microsoft / microsoft/winget-cli

Better Respect Package installation sources

Open
#4,803 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature
Dominant language
C++
Stars
26.4k
Forks
1.8k
Avg merge
1d 11h
Merged PRs (30d)
15

Description

Description of the new feature / enhancement

Currently winget list seems to list all installed applications, and in many cases this is great.
However it is not currently respecting that other tooling, like chocolatey, SCCM, intune or other package management solutions, may be in use for management of applications in estates already (like it is in mine) or that the application may have been manually installed as part of a short functionality test & should not become a winget manageable application which may be internal software or may be software installed direct from the web to have a quick nosy at it & see if it is worth keeping longer term.

It therefore would be handy to be able to specify for winget to only return applications that have been installed by it, so that any upgrade cycles that orgs and users have in place aren't fighting with winget & importantly if an org decides they are limiting the roll out of versions of software like Visual Studio or Office or other inner sourced version that need security team sign off & that process to allow use of newer versions isn't getting bypassed by how winget is currently blindly assuming that any installed application that matches a package listed in the winget packages repo is fair game for being auto managed by winget going forward.

Adding this feature will help IT Admins, Developers & Security teams in being able plan out whether they are going to migrate application management entirely to winget or keep what they currently have & allow winget for new packages & keep existing ones in their tooling of choice. Especially if this is a mixed environment with other Microsoft tooling like Intune, or SCCM, PowerShell DSC, Azure Machine Config or other 3rd party tools.

This was found as part of me trying to look into what was happening with how PowerShell can be released & available on winget and unable updated due to a package ID mismatch thanks to a previous update via Microsoft Update as discovered in this PowerShell issue & noticing that all my chocolatey installed applications show, whether or not there is an update available on winget or not.

#1488 - I think is a potential starter for this with the priority scale however there will be times when you want to set a per package ID source priority , example being you may be testing out an internal vendor build of an application to verify a bug fix prior to them releasing to either winget or their main package source feed.

Proposed technical implementation details
  • implement a InstalledByWinget attribute for packages
  • on find a package should be returned with a warning note of not installable via winget if the ID matches the install was via another source that winget cannot pass an install request off to
  • on install a package should check if it is managed elsewhere and throw an error to the user if install is attempted unless admin settings allow the user to override the previous installation source (I.e to allow winget to manage it)
  • on listing installed packages, it should check this store, prior to mapping the source as winget & if not via winget, should return unknown, unless winget adds ability for other package management tools to show as sources
  • on upgrade, a package that was installed via other means but is available via winget should prompt for user input on whether this should now be managed by winget, unless it is already deemed managed via another package manager & ideally delist it as a managed package from the other package manager as not to have conflicts between them
  • enable option to delist from winget a package that was once installed by it, as it has a self updating mechanism that is already in use so no longer needs maintaining by winget (should stay in the store as having initially been installed by winget)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source files, tests, or entry points are named. Start by tracing how installed packages are listed and how their source is mapped, then review the related proposal in #1488. Done means defining and implementing a consistent installed-by-winget state across find, install, list, and upgrade without conflicting with other management tools.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.