Windows install fails due to WDAC

[emil-mi]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

I ran into the error ::error:: Failed to extract packages during the installation. This happened using winget or the downloaded installer. Both were tryinig to install v26.1.1-3.

This error is caused by Windows Defender Application Control (WDAC) preventing the installer from unpacking an unsigned DLL (the python DLL) to %LOCALDATA%\Temp.... The WDAC is managed by my organization.

I was able to work around the issue by stringing together a set of pwsh commands that makes use of winget. This works by temporarily changing the TEMP directory.

This is a copy of a bug that was reported here: conda-forge/miniforge#863

Additional Context

No response

[marcoesters]

Does the temporary directory WDAC is complaining about happen to be _MEI + a random number?

We could set %TEMP% to something within the installer directory like we do for SH installers:

constructor/constructor/header.sh

Lines 536 to 538 in 7cbad1a

	export TMP_BACKUP="${TMP:-}"
	export TMP="$PREFIX/install_tmp"
	mkdir -p "$TMP"

But if it starts with _MEI, we may be able to set something more PyInstaller specific.

[emil-mi]

The error message that is logged is "Code Integrity determined that a process (\Device\HarddiskVolume3\Users[redacted]\AppData\Local\miniforge3_conda.exe) attempted to load \Device\HarddiskVolume3\Users[redacted]\AppData\Local\Temp_MEI463482\python313.dll that did not meet the Enterprise signing level requirements or violated code integrity policy".
I work around it by setting TMP and TEMP like this:

pwsh -NoProfile -c { $env:TEMP="c:\usr\tmp"; $env:TMP="c:\usr\tmp"; winget install CondaForge.Miniforge3 }

[marcoesters]

That's what I expected. It's the bootstrapper (conda-standalone), which is built with PyInstaller. When it's called, it extracts itself into %TEMP% while it's running - the directory always starts with _MEI.

I will be off until Tuesday, but this should not be a difficult thing to fix.