{"record":{"id":"8f8dc0c4555b8cd9","repo":"chocolatey/choco","slug":"custom-unofficial-builds-are-not-allowed-by-defau","errorCode":null,"errorMessage":"\nCustom unofficial builds are not allowed by default.\n To override this behavior, explicitly set --allow-unofficial.\n See the help menu (choco --help) for options.","messagePattern":"\nCustom unofficial builds are not allowed by default\\.\n To override this behavior, explicitly set --allow-unofficial\\.\n See the help menu \\(choco --help\\) for options\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/chocolatey/infrastructure.app/runners/GenericRunner.cs","lineNumber":99,"sourceCode":"                EnvironmentSettings.SetEnvironmentVariables(config);\r\n\r\n                this.Log().Debug(() => \"Configuration: {0}\".FormatWith(config.ToString()));\r\n\r\n                if (isConsole && (config.HelpRequested || config.UnsuccessfulParsing))\r\n                {\r\n#if DEBUG\r\n                    Console.WriteLine(\"Press enter to continue...\");\r\n                    Console.ReadKey();\r\n#endif\r\n                    Environment.Exit(config.UnsuccessfulParsing ? 1 : 0);\r\n                }\r\n\r\n                var token = Assembly.GetExecutingAssembly().GetPublicKeyToken();\r\n                if (string.IsNullOrWhiteSpace(token) || !token.IsEqualTo(ApplicationParameters.OfficialChocolateyPublicKey))\r\n                {\r\n                    if (!config.AllowUnofficialBuild)\r\n                    {\r\n                        throw new Exception(@\"\r\nCustom unofficial builds are not allowed by default.\r\n To override this behavior, explicitly set --allow-unofficial.\r\n See the help menu (choco --help) for options.\");\r\n                    }\r\n                    else\r\n                    {\r\n                        this.Log().Warn(config.RegularOutput ? ChocolateyLoggers.Important : ChocolateyLoggers.LogFileOnly, @\"\r\nChocolatey is not an official build (bypassed with --allow-unofficial).\r\n If you are seeing this message and it is not expected, your system may\r\n now be in a bad state. Only official builds are to be trusted.\r\n\"\r\n                        );\r\n                    }\r\n                }\r\n            }\r\n\r\n            return command;\r\n        }\r","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/chocolatey/choco/blob/0d5abdd10cc177a141e69547cad6935b419b6c17/src/chocolatey/infrastructure.app/runners/GenericRunner.cs#L81-L117","documentation":"Thrown by GenericRunner when the executing assembly's public key token does not match ApplicationParameters.OfficialChocolateyPublicKey (i.e., it is a custom/unofficial build) and config.AllowUnofficialBuild is false. Chocolatey enforces build authenticity by checking the strong-name signing token, preventing unofficially compiled binaries from running by default. This is a security/trust measure.","triggerScenarios":"Running a self-compiled or modified Chocolatey binary without the official signing key. Running a debug or dev build. Running a fork or custom build without explicitly opting in. The assembly has no public key token at all (unsigned). The token differs from the official key.","commonSituations":"Developer builds Chocolatey from source for testing or contribution. CI pipeline compiles and runs Chocolatey from a PR branch. Fork maintainer distributes a custom build. Someone runs a tampered or unofficially modified binary.","solutions":["If this is intentional (development/testing), pass --allow-unofficial to bypass the check","Use an official Chocolatey build downloaded from the official source for production","Sign the custom build with the official key if you have access (internal Chocolatey team only)","Set config.AllowUnofficialBuild = true programmatically for test harnesses"],"exampleFix":"// before (custom build)\nchoco install mypackage\n// throws: Custom unofficial builds are not allowed by default.\n\n// after (custom build - explicit opt-in)\nchoco install mypackage --allow-unofficial","handlingStrategy":"validation","validationCode":"// For custom builds, set AllowUnofficialBuild before running\nif (!IsOfficialBuild())\n{\n    config.AllowUnofficialBuild = true;\n    Console.Warning(\"Running unofficial build. Set --allow-unofficial to proceed.\");\n}\n// CLI: always pass --allow-unofficial for dev builds\n// choco install mypackage --allow-unofficial","typeGuard":null,"tryCatchPattern":"try\n{\n    runner.Run(config, container, isConsole, parseArgs);\n}\ncatch (Exception ex) when (ex.Message.Contains(\"unofficial\"))\n{\n    logger.Error(\"Unofficial build detected. Add --allow-unofficial to bypass.\");\n    Environment.Exit(1);\n}","preventionTips":["For development/custom builds, always pass --allow-unofficial","For production, use only official Chocolatey builds from the official download source","Set config.AllowUnofficialBuild = true in test harnesses","Do not distribute unofficial builds without the --allow-unofficial opt-in documented"],"tags":["security","build-authenticity","signing","unofficial-build","configuration"],"backgroundTag":null,"analyzedSha":"0d5abdd10cc177a141e69547cad6935b419b6c17","analyzedAt":"2026-08-13T18:33:03.301Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}