SandboxTest.ps1

### Exit Codes:
# -1 = Sandbox is not enabled
#  0 = Success
#  1 = Error fetching GitHub release
#  2 = Unable to kill a running process
#  3 = WinGet is not installed
#  4 = Manifest validation error
###

[CmdletBinding()]
Param(
    # Manifest
    [Parameter(Position = 0, HelpMessage = 'The Manifest to install in the Sandbox.')]
    [ValidateScript({
            if (-Not (Test-Path -Path $_)) { throw "$_ does not exist" }
            return $true
        })]
    [String] $Manifest,
    # Script
    [Parameter(Position = 1, HelpMessage = 'The script to run in the Sandbox.')]
    [ScriptBlock] $Script,
    # MapFolder
    [Parameter(HelpMessage = 'The folder to map in the Sandbox.')]
    [ValidateScript({
            if (-Not (Test-Path -Path $_ -PathType Container)) { throw "$_ is not a folder." }
            return $true
        })]
    [String] $MapFolder = $pwd,
    # WinGetVersion
    [Parameter(HelpMessage = 'The version of WinGet to use')]
    [string] $WinGetVersion,
    # WinGetOptions
    [Parameter(HelpMessage = 'Additional options for WinGet')]
    [string] $WinGetOptions,
    # Switches
    [switch] $SkipManifestValidation,
    [switch] $Prerelease,
    [switch] $EnableExperimentalFeatures,
    [switch] $Clean
)

enum DependencySources {
    InRelease
    Legacy
}

# Script Behaviors
$ProgressPreference = 'SilentlyContinue'
$ErrorActionPreference = 'Stop' # This gets overriden most places, but is set explicitly here to help catch errors
if ($PSBoundParameters.Keys -notcontains 'InformationAction') { $InformationPreference = 'Continue' } # If the user didn't explicitly set an InformationAction, Override their preference
$script:OnMappedFolderWarning = ($PSBoundParameters.Keys -contains 'WarningAction') ? $PSBoundParameters.WarningAction : 'Inquire'
$script:UseNuGetForMicrosoftUIXaml = $false
$script:ScriptName = 'SandboxTest'
$script:AppInstallerPFN = 'Microsoft.DesktopAppInstaller_8wekyb3d8bbwe'
$script:DependenciesBaseName = 'DesktopAppInstaller_Dependencies'
$script:ReleasesApiUrl = 'https://api.github.com/repos/microsoft/winget-cli/releases?per_page=100'
$script:DependencySource = [DependencySources]::InRelease
$script:UsePowerShellModuleForInstall = $false

# File Names
$script:AppInstallerMsixFileName = "$script:AppInstallerPFN.msixbundle" # This should exactly match the name of the file in the CLI GitHub Release
$script:DependenciesZipFileName = "$script:DependenciesBaseName.zip" # This should exactly match the name of the file in the CLI GitHub Release

# Download Urls
$script:VcLibsDownloadUrl = 'https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx'
$script:UiLibsDownloadUrl_v2_7 = 'https://github.com/microsoft/microsoft-ui-xaml/releases/download/v2.7.3/Microsoft.UI.Xaml.2.7.x64.appx'
$script:UiLibsDownloadUrl_v2_8 = 'https://github.com/microsoft/microsoft-ui-xaml/releases/download/v2.8.6/Microsoft.UI.Xaml.2.8.x64.appx'
$script:UiLibsDownloadUrl_NuGet = 'https://globalcdn.nuget.org/packages/microsoft.ui.xaml.2.8.6.nupkg?packageVersion=2.8.6'

# Expected Hashes
$script:VcLibsHash = 'B56A9101F706F9D95F815F5B7FA6EFBAC972E86573D378B96A07CFF5540C5961'
$script:UiLibsHash_v2_7 = '8CE30D92ABEC6522BEB2544E7B716983F5CBA50751B580D89A36048BF4D90316'
$script:UiLibsHash_v2_8 = '249D2AFB41CC009494841372BD6DD2DF46F87386D535DDF8D9F32C97226D2E46'
$script:UiLibsHash_NuGet = '6B62BD3C277F55518C3738121B77585AC5E171C154936EC58D87268BBAE91736'

# File Paths
$script:AppInstallerDataFolder = Join-Path -Path $env:LOCALAPPDATA -ChildPath 'Packages' -AdditionalChildPath $script:AppInstallerPFN
$script:DependenciesCacheFolder = Join-Path -Path $script:AppInstallerDataFolder -ChildPath "$script:ScriptName.Dependencies"
$script:TestDataFolder = Join-Path -Path $script:AppInstallerDataFolder -ChildPath $script:ScriptName
$script:PrimaryMappedFolder = (Resolve-Path -Path $MapFolder).Path
$script:ConfigurationFile = Join-Path -Path $script:TestDataFolder -ChildPath "$script:ScriptName.wsb"

# Sandbox Settings
$script:SandboxDesktopFolder = 'C:\Users\WDAGUtilityAccount\Desktop'
$script:SandboxWorkingDirectory = Join-Path -Path $script:SandboxDesktopFolder -ChildPath $($script:PrimaryMappedFolder | Split-Path -Leaf)
$script:SandboxTestDataFolder = Join-Path -Path $script:SandboxDesktopFolder -ChildPath $($script:TestDataFolder | Split-Path -Leaf)
$script:SandboxBootstrapFile = Join-Path -Path $script:SandboxTestDataFolder -ChildPath "$script:ScriptName.ps1"
$script:HostGeoID = (Get-WinHomeLocation).GeoID

# Misc
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$script:WebClient = New-Object System.Net.WebClient
$script:CleanupPaths = @()

# The experimental features get updated later based on a switch that is set
$script:SandboxWinGetSettings = @{
    '$schema'            = 'https://aka.ms/winget-settings.schema.json'
    logging              = @{
        level = 'verbose'
    }
    experimentalFeatures = @{
        fonts = $false
    }
}

# Proxy settings
$script:Proxy = "http://localhost:57890/"
if ($env:HTTPS_PROXY) {
    $script:Proxy = $env:HTTPS_PROXY
}
elseif ($env:HTTP_PROXY) {
    $script:Proxy = $env:HTTP_PROXY
}

####
# Description: Cleans up resources used by the script and then exits
# Inputs: Exit code
# Outputs: None
####
function Invoke-CleanExit {
    param (
        [Parameter(Mandatory = $true)]
        [int] $ExitCode
    )
    Invoke-FileCleanup -FilePaths $script:CleanupPaths
    $script:WebClient.Dispose()
    Write-Debug "Exiting ($ExitCode)"
    exit $ExitCode
}

####
# Description: Ensures that a folder is present. Creates it if it does not exist
# Inputs: Path to folder
# Outputs: Boolean. True if path exists or was created; False if otherwise
####
function Initialize-Folder {
    param (
        [Parameter(Mandatory = $true)]
        [String] $FolderPath
    )
    $FolderPath = [System.Io.Path]::GetFullPath($FolderPath) # Normalize the path just in case the separation characters weren't quite right, or dot notation was used
    if (Test-Path -Path $FolderPath -PathType Container) { return $true } # The path exists and is a folder
    if (Test-Path -Path $FolderPath) { return $false } # The path exists but was not a folder
    Write-Debug "Initializing folder at $FolderPath"
    $directorySeparator = [System.IO.Path]::DirectorySeparatorChar

    # Build the path up one part at a time. This is safer than using the `-Force` parameter on New-Item to create the directory
    foreach ($pathPart in $FolderPath.Split($directorySeparator)) {
        $builtPath += $pathPart + $directorySeparator
        if (!(Test-Path -Path $builtPath)) { New-Item -Path $builtPath -ItemType Directory | Out-Null }
    }

    # Make sure that the path was actually created
    return Test-Path -Path $FolderPath
}

####
# Description: Check if user configured a credential for GitHub.
#       This can prevent users from facing "API rate limit exceeded" error.
# Inputs: None.
# Outputs: Boolean. Which represents if the credential is valid.
####
function Test-GitHubToken {
    # If a GitHub Token is present, check if it is valid.
    # If it is valid, use it for the API requests
    if ($null -ne $script:IsValidGitHubToken) {
        # If the token has already been validated in this run, it doesn't need to be re-validated
        # This assumes the token is not changing while the script is executing
        return $script:IsValidGitHubToken
    }

    if (!$env:GITHUB_TOKEN) {
        # If the environment variable doesn't exist, there is no token to validate
        # Don't query the API at all in this case
        $script:IsValidGitHubToken = $false
        return $script:IsValidGitHubToken
    }

    # The rate limit for authorized users is usually much higher than 60
    $requestParameters = @{
        Uri            = 'https://api.github.com/rate_limit'
        Authentication = 'Bearer'
        Token          = $(ConvertTo-SecureString "$env:GITHUB_TOKEN" -AsPlainText)
        Proxy          = $script:Proxy
    }

    $script:IsValidGitHubToken = (Invoke-RestMethod @requestParameters).resources.core.limit -gt 60
    return $script:IsValidGitHubToken
}

function Get-ReleasesResponse {
    if (Get-Command 'gh' -ErrorAction SilentlyContinue) {
        # If the user is logged in, use the gh cli for getting the information
        if ($(gh auth status | Out-Null; $?)) {
            return $(gh api repos/microsoft/winget-cli/releases --paginate | ConvertFrom-Json)
        }
    }

    # If the user is not logged in the API will be queried directly
    $requestParameters = @{
        Uri = $script:ReleasesApiUrl
    }

    if (Test-GitHubToken) {
        $requestParameters.Add('Authentication', 'Bearer')
        $requestParameters.Add('Token', $(ConvertTo-SecureString "$env:GITHUB_TOKEN" -AsPlainText))
    }
    else {
        # See https://docs.github.com/zh/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28#primary-rate-limit-for-unauthenticated-users
        Write-Host "WARNING: You may encounter 'API rate limit exceeded' error! Please consider adding `GITHUB_TOKEN` to your environment variable."
    }

    return Invoke-RestMethod @requestParameters
}

####
# Description: Gets the details for a specific WinGet CLI release
# Inputs: None
# Outputs: Nullable Object containing GitHub release details
####
function Get-Release {
    $releasesAPIResponse = Get-ReleasesResponse
    if (!$script:Prerelease) {
        $releasesAPIResponse = $releasesAPIResponse.Where({ !$_.prerelease })
    }
    if (![String]::IsNullOrWhiteSpace($script:WinGetVersion)) {
        $releasesAPIResponse = @($releasesAPIResponse.Where({ $_.tag_name -match $('^v?' + [regex]::escape($script:WinGetVersion)) }))
    }
    if ($releasesAPIResponse.Count -lt 1) { return $null }
    return $releasesAPIResponse | Sort-Object -Property published_at -Descending | Select-Object -First 1
}

####
# Description: Gets the content of a file from a URI
# Inputs: Remote URI
# Outputs: File Contents
####
function Get-RemoteContent {
    param (
        [Parameter(Mandatory = $true)]
        [AllowEmptyString()]
        [String] $URL,
        [String] $OutputPath = '',
        [switch] $Raw
    )
    Write-Debug "Attempting to fetch content from $URL"
    # Check if the URL is valid before trying to download
    $response = [String]::IsNullOrWhiteSpace($URL) ? @{StatusCode = 400 } : $(Invoke-WebRequest -Proxy $script:Proxy -Uri $URL -Method Head -ErrorAction SilentlyContinue) # If the URL is null, return a status code of 400
    if ($response.StatusCode -ne 200) {
        Write-Debug "Fetching remote content from $URL returned status code $($response.StatusCode)"
        return $null
    }
    $localFile = $OutputPath ? [System.IO.FileInfo]::new($OutputPath) : $(New-TemporaryFile) # If a path was specified, store it at that path; Otherwise use the temp folder
    Write-Debug "Remote content will be stored at $($localFile.FullName)"
    $script:CleanupPaths += $Raw ? @($localFile.FullName) : @() # Mark the file for cleanup when the script ends if the raw data was requested
    try {
        $script:WebClient.DownloadFile($URL, $localFile.FullName)
    }
    catch {
        # If the download fails, write a zero-byte file anyways
        $null | Out-File $localFile.FullName
    }
    return $Raw ? $(Get-Content -Path $localFile.FullName) : $localFile # If the raw content was requested, return the content, otherwise, return the FileInfo object
}

####
# Description: Removes files and folders from the file system
# Inputs: List of paths to remove
# Outputs: None
####
function Invoke-FileCleanup {
    param (
        [Parameter(Mandatory = $true)]
        [AllowEmptyString()]
        [AllowEmptyCollection()]
        [String[]] $FilePaths
    )
    if (!$FilePaths) { return }
    foreach ($path in $FilePaths) {
        Write-Debug "Removing $path"
        if (Test-Path $path) { Remove-Item -Path $path -Recurse }
        else { Write-Warning "Could not remove $path as it does not exist" }
    }
}

####
# Description: Stops a process and waits for it to terminate
# Inputs: ProcessName, TimeoutSeconds
# Outputs: None
####
function Stop-NamedProcess {
    [CmdletBinding(SupportsShouldProcess)]
    param (
        [Parameter(Mandatory = $true)]
        [String] $ProcessName,
        [int] $TimeoutMilliseconds = 30000 # Default to 30 seconds
    )
    $process = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue
    if (!$process) { return } # Process was not running

    # Stop The Process
    Write-Information "--> Stopping $ProcessName"
    if ($PSCmdlet.ShouldProcess($process)) { $process | Stop-Process -WhatIf:$WhatIfPreference }

    $elapsedTime = 0
    $waitMilliseconds = 500
    $processStillRunning = $true
    # Wait for the process to terminate
    do {
        $processStillRunning = Get-Process -Name $processName -ErrorAction SilentlyContinue
        if ($processStillRunning) {
            Write-Debug "$ProcessName is still running after $($elapsedTime/1000) seconds"
            Start-Sleep -Milliseconds $waitMilliseconds  # Wait before checking again
            $elapsedTime += $waitMilliseconds
        }
    } while ($processStillRunning -and $elapsedTime -lt $TimeoutMilliseconds)

    if ($processStillRunning) {
        Write-Error -Category OperationTimeout "Unable to terminate running process: $ProcessName" -ErrorAction Continue
        Invoke-CleanExit -ExitCode 2
    }
}

####
# Description: Ensures that a file has the expected checksum
# Inputs: Expected Checksum, Path to file, Hashing algorithm
# Outputs: Boolean
####
function Test-FileChecksum {
    param (
        [Parameter(Mandatory = $true)]
        [String] $ExpectedChecksum,
        [Parameter(Mandatory = $true)]
        [String] $Path,
        [Parameter()]
        [String] $Algorithm = 'SHA256'
    )

    # Get the hash of the file that is currently at the expected location for the dependency; This can be $null
    $currentHash = Get-FileHash -Path $Path -Algorithm $Algorithm -ErrorAction SilentlyContinue
    return ($currentHash -and $currentHash.Hash -eq $ExpectedChecksum)
}

#### Start of main script ####

# Check if Windows Sandbox is enabled
if (-Not (Get-Command 'WindowsSandbox' -ErrorAction SilentlyContinue)) {
    Write-Error -ErrorAction Continue -Category NotInstalled -Message @'
Windows Sandbox does not seem to be available. Check the following URL for prerequisites and further details:
https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview

You can run the following command in an elevated PowerShell for enabling Windows Sandbox:
$ Enable-WindowsOptionalFeature -Online -FeatureName 'Containers-DisposableClientVM'
'@
    Invoke-CleanExit -ExitCode -1
}

# Validate the provided manifest
if (!$SkipManifestValidation -and ![String]::IsNullOrWhiteSpace($Manifest)) {
    # Check that WinGet is Installed
    if (!(Get-Command 'winget.exe' -ErrorAction SilentlyContinue)) {
        Write-Error -Category NotInstalled "WinGet is not installed. Manifest cannot be validated" -ErrorAction Continue
        Invoke-CleanExit -ExitCode 3
    }
    Write-Information "--> Validating Manifest"
    $validateCommandOutput = winget.exe validate $Manifest
    switch ($LASTEXITCODE) {
        '-1978335191' {
            ($validateCommandOutput | Select-Object -Skip 1 -SkipLast 1) | Write-Information # Skip the first line and the empty last line
            Write-Error -Category ParserError 'Manifest validation failed' -ErrorAction Continue
            Invoke-CleanExit -ExitCode 4
        }
        '-1978335192' {
            ($validateCommandOutput | Select-Object -Skip 1 -SkipLast 1) | Write-Information # Skip the first line and the empty last line
            Write-Warning "Manifest validation succeeded with warnings"
            Start-Sleep -Seconds 5 # Allow the user 5 seconds to read the warnings before moving on
        }
        Default {
            $validateCommandOutput.Trim() | Write-Information # On the success, print an empty line after the command output
        }
    }
}

# Get the details for the version of WinGet that was requested
Write-Verbose "Fetching release details from $script:ReleasesApiUrl; Filters: {Prerelease=$script:Prerelease; Version~=$script:WinGetVersion}"
$script:WinGetReleaseDetails = Get-Release
if (!$script:WinGetReleaseDetails) {
    Write-Error -Category ObjectNotFound 'No WinGet releases found matching criteria' -ErrorAction Continue
    Invoke-CleanExit -ExitCode 1
}
if (!$script:WinGetReleaseDetails.assets) {
    Write-Error -Category ResourceUnavailable 'Could not fetch WinGet CLI release assets' -ErrorAction Continue
    Invoke-CleanExit -ExitCode 1
}

Write-Verbose "Parsing Release Information"
# Parse the needed URLs out of the release. It is entirely possible that these could end up being $null
$script:AppInstallerMsixShaDownloadUrl = $script:WinGetReleaseDetails.assets.Where({ $_.name -eq "$script:AppInstallerPFN.txt" }).browser_download_url
$script:AppInstallerMsixDownloadUrl = $script:WinGetReleaseDetails.assets.Where({ $_.name -eq $script:AppInstallerMsixFileName }).browser_download_url
$script:DependenciesShaDownloadUrl = $script:WinGetReleaseDetails.assets.Where({ $_.name -eq "$script:DependenciesBaseName.txt" }).browser_download_url
$script:DependenciesZipDownloadUrl = $script:WinGetReleaseDetails.assets.Where({ $_.name -eq $script:DependenciesZipFileName }).browser_download_url
Write-Debug @"

    AppInstallerMsixShaDownloadUrl = $script:AppInstallerMsixShaDownloadUrl
    AppInstallerMsixDownloadUrl = $script:AppInstallerMsixDownloadUrl
    DependenciesShaDownloadUrl = $script:DependenciesShaDownloadUrl
    DependenciesZipDownloadUrl = $script:DependenciesZipDownloadUrl
"@

# Parse out the version
$script:AppInstallerReleaseTag = $script:WinGetReleaseDetails.tag_name
$script:AppInstallerParsedVersion = [System.Version]($script:AppInstallerReleaseTag -replace '(^v)|(-preview$)')
Write-Debug "Using Release version $script:AppinstallerReleaseTag ($script:AppInstallerParsedVersion)"

# Get the hashes for the files that change with each release version
Write-Verbose "Fetching file hash information"
$script:AppInstallerMsixHash = Get-RemoteContent -URL $script:AppInstallerMsixShaDownloadUrl -Raw
$script:DependenciesZipHash = Get-RemoteContent -URL $script:DependenciesShaDownloadUrl -Raw
Write-Debug @"

    AppInstallerMsixHash = $script:AppInstallerMsixHash
    DependenciesZipHash = $script:DependenciesZipHash
"@

# Set the folder for the files that change with each release version
$script:AppInstallerReleaseAssetsFolder = Join-Path $script:AppInstallerDataFolder -ChildPath 'bin' -AdditionalChildPath $script:AppInstallerReleaseTag

# Build the dependency information
Write-Verbose "Building Dependency List"
$script:AppInstallerDependencies = @()
if ($script:AppInstallerParsedVersion -ge [System.Version]'1.9.25180') {
    # As of WinGet 1.9.25180, VCLibs no longer publishes to the public URL and must be downloaded from the WinGet release
    # Add the Zip file from the release to the dependencies
    Write-Debug "Adding $script:DependenciesZipFileName to dependency list"
    $script:AppInstallerDependencies += @{
        DownloadUrl = $script:DependenciesZipDownloadUrl
        Checksum    = $script:DependenciesZipHash
        Algorithm   = 'SHA256'
        SaveTo      = (Join-Path -Path $script:AppInstallerReleaseAssetsFolder -ChildPath $script:DependenciesZipFileName)
    }
}
else {
    $script:DependencySource = [DependencySources]::Legacy
    # Add the VCLibs to the dependencies
    Write-Debug "Adding VCLibs UWP to dependency list"
    $script:AppInstallerDependencies += @{
        DownloadUrl = $script:VcLibsDownloadUrl
        Checksum    = $script:VcLibsHash
        Algorithm   = 'SHA256'
        SaveTo      = (Join-Path -Path $script:DependenciesCacheFolder -ChildPath 'Microsoft.VCLibs.Desktop.x64.appx')
    }
    if ($script:UseNuGetForMicrosoftUIXaml) {
        # Add the NuGet file to the dependencies
        Write-Debug "Adding Microsoft.UI.Xaml (NuGet) to dependency list"
        $script:AppInstallerDependencies += @{
            DownloadUrl = $script:UiLibsDownloadUrl_NuGet
            Checksum    = $script:UiLibsHash_NuGet
            Algorithm   = 'SHA256'
            SaveTo      = (Join-Path -Path $script:DependenciesCacheFolder -ChildPath 'Microsoft.UI.Xaml.zip')
        }
    }
    # As of WinGet 1.7.10514 (https://github.com/microsoft/winget-cli/pull/4218), the dependency on uiLibsUwP was bumped from version 2.7.3 to version 2.8.6
    elseif ($script:AppInstallerParsedVersion -lt [System.Version]'1.7.10514') {
        # Add Xaml 2.7 to the dependencies
        Write-Debug "Adding Microsoft.UI.Xaml (v2.7) to dependency list"
        $script:AppInstallerDependencies += @{
            DownloadUrl = $script:UiLibsDownloadUrl_v2_7
            Checksum    = $script:UiLibsHash_v2_7
            Algorithm   = 'SHA256'
            SaveTo      = (Join-Path -Path $script:DependenciesCacheFolder -ChildPath 'Microsoft.UI.Xaml.2.7.x64.appx')
        }
    }
    else {
        # Add Xaml 2.8 to the dependencies
        Write-Debug "Adding Microsoft.UI.Xaml (v2.8) to dependency list"
        $script:AppInstallerDependencies += @{
            DownloadUrl = $script:UiLibsDownloadUrl_v2_8
            Checksum    = $script:UiLibsHash_v2_8
            Algorithm   = 'SHA256'
            SaveTo      = (Join-Path -Path $script:DependenciesCacheFolder -ChildPath 'Microsoft.UI.Xaml.2.8.x64.appx')
        }
    }
}

# Add WinGet as a dependency for itself
# This seems weird, but it's the easiest way to ensure that it is downloaded and has the right hash
Write-Debug "Adding $script:AppInstallerMsixFileName ($script:AppInstallerReleaseTag) to dependency list"
$script:AppInstallerDependencies += @{
    DownloadUrl = $script:AppInstallerMsixDownloadUrl
    Checksum    = $script:AppInstallerMsixHash
    Algorithm   = 'SHA256'
    SaveTo      = (Join-Path -Path $script:AppInstallerReleaseAssetsFolder -ChildPath $script:AppInstallerMsixFileName)
}

# If the PowerShell Module will be used, destroy the dependency list that was just created
# This is cleaner than adding if statements everywhere to try and handle this flag.
# Since the time it takes to build the dependency tree is minimal, don't worry about performance yet
if ($script:UsePowerShellModuleForInstall) {
    $script:AppInstallerDependencies = @()
}

# Process the dependency list
Write-Information "--> Checking Dependencies"
foreach ($dependency in $script:AppInstallerDependencies) {
    # On a clean install, remove the existing files
    if ($Clean) { Invoke-FileCleanup -FilePaths $dependency.SaveTo }

    # If the hash doesn't match, the dependency needs to be re-downloaded
    # If the file doesn't exist on the system, the hashes will not match since $null != ''
    Write-Verbose "Checking the hash of $($dependency.SaveTo)"
    if (!(Test-FileChecksum -ExpectedChecksum $dependency.Checksum -Path $dependency.SaveTo -Algorithm $dependency.Algorithm)) {
        if (!(Initialize-Folder $($dependency.SaveTo | Split-Path))) { throw "Could not create folder for caching $($dependency.DownloadUrl)" } # The folder needs to be present, otherwise the WebClient request will fail
        Write-Information "  - Downloading $($dependency.DownloadUrl)"
        Get-RemoteContent -URL $dependency.DownloadUrl -OutputPath $dependency.SaveTo -ErrorAction SilentlyContinue | Out-Null
    }

    # If the hash didn't match, remove the item so the sandbox can fall-back to using the PowerShell module
    if (!(Test-FileChecksum -ExpectedChecksum $dependency.Checksum -Path $dependency.SaveTo -Algorithm $dependency.Algorithm)) {
        $script:UsePowerShellModuleForInstall = $true
        Write-Debug "Hashes did not match; Expected $($dependency.Checksum), Received $((Get-FileHash $dependency.SaveTo -Algorithm $dependency.Algorithm -ErrorAction Continue).Hash)"
        Remove-Item $dependency.SaveTo -Force | Out-Null
        # Continue on these errors because the PowerShell module will be used instead
        Write-Error -Category SecurityError 'Dependency hash does not match the downloaded file' -ErrorAction Continue
        Write-Error -Category SecurityError 'Please open an issue referencing this error at https://bit.ly/WinGet-SandboxTest-Needs-Update' -ErrorAction Continue
        break # Skip processing further dependencies, since the PowerShell Module will be used
    }
}

# Kill the active running sandbox, if it exists, otherwise the test data folder can't be removed
Stop-NamedProcess -ProcessName 'WindowsSandboxClient'
Stop-NamedProcess -ProcessName 'WindowsSandboxRemoteSession'
Start-Sleep -Milliseconds 5000 # Wait for the lock on the file to be released

# Remove the test data folder if it exists. We will rebuild it with new test data
Write-Verbose "Cleaning up previous test data"
Invoke-FileCleanup -FilePaths $script:TestDataFolder

# Create the paths if they don't exist
if (!(Initialize-Folder $script:TestDataFolder)) { throw 'Could not create folder for mapping files into the sandbox' }
if (!(Initialize-Folder $script:DependenciesCacheFolder)) { throw 'Could not create folder for caching dependencies' }

# Set Experimental Features to be Enabled, If requested
if ($EnableExperimentalFeatures) {
    Write-Debug "Setting Experimental Features to Enabled"
    $experimentalFeatures = @($script:SandboxWinGetSettings.experimentalFeatures.Keys)
    foreach ($feature in $experimentalFeatures) {
        $script:SandboxWinGetSettings.experimentalFeatures[$feature] = $true
    }
}

# Copy Files to the TestDataFolder that will be mapped into sandbox
Write-Verbose "Copying assets into $script:TestDataFolder"
if ($Manifest) { Copy-Item -Path $Manifest -Destination $script:TestDataFolder -Recurse -ErrorAction SilentlyContinue }
$script:SandboxWinGetSettings | ConvertTo-Json | Out-File -FilePath (Join-Path -Path $script:TestDataFolder -ChildPath 'settings.json') -Encoding ascii
foreach ($dependency in $script:AppInstallerDependencies) { Copy-Item -Path $dependency.SaveTo -Destination $script:TestDataFolder -ErrorAction SilentlyContinue }

# Create a script file from the script parameter
if (-Not [String]::IsNullOrWhiteSpace($Script)) {
    Write-Verbose "Creating script file from 'Script' argument"
    $Script | Out-File -Path (Join-Path $script:TestDataFolder -ChildPath 'BoundParameterScript.ps1')
}

# Create the bootstrapping script
Write-Verbose "Creating the script for bootstrapping the sandbox"
@"
function Update-EnvironmentVariables {
    foreach(`$level in "Machine","User") {
        [Environment]::GetEnvironmentVariables(`$level).GetEnumerator() | % {
            # For Path variables, append the new values, if they're not already in there
            if(`$_.Name -match '^Path$') {
                `$_.Value = (`$((Get-Content "Env:`$(`$_.Name)") + ";`$(`$_.Value)") -split ';' | Select -unique) -join ';'
            }
          `$_
        } | Set-Content -Path { "Env:`$(`$_.Name)" }
    }
}

function Get-ARPTable {
    `$registry_paths = @('HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
    return Get-ItemProperty `$registry_paths -ErrorAction SilentlyContinue |
        Where-Object { `$_.DisplayName -and (-not `$_.SystemComponent -or `$_.SystemComponent -ne 1 ) } |
        Select-Object DisplayName, DisplayVersion, Publisher, @{N='ProductCode'; E={`$_.PSChildName}}, @{N='Scope'; E={if(`$_.PSDrive.Name -eq 'HKCU') {'User'} else {'Machine'}}}
}

Push-Location $($script:SandboxTestDataFolder)
Write-Host @'
--> Installing WinGet
'@
`$ProgressPreference = 'SilentlyContinue'

try {
    if ($([int]$script:UsePowerShellModuleForInstall)) { throw } # Using exceptions for control logic is generally not preferred, but is done here to keep things clean and readable
    Get-ChildItem -Filter '*.zip' | Expand-Archive
    Get-ChildItem -Recurse -Filter '*.appx' | Where-Object {`$_.FullName -match 'x64'} | Add-AppxPackage -ErrorAction Stop
    # This path is set explicitly instead of using Get-ChildItem as an error prevention measure
    Add-AppxPackage './$($script:AppInstallerPFN).msixbundle' -ErrorAction Stop
} catch {
  Write-Host -ForegroundColor Red 'Could not install from cached packages. Falling back to Repair-WinGetPackageManager cmdlet'
  try {
    Install-PackageProvider -Name NuGet -Force | Out-Null
    Install-Module -Name Microsoft.WinGet.Client -Force -Repository PSGallery | Out-Null
  } catch {
    throw "Microsoft.Winget.Client was not installed successfully"
  } finally {
    # Check to be sure it acutally installed
    if (-not(Get-Module -ListAvailable -Name Microsoft.Winget.Client)) {
      throw "Microsoft.Winget.Client was not found. Check that the Windows Package Manager PowerShell module was installed correctly."
    }
  }
  Repair-WinGetPackageManager -Version $($script:AppInstallerReleaseTag)
}

Write-Host @'
--> Disabling safety warning when running installers
'@
New-Item -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Associations' | Out-Null
New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Associations' -Name 'ModRiskFileTypes' -Type 'String' -Value '.bat;.exe;.reg;.vbs;.chm;.msi;.js;.cmd' | Out-Null

Write-Host @'
Tip: you can type 'Update-EnvironmentVariables' to update your environment variables, such as after installing a new software.
'@

Write-Host @'

--> Configuring Winget
'@
winget settings --Enable LocalManifestFiles
winget settings --Enable LocalArchiveMalwareScanOverride
Get-ChildItem -Filter 'settings.json' | Copy-Item -Destination C:\Users\WDAGUtilityAccount\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json
Set-WinHomeLocation -GeoID $($script:HostGeoID)

`$manifestFolder = (Get-ChildItem `$pwd -Directory).Where({Get-ChildItem `$_ -Filter '*.yaml'}).FullName | Select-Object -First 1
if (`$manifestFolder) {
    Write-Host @"

--> Installing the Manifest `$(`$manifestFolder | Split-Path -Leaf)

`"@
    `$originalARP = Get-ARPTable
    winget install -m `$manifestFolder --accept-package-agreements --verbose-logs --ignore-local-archive-malware-scan --dependency-source winget $WinGetOptions

    Write-Host @'

--> Refreshing environment variables
'@
    Update-EnvironmentVariables

    Write-Host @'

--> Comparing ARP Entries
'@
    (Compare-Object (Get-ARPTable) `$originalARP -Property DisplayName,DisplayVersion,Publisher,ProductCode,Scope)| Select-Object -Property * -ExcludeProperty SideIndicator | Format-Table
}

`$BoundParameterScript = Get-ChildItem -Filter 'BoundParameterScript.ps1'
if (`$BoundParameterScript) {
    Write-Host @'

--> Running the following script: {
`$(Get-Content -Path `$BoundParameterScript.FullName)
}

'@
& `$BoundParameterScript.FullName
}

Pop-Location
"@ | Out-File -FilePath $(Join-Path -Path $script:TestDataFolder -ChildPath "$script:ScriptName.ps1")

# Create the WSB file
# Although this could be done using the native XML processor, it's easier to just write the content directly as a string
Write-Verbose "Creating WSB file for launching the sandbox"
@"
<Configuration>
  <Networking>Enable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>$($script:TestDataFolder)</HostFolder>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>$($script:PrimaryMappedFolder)</HostFolder>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($script:SandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($script:SandboxBootstrapFile)'</Command>
  </LogonCommand>
</Configuration>
"@ | Out-File -FilePath $script:ConfigurationFile

if ($script:PrimaryMappedFolder -notmatch 'winget-pkgs') {
    Write-Warning @"
The mapped folder does not appear to be within the winget-pkgs repository path.
This will give read-and-write access to $($script:PrimaryMappedFolder) within the sandbox
"@ -WarningAction $script:OnMappedFolderWarning
}

Write-Information @"
--> Starting Windows Sandbox, and:
    - Mounting the following directories:
      - $($script:TestDataFolder) as read-and-write
      - $($script:PrimaryMappedFolder) as read-and-write
    - Installing WinGet
    - Configuring Winget
"@

if (-Not [String]::IsNullOrWhiteSpace($Manifest)) {
    Write-Information @"
      - Installing the Manifest $(Split-Path $Manifest -Leaf)
      - Refreshing environment variables
      - Comparing ARP Entries
"@
}

if (-Not [String]::IsNullOrWhiteSpace($Script)) {
    Write-Information @"
      - Running the following script: {
$Script
}
"@
}

Write-Verbose "Invoking the sandbox using $script:ConfigurationFile"
WindowsSandbox $script:ConfigurationFile
Invoke-CleanExit -ExitCode 0