Vcpkg 2018.11.23-nohash

[ras0219-msft]

As part of installing packages, vcpkg downloads several external executables such as nuget.exe and 7-zip. 7-zip specifically is downloaded from NuGet.org as a NuGet package and then unpacked locally.

To protect users from malicious executables, the vcpkg system has hashes checked in for every file that is externally downloaded. Unfortunately, NuGet.org has just modified all existing packages to include signature files inside the zip, which changes the hash.

We have fixed this issue in Vcpkg master[1], however since appveyor uses an older copy it will not have these fixes until the next image update.

These are the possible mitigation strategies I see:

1. Mint a new image with the new vcpkg version
2. Before spinning up a windows build, run git pull && ./bootstrap-vcpkg.bat in the vcpkg tool folder. This avoid minting a new image but requires adding startup time to every build. If you want to pull a specific commit with the fix, use 068032bc548817a04709970f76268a6d7b1767c7.
3. Recommend to users that they do x86 java #2 before their builds -- this will still cause disruption for users because they need to see at least one of their builds fail, search, and eventually stumble upon this issue.

A longer-term mitigation against issues like this in the future would be to recommend in the appveyor docs on vcpkg that users explicitly pull new versions before running their build.

[1] microsoft/vcpkg#4663

[IlyaFinkelshteyn]

@ras0219-msft will add this to next image update, Unfortunately we started distribution of new image yesterday and it is already late to get into this train. Next one should not take too long. As you see I am updating documentation, and you are welcome to contribute too :)

[FeodorFitsner]

Updating vcpkg:

cd "C:\Tools\vcpkg"
git pull
.\bootstrap-vcpkg.bat

[IlyaFinkelshteyn]

New Windows images deployed