Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dismiss the use of symlinks on Windows #1397

Closed
rcsilva83 opened this issue Dec 7, 2022 · 2 comments · Fixed by #1755
Closed

Dismiss the use of symlinks on Windows #1397

rcsilva83 opened this issue Dec 7, 2022 · 2 comments · Fixed by #1755

Comments

@rcsilva83
Copy link

I think it would be a huge security enhancement if Volta didn't make use of symlinks on Windows. Microsoft discourages the use of symlinks, for security reasons, and Developer Mode (which is recommended by Volta) enables much more than just symlinks, many of them are undesirable.

It looks like the main Volta logic is implemented by code and the symlink could be easily replaced by a call to volta-shim. Actually, I made a test replacing rimraf's symlink by a renamed copy of volta-shim and it worked.

If this issue makes sense for the Volta team, I can start working on a PR with this implementation.

PS: this idea came from #964

@rcsilva83
Copy link
Author

As discussed on Discord, an alternative to symlink on Windows already used on projects like Scoop, pnpm and fnm are NTFS juntions. The main drawback of NTFS junctions is it can only be used for directory and it would be necessary another solution for files.

@rcsilva83 rcsilva83 changed the title Dismiss the use of symlinks (specially on Windows) Dismiss the use of symlinks on Windows Dec 13, 2022
@supuwoerc
Copy link

I think it would be a huge security enhancement if Volta didn't make use of symlinks on Windows. Microsoft discourages the use of symlinks, for security reasons, and Developer Mode (which is recommended by Volta) enables much more than just symlinks, many of them are undesirable.

It looks like the main Volta logic is implemented by code and the symlink could be easily replaced by a call to volta-shim. Actually, I made a test replacing rimraf's symlink by a renamed copy of volta-shim and it worked.

If this issue makes sense for the Volta team, I can start working on a PR with this implementation.

PS: this idea came from #964

That's a good idea. I also had a problem with Volta not being available due to permission issues on the company machine. I think it's due to lack of access

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants