WinGet (Windows Package Manager)

repository·master·Indexed 12 days ago

https://github.com/microsoft/winget-cli

A command-line tool for discovering, installing, and managing software packages on Windows via the Microsoft Store and community repositories. Includes documentation on installation, troubleshooting, the Microsoft.WinGet.Client PowerShell module, COM APIs for C++ and C#, and package manifest JSON schemas.

Tokens
113.5K
Snippets
357
Records
532
Agent score
98%

What's inside WinGet

  1. Manage WinGet repositories with the source command

    master

    The source command manages the repositories (sources) that WinGet uses to discover and install applications. You can use it to add, remove, list, and update sources.

    Note: The source command is currently intended for internal use only. Additional sources are not supported at this time.

    Warning: Only add a new source if you trust it as a secure location.

    winget source [<command>] [<options>]
  2. Understand Windows Package Manager Repository Product Policies

    master

    When submitting a "Product" (apps, games, titles, or additional content) to the Windows Package Manager repository via a Pull Request, your submission must adhere to specific Product Policies.

    Key principles for submissions include:

    • Distinct Value: Provide a compelling reason for users to download the product via the repository rather than other sources.
    • Accurate Representation: Do not mislead customers regarding the product's capabilities or the identity of the provider.
    • Integrity: Fraudulent activity, including rating/review manipulation or attempts to cheat the ecosystem, is strictly prohibited.

    If you have feedback regarding these policies, you can submit it via the GitHub issues forum.

  3. Use the Microsoft.Management.Configuration API

    master

    The Microsoft.Management.Configuration API allows developers to programmatically manage configuration sets, check for conflicts, and apply configurations with progress monitoring.

    Key workflows include:

    • Loading Configurations: Use ConfigurationProcessor.OpenConfigurationSet to load a configuration from a file.
    • Conflict Detection: Use ConfigurationProcessor.CheckForConflicts to identify overlapping or contradictory settings between multiple configuration sets.
    • Applying Configurations: Use ConfigurationProcessor.ApplySetAsync to apply a configuration set asynchronously. This method supports progress reporting via the Progress property on the returned operation.
    • Monitoring Changes: Subscribe to ConfigurationProcessor.ConfigurationChange to watch for additions, state changes, or removals of configuration sets, and ConfigurationSet.ConfigurationSetChange to watch for changes within a specific set.
    using Microsoft.Management.Configuration;
    
    // Example workflow: Load, Check Conflicts, and Apply
    ConfigurationProcessor processor = new ConfigurationProcessor(factory);
    ConfigurationSet configSet = processor.OpenConfigurationSet(file);
    
    // Check for conflicts
    var conflicts = processor.CheckForConflicts(new List<ConfigurationSet> { configSet }, true);
    
    // Apply with progress
    var operation = processor.ApplySetAsync(configSet, ApplyConfigurationSetFlags.None);
    operation.Progress = (data) => { /* Handle progress */ };
    await operation.AsTask();
  4. Enable RegFree WinRT for non-packaged desktop applications

    master

    Undocked RegFree WinRT allows non-packaged desktop applications to leverage user-defined Windows Runtime (WinRT) types using application manifests. This is particularly useful for supporting older OS versions (down to Windows 8.1), as Windows 10 19h1 and later support this feature natively.

    The package uses the Detours library to detour RoActivateInstance, RoGetActivationFactory, RoGetMetadataFile, and RoResolveNamespace to reimplement the RegFree WinRT feature.

    Setup:

    1. The package automatically places winrtact.dll into your build folder alongside your executable.
    2. Native Code: Initialization is handled automatically via ForceSymbolReferences.
    3. Managed Code: You must manually initialize the library by calling Microsoft.Windows.UndockedRegFreeWinrt.Initialize(); to initialize the detours and load the catalog.
    // For Managed code initialization
    Microsoft.Windows.UndockedRegFreeWinrt.Initialize();
  5. Use the Windows Package Manager Configuration PowerShell Module

    master

    The Windows Package Manager Configuration PowerShell Module allows you to manage WinGet configurations via PowerShell. It consists of two main components: Microsoft.WinGet.Configuration.Cmdlets (the cmdlet implementations) and Microsoft.WinGet.Configuration.Engine (the core logic).

    Prerequisites

    • PowerShell Version: Minimum version 7.2.8.

    Available Cmdlets

    • Get-WinGetConfiguration: Retrieves configuration from a file.
    • Get-WinGetConfigurationDetails: Retrieves details for a specific configuration set.
    • Invoke-WinGetConfiguration: Executes a configuration.
    • Start-WinGetConfiguration: Starts a configuration process.
    • Complete-WinGetConfiguration: Completes a configuration job.

    Telemetry Configuration

    Telemetry is enabled by default. To disable it, set the POWERSHELL_TELEMETRY_OPTOUT environment variable to 1, yes, or true.

  6. Overview of vcpkg port overlays

    master

    The src/VcpkgPortOverlay directory contains custom vcpkg ports used by the project. These ports are mostly derived from the official vcpkg registry but include small, necessary modifications such as:

    • Custom patches: Adding functionality like certificate pinning.
    • Specific versions/commits: Using specific source commits to ensure compatibility (e.g., ARM64 support) or to fix vulnerabilities.
    • Custom configurations: Disabling specific build components like tests or samples.
    • Non-registry ports: Including ports that do not exist in the official vcpkg registry (e.g., sfs-client).
  7. Understand winget list output enhancements

    master

    The winget list command provides a tabular view of installed packages. Enhanced functionality includes:

    • Available Versions and Sources: For every package in configured sources, the output displays the 'Available' version and the 'Source' it belongs to. If a package is available from multiple sources, the first configured source is displayed.
    • Source Filtering: Using -s <source> reduces the list to only packages available from that specific source.
    • Unmanaged Apps: Using -u or --unavailable displays apps installed in Add/Remove Programs that do not match any configured WinGet source.
  8. How ZIP archive installation works

    master

    When WinGet encounters a package with a ZIP installer type, it follows this execution flow:

    1. Threat Detection: Scans the downloaded ZIP for malware/compression bombs (unless bypassed).
    2. Extraction: Extracts the top-level contents of the ZIP to a temporary location using Windows Shell APIs. Note that nested archives (archives within archives) are not currently supported; the NestedInstallerFile must reside at the top level of the ZIP.
    3. Execution: Executes the installation flow based on the specified NestedInstallerType (e.g., running an .exe or .msi found inside the extracted folder).

    For portable applications bundled in an archive, WinGet maintains a metadata table of all created files (paths, flags, hashes, and symlink targets) to enable proper uninstallation and verification, rather than relying solely on standard ARP entries.

  9. Windows Package Manager Content Policies

    master

    When submitting a Product to the Windows Package Manager repository, all content and metadata must adhere to strict safety and appropriateness standards. This includes the Product name, publisher name, icons, descriptions, screenshots, trailers, and any content delivered from a server that the Product connects to.

    Age Rating Requirements

    • Metadata and accompanying content must merit a rating of PEGI 12, ESRB EVERYONE 10+, or lower.
    • If the Product provides content (such as user-generated or web-based content) that might require a higher age rating, you must implement a content filter or require users to sign in with a preexisting account to opt-in to that content.

    Intellectual Property

    • All content in the Product and associated metadata must be originally created by the application provider, appropriately licensed from third-party rights holders, or used as permitted by law.

    Prohibited Content

    Products must not contain content that:

    • Facilitates or glamorizes extreme violence, human rights violations, illegal weapons, or violence against persons/animals/property.
    • Poses a safety risk, injury risk, or damage risk to users or property.
    • Is defamatory, libelous, slanderous, or threatening.
    • Is offensive, sensitive, or advocates discrimination/hatred based on race, ethnicity, gender, religion, etc.
    • Facilitates excessive/irresponsible use of alcohol, tobacco, drugs, or weapons.
    • Is pornographic or sexually explicit.
    • Encourages or glamorizes illegal real-world activity.
    • Contains excessive profanity or obscene material.

    Regional Compliance

    • Content must not be offensive in any country/region to which the Product is targeted. This includes respecting local laws and cultural norms (e.g., specific prohibitions in China regarding sexual content or disputed territory references).
  10. Understand Pure C API return values

    master

    When using the C API:

    • pure_zip(): Returns 0 if the ZIP file is clean. Returns a non-zero error code if anomalies are detected.
    • pure_zip_bomb(): Returns 1 if the error code indicates a ZIP bomb, otherwise returns 0.
    • pure_error_code(): Returns the constant name (e.g., PURE_E_ZIP_BOMB_FIFIELD) of the error code.
    • pure_error_string(): Returns the human-readable error message string for the given error code.
  11. Understand the Microsoft.Management.Configuration API model

    master

    The Microsoft.Management.Configuration API enables 'Developer+' configuration scenarios by allowing interaction with configuration sets.

    Core Abstractions

    • Configuration Set: A self-contained group of configuration units operated on together. You can author new sets, load existing ones from a stream, or load previously applied sets from local history.
    • Configuration Unit: The smallest actionable configuration element within a set. Each unit describes individual configurable items and their values.

    Configuration Actions

    Every configuration unit performs three primary actions:

    1. Test: Determines if the current system state matches the described state.
    2. Get: Extracts the current system state relative to the configuration scope.
    3. Set: Applies the described state to the system.

    Monitoring Changes

    The API supports multiple processes watching for state changes. You can subscribe to the ConfigurationSet.ConfigurationSetChange event to monitor changes to both the configuration set lifetime and the individual configuration unit states.