chocolatey / chocolatey/choco

On package update, recognize and inform users if an installer script has not changed

Open
#1,911 6 comments 3 reactions 0 assignees View on GitHub
0 - Backlog 0 - Triaging Enhancement Security
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

Whenever I install or update packages using `choco`, I always review the installation scripts. This becomes very tedious on updates, because often the script itself does not change at all -- the bits that are installed change, which may mean some file names/URLs have changed, but the script that does the installation does not change, so I end up reviewing the same code over and over again, and that's just something to make my eyes glaze over and I may miss something important.

It would be very helpful if `choco`, on update, could recognize if a given script did or did not change since the last version of the package was installed, and notify me appropriately. Presumably if I trusted the script before, I trust it still, especially if it did not change. This way my `choco` updates would be much easier to review/approve, and I could focus my attention on scripts that actually changed when I update installed packages.

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by tracing the package update flow in choco and how installed package versions and installer scripts are compared; done means updates identify whether the installer script changed and inform users so unchanged scripts need not be reviewed again.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.