product name, Product icon, Product description, Product screenshots, Product trailers and trailer thumbnails, and any other Product metadata) offered for distribution in the Windows Package Manager repository. Content means the Product name, publisher name, Product icon, Product description, the images, sounds, videos and text contained in the Product, the tiles, notifications, error messages or ads exposed through the Product, and anything that’s delivered from a server or that the Product connects to. Because Product and the Windows Package Manager repository are used around the world, these requirements will be interpreted and applied in the context of regional and cultural norms.
+
+### 2.1 General Content Requirements
+
+Metadata and other content you submit to accompany your submission may contain only content that would merit a rating of PEGI 12, ESRB EVERYONE 10+, or lower.
+
+### 2.2 Content Including Names, Logos, Original and Third Party
+
+All content in the Product and associated metadata must be either originally created by the application provider, appropriately licensed from the third-party rights holder, used as permitted by the rights holder, or used as otherwise permitted by law.
+
+### 2.3 Risk of Harm
+
+### 2.3.1
+
+The Product must not contain any content that facilitates or glamorizes the following real world activities: (a) extreme or gratuitous violence; (b) human rights violations; (c) the creation of illegal weapons; or (d) the use of weapons against a person, animal, or real or personal property.
+
+### 2.3.2
+
+The Product must not: (a) pose a safety risk to, nor result in discomfort, injury or any other harm to end users or to any other person or animal; or (b) pose a risk of or result in damage to real or personal property. You are solely responsible for all Product safety testing, certificate acquisition, and implementation of any appropriate feature safeguards. You will not disable any platform safety or comfort features, and you must include all legally required and industry-standard warnings, notices, and disclaimers in the Product.
+
+### 2.4 Defamatory, Libelous, Slanderous and Threatening
+
+The Product must not contain any content that is defamatory, libelous, slanderous, or threatening.
+
+### 2.5 Offensive Content
+
+The Product and associated metadata must not contain potentially sensitive or offensive content. Content may be considered sensitive or offensive in certain countries/regions because of local laws or cultural norms. In addition, the Product and associated metadata must not contain content that advocates discrimination, hatred, or violence based on considerations of race, ethnicity, national origin, language, gender, age, disability, religion, sexual orientation, status as a veteran, or membership in any other social group.
+
+### 2.6 Alcohol, Tobacco, Weapons and Drugs
+
+The Product must not contain any content that facilitates or glamorizes excessive or irresponsible use of alcohol or tobacco Products, drugs, or weapons.
+
+### 2.7 Adult Content
+
+The Product must not contain or display content that a reasonable person would consider pornographic or sexually explicit.
+
+### 2.8 Illegal Activity
+
+The Product must not contain content or functionality that encourages, facilitates or glamorizes illegal activity in the real world.
+
+### 2.9 Excessive Profanity and Inappropriate Content
+
+- The Product must not contain excessive or gratuitous profanity.
+- The Product must not contain or display content that a reasonable person would consider to be obscene.
+
+### 2.10 Country/Region Specific Requirements
+
+Content that is offensive in any country/region to which the Product is targeted is not allowed. Content may be considered offensive in certain countries/regions because of local laws or cultural norms. Examples of potentially offensive content in certain countries/regions include the following:
+
+China
+
+- Prohibited sexual content
+- Disputed territory or region references
+- Providing or enabling access to content or services that are illegal under applicable local law
+
+### 2.11 Age Ratings
+
+The Product should have a age rating that would merit a rating of PEGI 12, ESRB EVERYONE 10+, or lower.
+
+### 2.11.1
+
+If the Product provides content (such as user-generated, retail or other web-based content) that might be appropriate for a higher age rating than its assigned rating, you must enable users to opt in to receiving such content by using a content filter or by signing in with a pre-existing account.
+
+### 2.12 User Generated Content
+
+User Generated Content (UGC) is content that users contribute to an app or Product and which can be viewed or accessed by other users in an online state. If the Product contains UGC, the Product should:
+
+- Publish and make available to users a Product terms of service and/or content guidelines for User Generated Content either in Product or on the Product website.
+- Provide a means for users to report inappropriate content within the Product to the developer for review and removal/disablement if in violation of content guidelines and/or implement a method for proactive detection of inappropriate or harmful UGC.
+- Remove or disable UGC when requested by Microsoft.
### See also
-- [Change history for Windows Package Manager Policy History](windows-package-manager-policies-change-history.md)
+- [Change history for Windows Package Manager Policy History](.\windows-package-manager-policies-change-history.md)
- [Windows Package Manager Code of Conduct](https://github.com/microsoft/winget-pkgs/blob/master/CODE_OF_CONDUCT.md)
- [Windows Package Manager Contributing requirements](https://github.com/microsoft/winget-pkgs/blob/master/README.md)
\ No newline at end of file
diff --git a/doc/windows/package-manager/package/winget-validation-troubleshooter.md b/doc/windows/package-manager/package/winget-validation-troubleshooter.md
@@ -0,0 +1,5 @@
+# Change history for Microsoft Store Policies
+
+| Date | Document Version | Change Description |
+|------|------------------|--------------------|
+| 5/25/2021 | 1.0 | Initial publishing of Windows Package Manager Policies|
diff --git a/doc/windows/package-manager/package/winget-validation.md b/doc/windows/package-manager/package/winget-validation.md
@@ -0,0 +1,119 @@
+## Validation process
+
+When you create a pull request, this will start an automation process that validates the manifest and processes your pull request. GitHub labels are used to share progress and allow you to communicate with us.
+
+## Submission expectations
+
+All application submissions to the Windows Package Manager repository should be well-behaved and adhere to the [Windows Package Manager policies](./windows-package-manager-policies.md).
+Here are some expectations for submissions:
+
+- The manifest complies with the [schema requirements]("https://docs.microsoft.com/windows/package-manager/package/manifest?tabs=minschema%2Ccompschema").
+- All URLs in the manifest lead to safe websites.
+
+- The installer and application are virus free. The package may be identified as malware by mistake. If you believe it is a false positive you can submit the installer to the defender team for
+ analysis from [here](https://www.microsoft.com/wdsi/filesubmission).
+
+- The application installs and uninstalls correctly for both administrators and non-administrators.
+
+- The installer supports non-interactive modes.
+
+- All manifest entries are accurate and not misleading.
+
+- The installer comes directly from the publisher\'s website.
+
+Please see [Windows Package Manager policies](.\windows-package-manager-policies.md) for a complete list of the policies.
+
+## Pull request labels
+
+During validation, we apply a series of labels to our pull request to
+communicate progress. Some labels will direct the ISV to take action,
+while others will be directed to the Package Manager developers.
+
+### Status Labels
+
+The following table describes the possible **status labels** you will
+encounter:
+
+| **Label** | **Details** |
+|--------------|-------------|
+| <img width=180/> | <img width=500/> |
+| **Azure-Pipeline-Passed** | The manifest has completed the test pass. It is waiting for approval. If no issues are encountered during the test pass it will automatically be approved. If a test fails, it may be flagged for manual review.|
+| **Blocking-Issue** | This label indicates that the **Pull Request** cannot be approved because there is a blocking issue. You can often tell what the blocking issue is by the included error label as well. |
+| **Needs: Attention** | This label indicates that the **Pull Request** needs to be investigated by the Windows Package Manager development team. This is either due to a test failure that needs manual review, or a comment added to the **Pull Request** by the community. |
+| **Needs: author feedback** | Indicates there is a failure with the submission. We will reassign **Pull Request** back to you. If you do not address the issue within 10 days, the bot will close the **pull request**. **Needs: author feedback** labels are typically added when there was a failure with the Pull Request that should be updated, or if the person reviewing the Pull Request has a question. |
+| **Validation-Completed** | Indicates that the test pass has been completed successfully and your **Pull Request** will be merged.|
+
+### Error Labels
+
+The following table describes the possible **error labels** that will be
+encountered. Not all of the error cases will be assigned to the ISV
+immediately. Some may trigger manual validation.
+
+
+| **Label** | **Details** |
+|--------------|-------------|
+|<img width=200/>|<img width=500/>|
+| **Binary-Validation-Error** | The application included in this **Pull Request** failed to pass the **Installers Scan** test. This test is designed to ensure that the application installs on all environments without warnings. For further details on this error, see [binary validation errors](.\binary-validation-errors.md). |
+| **Error-Analysis-Timeout** | This label indicates that the **Binary-Validation-Test** test timed out. The **Pull Request** will get assigned to a Windows Package Manager developer to look at it. |
+| **Error-Hash-Mismatch** | The submitted manifest could not be processed because the **InstallerSha256** hash provided for the **InstallerURL** did not match. Update the **InstallerSha256** in the **Pull Request** and try again. |
+| **Error-Installer-Availability** | The validation service was unable to download the installer. This may be related to Azure IP ranges being blocked, or the installer URL may be incorrect. Check that the **InstallerURL** is correct and try again. If you feel this has failed in error, please add a comment and the **Pull Request** will get assigned to a Windows Package Manager developer to look investigate. |
+| **Manifest-Path-Error** | The manifest files must be put into a specific folder structure. This label indicates a problem with the path of your submission. For example, the folder structure does not have the [required format](https://docs.microsoft.com/windows/package-manager/package/manifest?tabs=minschema%2Ccompschema). Update your manifest and path resubmit your **Pull Request**. |
+| **Manifest-Validation-Error** | The submitted manifest contains a syntax error. Address the syntax issue with the manifest and re-submit. For details on the manifest format and schema see: [required format](https://docs.microsoft.com/windows/package-manager/package/manifest?tabs=minschema%2Ccompschema). |
+| **PullRequest-Error** | The pull request is invalid because not all files submitted are under manifest folder or there is more than one package or version in the **Pull Request**. Update your **Pull Request** to address the issue and try again. |
+| **URL-Validation-Error** | The **URLs Validation Test** could not locate the URL and responded with a [HTTP error status code](https://docs.microsoft.com/troubleshoot/iis/http-status-code) (403 or 404), or the URL reputation test failed. You can identify which URL is in question by looking at the [Pull Request check details](.\winget-validation-troubleshooter.md). To address this issue, update the URLs in question to resolve the [HTTP error status code](https://docs.microsoft.com/troubleshoot/iis/http-status-code). If the issue is not due to [HTTP error status code](https://docs.microsoft.com/troubleshoot/iis/http-status-code) then you can [submit the URL for review](https://www.microsoft.com/wdsi/filesubmission/) to avoid the reputation failure. |
+| **Validation-Defender-Error** | During dynamic testing, Defender reported a problem. To reproduce this problem, install your application, then run a Defender full scan. If you can reproduce the problem, either fix the binary, or submit to this URL for false positive assistance. As stated in the following article,[Address false positives/negatives in Microsoft Defender for Endpoint Microsoft Docs](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-worldwide), you can submit your binary for analysis to the [defender analysis web page](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-worldwide#part-4-submit-a-file-for-analysis). If you are unable to reproduce, add a comment to get the Windows Package Manager developers to look at it. |
+| **Validation-Domain** | The test has determined the domain if the **InstallerURL** does not match the domain expected. The Windows Package Manager policies requires that the [InstallerUrl](https://docs.microsoft.com/windows/package-manager/package/manifest?tabs=minschema%2Ccompschema)comes directly from the ISVs release location. If you believe this is a false detection, add a comment to the **Pull Request** to get the Windows Package Manager developers to look at it. |
+| **Validation-Error** | Validation of the Windows Package Manager failed during manual approval. Look at the accompanying comment for next steps. |
+| **Validation-Executable-Error** | During installation testing, the test was unable to locate the primary application. Make sure the application installs correctly on all platforms. If your application does not install an application, but should still be included in the repository, add a comment to the **Pull Request** to get the Windows Package Manager developers to look at it.|
+| **Validation-Hash-Verification-Failed** | During installation testing, the application fails to install because the **InstallerSha256** no longer matches the **InstallerURL** hash. This can occur if the application is behind a vanity URL and the installer was updated without updating the **InstallerSha256**. To address this issue, update the **InstallerSha256** associated with the **InstallerURL** and submit again. |
+| **Validation-HTTP-Error** | The URL used for the installer does not use the HTTPs protocol. Please update the **InstallerURL** to use HTTPS and resubmit the **Pull Request.** |
+| **Validation-Indirect-URL** | The URL is not coming directly from the ISVs server. Testing has determined a redirector has been used. This is not allowed because the Windows Package Manager policies require that the[InstallerUrl](https://docs.microsoft.com/windows/package-manager/package/manifest?tabs=minschema%2Ccompschema) comes directly from the ISVs release location. Remove the redirection and resubmit.
+| **Validation-Installation-Error** | During manual validation of this package, there was a general error. Look at the accompanying comment for next steps.|
+| **Validation-Merge-Conflict** | This package could not be validated due to a merge conflict. Please address the merge conflict and resubmit your **Pull Request.**
+| **Validation-MSIX-Dependency** | The MSIX package has a dependency on package that could not be resolved. Update the package to include the missing components or add the dependency to the manifest file and resubmit the **Pull Request.**|
+| **Validation-Unapproved-URL** | The test has determined the domain if the **InstallerURL** does not match the domain expected. The Windows Package Manager policies requires that the [InstallerUrl](https://docs.microsoft.com/windows/package-manager/package/manifest?tabs=minschema%2Ccompschema) comes directly from the ISVs release location. |
+| **Validation-Unattended-Failed** | During installation, the test timed out.This most likely is due to the application not installing silently. It could also be due to some other error being encountered and stopping the test. Verify that you can install your manifest without user input. If you need assistance, add a comment to the **Pull Request** and the Windows Package Manager developers will look at it. |
+| **Validation-Uninstall-Error** | During uninstall testing, the application did not clean up completely following uninstall. Look at the accompanying comment for more details.|
+| **Validation-VCRuntime-Dependency** | The package has a dependency on the C++ runtime that could not be resolved. Update the package to include the missing components or add the dependency to the manifest file and resubmit the **Pull Request**. |
+
+### Content Policy Labels
+
+The following table lists **content policy labels**. If one of
+the following labels is added, then something in the manifest metadata
+triggered additional manual content review to ensure that the metadata
+is following the [Windows Package Manager policies](.\windows-package-manager-policies.md).
+
+| **Label** | **Details** |
+|--------------|-------------|
+|<img width=180/>|<img width=500/>|
+| **Policy-Test-2.1** |Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#21-general-content-requirements) |
+| **Policy-Test-2.2** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#22-content-including-names-logos-original-and-third-party) |
+| **Policy-Test-2.3** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#23-risk-of-harm) |
+| **Policy-Test-2.4** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#24-defamatory-libelous-slanderous-and-threatening) |
+| **Policy-Test-2.5** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#25-offensive-content) |
+| **Policy-Test-2.6** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#26-alcohol-tobacco-weapons-and-drugs) |
+| **Policy-Test-2.7** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#27-adult-content) |
+| **Policy-Test-2.8** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#28-illegal-activity) |
+| **Policy-Test-2.9** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#29-excessive-profanity-and-inappropriate-content) |
+| **Policy-Test-2.10** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#210-countryregion-specific-requirements) |
+| **Policy-Test-2.11** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#211-age-ratings) |
+| **Policy-Test-2.12** | Manual review triggered see [Windows Package Manager Policies](.\windows-package-manager-policies.md#212-user-generated-content) |
+
+### Internal Labels
+
+The following table lists the **internal errors**. When internal errors are encountered the **Pull Request** will be assigned to the Windows Package
+Manager developers to investigate:
+
+| **Label** | **Details** |
+|--------------|-------------|
+|<img width=180/>|<img width=500/>|
+|**Internal-Error-Domain**|During the domain validation of the URL, the test encountered an issue. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-Dynamic-Scan**|During the validation of the installed binaries, the test encountered an issue. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-Keyword-Policy**| During the validation of the manifest, the test encountered an issue. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-Manifest**| During the validation of the manifest, the test encountered an issue. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-NoArchitectures**| Testing encountered and issue where the test could not determine the architecture if the application. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-NoSupportedArchitectures**| Testing encountered and issue where the current architecture is not supported. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-PR**| An error occurred during the processing of the PR. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-Static-Scan**| During static analysis of the installers, the test encountered an issue. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error-URL**| During reputation validation of the installers, the test encountered an issue. A Windows Package Manager developer will take a look at it.|
+|**Internal-Error**| This indicates a generic failure or unknown error was encountered during the test pass. A Windows Package Manager developer will take a look at it.|
