microsoft / microsoft/winget-create
Auto-detect PackageDependencies from installer PE import table
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 651
- Forks
- 114
- Avg merge
- 7h 52m
- Merged PRs (30d)
- 3
Description
Description of the new feature / enhancement
When a package links against common runtimes like VCRedist or .NET, the
PackageDependencies field must be filled in manually. There's no tooling
to catch missing dependencies, so publishers often omit them unknowingly
and only find out during PR review when a maintainer flags it causing
unnecessary roundtrips.
winget-create already downloads the installer/executable, so it has everything it
needs to detect this automatically.
Proposed technical implementation details
After downloading the installer, if it's a PE binary (.exe/.dll), parse
its import table using System.Reflection.PortableExecutable.PEReader
and match imported DLLs against a known mapping:
| Imported DLL | WinGet Package |
|---|---|
VCRUNTIME140.dll |
Microsoft.VCRedist.2015+.x64 |
MSVCP140.dll |
Microsoft.VCRedist.2015+.x64 |
VCRUNTIME140.dll (x86 binary) |
Microsoft.VCRedist.2015+.x86 |
MSVCP140.dll (x86 binary) |
Microsoft.VCRedist.2015+.x86 |
VCRUNTIME140_1.dll |
Microsoft.VCRedist.2015+.x64 |
If a match is found, either auto-populate PackageDependencies in the
generated manifest, or prompt the user to confirm before adding it.
This came up during a winget-pkgs PR review (microsoft/winget-pkgs#389270)
where a reviewer had to manually flag a missing VCRedist dependency.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with winget-create's installer download and generated manifest flow, then read the proposed System.Reflection.PortableExecutable.PEReader API. Define how imported DLLs and PE architecture map to PackageDependencies, and decide whether generation should add the dependency automatically or prompt for confirmation. Done means matching VCRedist and .NET imports reliably without affecting non-PE installers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100