(git.install) support for Mandatory ASLR security exceptions

[escalonn]

Before starting, ensure that you have done the following.

• I have verified that there is no other issue or discussion covering the feature or enhancement
• I have verified there is no open pull request for the feature or enhancement
• I have verified the package to improve is located in this repository

What do you want to add?

Mandatory ASLR is a security feature in recent versions of Windows 10+ that is off by default. Git for Windows is unusable if it is turned on. Recent versions of the Git for Windows installer can add exceptions for the affected executables, which resolves the issue.

The package should support the relevant option, /AddmandatoryASLRsecurityexceptions=Enabled, with a package parameter.

Alternatively, the package should support /LOADINF, as e.g. ultravnc does, so that any option, including this one, can be provided to the installer.

What problem will the feature/enhancement solve?

As things stand, it's not feasible to use chocolatey to install Git for Windows on a system with Mandatory ASLR enabled, since only a manual install can set the necessary install option.

If the feature or enhancement is approved:

• I am willing to create a pull request to implement the feature or enhancement

Additional Context

No response

[pauby]

I don't see what the installer argument is here (I didn't dig too far as I was hoping it would be provided).

Can you pass the installer argument using --install-args?

[escalonn]

like my post (and the second link in my post) indicated, the argument is AddmandatoryASLRsecurityexceptions=Enabled. like the other installer arguments, it seems to want a /o: prefix (I'm just following the choco package script here).

I'd never heard of --installargs before. yes, that seems to work. I'm not certain I've put it together right and I'd rather not entirely uninstall to test, but this command for example seems to be working for me in pwsh.

choco upgrade git.install -y -f --params="/GitOnlyOnPath /WindowsTerminal /NoShellIntegration /WindowsTerminalProfile /Symlinks /DefaultBranchName:master /Editor:Nano /FSMonitor" --ia="/o:GitPullBehaviorOption=FFOnly /o:AddmandatoryASLRsecurityexceptions=Enabled"

Now if only Chocolatey GUI weren't broken to this day with upgrades and package parameters, I might be able to run that command just once instead of every release.

[pauby]

I'd never heard of --installargs before. yes, that seems to work.

Providing package parameters is not intended to replicate every argument that can be passed to the installer. The --install-args option allows you to pass arguments directly to the installer. If you want to raise a PR to have this one added, it would be appreciated.

Now if only Chocolatey GUI weren't broken to this day with upgrades and package parameters, I might be able to run that command just once instead of every release.

That would be something to raise over on the [ChocolateyGUI repository](https://github.com/chocolatey/chocolateygui].