microsoft / microsoft/winget-create

Auto-detect PackageDependencies from installer PE import table

Open
#676 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature
Dominant language
C#
Stars
651
Forks
114
Avg merge
7h 52m
Merged PRs (30d)
3

Description

Description of the new feature / enhancement

When a package links against common runtimes like VCRedist or .NET, the
PackageDependencies field must be filled in manually. There's no tooling
to catch missing dependencies, so publishers often omit them unknowingly
and only find out during PR review when a maintainer flags it causing
unnecessary roundtrips.

winget-create already downloads the installer/executable, so it has everything it
needs to detect this automatically.

Proposed technical implementation details

After downloading the installer, if it's a PE binary (.exe/.dll), parse
its import table using System.Reflection.PortableExecutable.PEReader
and match imported DLLs against a known mapping:

Imported DLL WinGet Package
VCRUNTIME140.dll Microsoft.VCRedist.2015+.x64
MSVCP140.dll Microsoft.VCRedist.2015+.x64
VCRUNTIME140.dll (x86 binary) Microsoft.VCRedist.2015+.x86
MSVCP140.dll (x86 binary) Microsoft.VCRedist.2015+.x86
VCRUNTIME140_1.dll Microsoft.VCRedist.2015+.x64

If a match is found, either auto-populate PackageDependencies in the
generated manifest, or prompt the user to confirm before adding it.

This came up during a winget-pkgs PR review (microsoft/winget-pkgs#389270)
where a reviewer had to manually flag a missing VCRedist dependency.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with winget-create's installer download and generated manifest flow, then read the proposed System.Reflection.PortableExecutable.PEReader API. Define how imported DLLs and PE architecture map to PackageDependencies, and decide whether generation should add the dependency automatically or prompt for confirmation. Done means matching VCRedist and .NET imports reliably without affecting non-PE installers.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.