Windows 10: How secure is Microsoft Windows "Winget" Package Manager

Jayden MagicCrayon9342 · Sep 28, 2020

I got interested in Microsoft's new package manager for Windows called Winget. I installed it and I really like the wide range of software available. However, I question the security of these repositories Winget is installing apps from. How secure are these repositories and can a generic antivirus scan these installed packages?

:)

Brink · Sep 28, 2020

Windows Package Manager Preview v0.2.2521 released

We have been humbled by all the positive support for the Windows Package Manager. You have taken us from zero to over one thousand packages in six months. This is an amazing start to the beginning of an open Windows catalog. Thank you!

Our newest feature is support for installing Apps from the Microsoft Store. Yes, you read that correctly. Our goal is to make it easier to install software on Windows. We also recently released tab completion in PowerShell, and a feature toggle. As we work towards building our 1.0 version I wanted to share the next few features along the roadmap. Our immediate focus is on rounding out critical features. These include list, upgrade, uninstall, and import/export.

I also wanted to share some thoughts we had leading up to Ignite in terms of future enterprise features. We will be enabling Group Policy support so IT professionals can ensure they have the ability to successfully manage their environments. Additional features included in the category of enterprise support are delivery optimization, metered networks, proxy support, and parallel downloads.

What’s New

Feature Toggle

If you would like to try out experimental features, use winget settings to open your default JSON editor. If you don’t have one I’d reccomend running winget install vscode. From there you can enable or disable features. I’ve included an example configuration below with our two experimental features for testing purposes (experimantalCMD, and experimentalArg) as well as the “experimentalMSStore” feature.

Experimental Feature Settings

Once you’ve enabled the experimentalCMD and the experimentalArg, execute winget experimental --arg to see an example. There is a little “Easter Egg” in the “flag”.

PowerShell autocomplete

You’re going to want to see this next feature in action on your machine. Head on over to the instructions and configure your PowerShell profile, I’ll wait. If the image below doesn’t play, please click on it.

I told you I’d wait. We don’t like unnecessary typing either. This quickly became my favorite way to figure out which versions of a package are available. Type winget[space][tab][space]pow[tab][space]-v[space][tab][tab][tab] and voila.

Microsoft Store

One of our most requested features was the ability to install Apps from the Microsoft Store. We’ve taken the first steps on this journey by adding a curated list of about 300 Apps to a new source. These apps are all free and rated E for everyone. Once you enable the experimental feature, we will automatically add the source for the store manifests. The search will span multiple sources to show results. Below, you will see results for winget search nightingale.

Next you will see the installation from the command winget install "Nightingale REST Client".

What’s Next

List

One of the critical features of a package manager is the ability to see what’s been installed. Our challenge here is to include Apps that may have been installed outside of the package manager and are available in the Control Panel or via Add Remove Software. We didn’t want to just consider what was installed via the Windows Package Manager. We will, however, keep track of what we installed so we can help you keep things upgraded to the current version.

Upgrade

Speaking of upgrade, wouldn’t it be nice if you could just winget upgrade powershell or winget upgrade and have all your apps upgraded. We thought so too. One of our more vocal (and helpful) community members (@megamorf) also pointed out you don’t always want a package upgraded. We’re going to give you the option to pin a package to a specific version, so it doesn’t get changed on you.

Uninstall

Sometimes you don’t need or want an app anymore. Generally, in my case, I want the space back on my C: drive. winget uninstall "some giant app" would come in handy. It would be cool if it could remove things that were installed outside of the package manager, so we’re going to see about getting that to work as well.

Import / Export

We couldn’t pass up the opportunity to perform a little more magic for the sake of convenience. It’s getting close to the time where I’ll be getting a new machine for work. I’m looking forward to be able to winget export packages.json from this computer and winget import packages.json on the new one. I’m looking forward to being able to share the results of that one with you.

How to get the Windows Package Manager

If you are a Windows Insider or part of our Package Manager Insider program, you should already have the latest version. Launch the store and check for updates if you’re an insider and you don’t have it. If you prefer to just download the client, head on over to GitHub releases page and take it for a spin. You can also join the Windows Package Manager Insider Program if you’d like automatic updates from the store, and you want to run on the released version of Windows 10.

Be sure to check out the GitHub client issues and add a “+1” to any features you’d really like to see.

Demitrius Nelon

Senior Program Manager
Click to expand...

Source: https://devblogs.microsoft.com/comma...iew-v0-2-2521/

Tweet

— Twitter API (@user) View on Twitter

Brink · Sep 28, 2020

Microsoft announces Windows Package Manager Preview for Windows 10

We are thrilled to announce the Windows Package Manager preview!

If you’re already familiar with what a package manager is, feel free to skip this paragraph. If you’re still reading, you’re going to love this! A package manager is designed to help you save time and frustration. Essentially, it is a set of software tools that help you automate the process of getting software on your machine. You specify which apps you want installed, and it does the work of finding the latest version (or the exact one you specified) and installing it on your machine.

Just about every developer has wanted a native package manager in Windows. That day is finally here. You are going to be able to winget install your way to bliss. One of the best parts is that it is open source. I had to pinch myself when I was able to winget install terminal, and then winget install powershell, and then winget install powertoys. You get the idea, and If you do not see an app you use, just create a new manifest, and submit a pull request.

When can I try it?

As of today, the Windows Package Manager preview has been made open source. You can clone, build, run and test the code from the GitHub repository (GitHub - microsoft/winget-cli: Windows Package Manager CLI (aka winget)). There are other possibly easier ways to get your hands on it if that doesn’t sound appealing. Please continue reading.

What functionality is included?

You can install any app with a valid manifest (even local ones -- manifest). The command line client “winget.exe” is already pre-configured to point to the Microsoft community repository. That means you can install any package with a manifest that has been published.
Have you ever had to completely re-install all your apps and tools on your PC? How long did it take? How did you remember where to go to find, download, and install all your editors & IDEs, languages & runtimes, source control tools, etc.?

Did you enjoy it? Yeah, neither did we … which is why we created Windows Package Manager.

Now you can install all your favorite apps & tools simply by typing winget install <foo> into your command-line. Or better still, you can create a script file that installs ALL your tools while you sit back enjoy a well-earned coffee break!”
You can search for available packages and display information using the show command. There are also commands to help with manifest creation and validation (hash and validate). Once the first third-party repository is published, you will be able to add that repository as a source as well. We’re providing documentation at Windows Package Manager and both of the GitHub repositories.

How do I get it?

We have provided three different ways for you to get your hands on the Windows Package Manager. If you are a Windows Insider, you may already have it. First, you can head over to the open source GitHub repository for the client. Second, you can join any of the Windows Insider rings. Third, you can join the Windows Package Manager Insider program by sending your Microsoft Account (MSA) to L: [email protected] and request to be included in the preview. Either of the Insider programs will ensure you automatically receive updates as we progress from preview to general availability. After you have joined either Insider program, head over to the Microsoft Store and get the App Installer. The Windows Package manager will be available after you get the update.

Why not contribute to another open source package manager?

We looked at several other package managers. There were several reasons leading us to create a new solution. One critical concern we had was how to build a repository of trusted applications. We are automatically checking each manifest. We leverage SmartScreen, static analysis, SHA256 hash validation and a few other processes to reduce the likelihood of malicious software making its way into the repository and onto your machine. Another key challenge was all the changes required to be able to deliver the client program as a native Windows application.

Which versions of Windows will be supported?

Windows Package Manager will support every Windows 10 version since the Fall Creators Update (1709)! The Windows Package Manager will be delivered with the Desktop App Installer when we ship version 1.0. If you are building software to run on Windows 10 you will have a simple way for your customers to install your software on billions of machines.

But what about…

We are expecting you have plenty of questions. What does this mean for the Windows store? It doesn’t mean anything for the Windows store. The Windows Package Manager is a command line interface, no marketing, no images, no commerce. Although we do plan on making those apps installable too.

What about insert any other package manager here? We think they are great. If they want to leverage our repository of validated packages, they can. If they want to see how we are doing it, it is open source. We’re open to feedback and suggestions.

We have already talked with a few of the well-known package manager teams. Chocolatey has a vibrant community with a massive collection of applications, and a rich history supporting both open source and enterprise customers. Scoop provides a convenient way to allow software to be installed without the UAC popups. Ninite keeps an eye on updates for all the apps it installed. There are many others like AppGet, Npackd and the PowerShell based OneGet package manager-manager.

If you are happy with your current package manager, keep using it. Our goal is to make installing software on Windows better for everyone.

What’s next?

We have a long list of features we think you will like. Take a look at the list of issues we have already created on GitHub. Be sure to +1 any issues you feel strongly about. If you do not see something, and you would like us to consider it, just create a new issue.

Demitrius Nelon

Senior Program Manager
Click to expand...

Source: https://devblogs.microsoft.com/comma...nager-preview/

See also: Windows Package Manager Client at GitHib

Brink · Sep 28, 2020

Windows Package Manager v0.2.2521 Preview released

Experimental support for a curated list of store apps for developers.

New Features

#535 Replace yaml-cpp with libyaml
#544 Add pre-indexed Microsoft Store source

winget features will show the status of the Microsoft Store Support.
winget settings will launch the settings file in your default JSON editor.

Add the following code block to your settings file and the store source will be added

Code:

{
"experimentalFeatures": {
"experimentalMSStore": true
}

}
Click to expand...

Click to expand...

Source: Releases . microsoft/winget-cli . GitHub

Windows 10: How secure is Microsoft Windows "Winget" Package Manager

How secure is Microsoft Windows "Winget" Package Manager

How secure is Microsoft Windows "Winget" Package Manager

How secure is Microsoft Windows "Winget" Package Manager

How secure is Microsoft Windows "Winget" Package Manager - Similar Threads - secure Microsoft Winget

Install Microsoft .NET with the Windows Package Manager winget

Is it possible for windows package manager/winget to be compromised and push out an update...

Is it possible for windows package manager/winget to be compromised and push out an update...

Winget package manager

Is there a tutorial to submit packages in Windows package manager winget?

Windows Package Manager (WinGet) v0.3.11201 Preview released

Windows Package Manager (WinGet) v0.3.11102 Preview released

Winstall is a (web) GUI for Windows Package Manager (winget)

How to Install WinGet Windows Package Manager