Move from full trust to partial trust win app

[rimutaka]

File access

The current version of the windows app is packaged to run at full trust when all it needs is:

1. access to the working directory to read .git folder with the repo
2. internet client access to submit reports
3. access to *AppData...\stackmuncher* folder to cache the reports locally, which is granted to all apps by default

The rules are stored in the application folder under *C:\Program Files\WindowsApps\stackmuncher....* as part of the package. The app has access to that by default.

According to https://docs.microsoft.com/en-us/archive/msdn-magazine/2018/may/universal-windows-platform-closing-uwp-win32-gaps#console-uwp-apps it is possible to declare the app as a console app which grants it access to the current working directory - the directory it was launched from.

I tried to follow the example, but it didn't work - the app installed, ran and tripped over access to the project dir - the current dir.

    <Application Id="stackmuncher" Executable="stackmuncher.exe" EntryPoint="Windows.PartialTrustApplication" desktop4:SupportsMultipleInstances="true" desktop4:Subsystem="console">
      <uap:VisualElements DisplayName="stackmuncher" Description="stackmuncher app" Square150x150Logo="150.png" Square44x44Logo="44.png" BackgroundColor="#999999" />
      <Extensions>
        <uap5:Extension Category="windows.appExecutionAlias" Executable="stackmuncher.exe" EntryPoint="Windows.PartialTrustApplication">
          <uap5:AppExecutionAlias desktop4:Subsystem="console">
            <uap5:ExecutionAlias Alias="stackmuncher.exe"/>
          </uap5:AppExecutionAlias>
        </uap5:Extension>
      </Extensions>
    </Application>

It is not clear if this applies to Win32 apps, but is worth trying.

Related:

• https://docs.microsoft.com/en-us/windows/uwp/files/file-access-permissions#locations-that-all-apps-can-access
• https://docs.microsoft.com/en-us/uwp/schemas/appxpackage/uapmanifestschema/element-uap5-appexecutionalias
• https://stackoverflow.com/questions/33082835/windows-10-universal-app-file-directory-access
• https://support.microsoft.com/en-us/windows/-windows-10-file-system-access-and-privacy-a7d90b20-b252-0e7b-6a29-a3a688e5c7be
• AppContainer for Win32 apps microsoft/WindowsAppSDK#219

Git access

Partially-trusted apps trip over git access because WinApps cannot launch another process. We'd need to bundle mingit with it: https://github.com/git-for-windows/git/releases and launch it from the app's folder, which is apparently allowed.
A better alternative is to use GitOxide as per #15