Scoop VS winget-pkgs

Scoop is a command-line installer for Windows, aimed at making it easier for users to manage software installations and maintain a clean system. It's designed with developers and power users in mind but can be beneficial for any Windows user looking for an efficient way to manage software. Basically it makes our life easier when it comes to software installation of any sort. Scoop support installation for large number of software. Check it out here Scoop.

Use a package manager! Assuming Windows (since it's the odd one out), get yourself some scoop then just scoop install openjdk. No need to navigate to a website, download bundleware, click next-next-next and accidentally install a virus like some caveman from 1997. This has been a solved problem since ancient times!

Should be easy enough, I installed neovim on my windows machine with scoop (you can even get nightly if you want), it's basically a one line install. You can also do a manual install if you want, but you don't have to. It took a little fiddling for me because I wanted to install scoop as well as all applications onto my D drive rather than my C drive, but nothing too crazy. I never got NvChad on my windows machine, but I do have it on linux, and siduck (the creator of nvchad) has given good instructions for installing even on windows, so i don't think it should be a problem. Also, there's a discord for nvchad, and siduck is pretty active on there if you want to ask questions. Good luck!

I update it with Brew on macOS and Scoop [1] on Windows (but I guess it is included in other package managers such as chocolatey).

Of course, a built-in auto-updater would be good, but a packaged version is a nice workaround for me.

[1]: https://scoop.sh/

So I tried installing scoop the "normal" way for both users then ran scoop install {app} --global as per https://github.com/ScoopInstaller/Scoop/wiki/Global-Installs and got:Cannot find path 'C:\ProgramData\scoop\buckets' because it does not exist

There are a number of ways that you can install the Snyk CLI on your machine, ranging from using the available stand-alone executables to using package managers such as Homebrew for macOS and Scoop for Windows.

Scoop provides a wonderful foundation for creating a portable developer's toolkit on Windows systems.

7.0 is now available: https://github.com/microsoft/winget-pkgs/pull/147886

I researched this for a WinGet thing: https://github.com/microsoft/winget-pkgs/pull/110618

Ah, reminds me of that time I requested a .editorconfig file in a Microsoft repo: https://github.com/microsoft/winget-pkgs/issues/329

Take dropbox as an example. This is what the yaml manifest looks like for that if you install it through winget. It literally has a hardcoded link to an .exe installer hosted by dropbox and then just set the flags to silent. I am not spreading misinformation, you are.

It's not quite the same though, as there are different considerations when using a repository of things a unified group has decided should be included and built (or slightly modified existing) packages for and a repo where anyone can submit a package that will go through some level of vetting. In the end I still believe most this discussion is really about individuals and how much trust they apply towards different groups and sources and is not really about Linux or Windows in particular as much.

1: https://github.com/microsoft/winget-pkgs

I never used winget, but probably: - https://github.com/microsoft/winget-pkgs/issues/107858 - https://github.com/Genymobile/scrcpy/issues/4027

It's probably not on the Store, winget pulls from both the Store and a community collection of manifests on GitHub: https://github.com/microsoft/winget-pkgs

I think that's part of the problem, if you don't have that package manager to bootstrap your signature key ring, DNS is your next best bootstrap. It is, of course, a terrible bootstrap for trust, but it is one so many users on Windows have been relying on for such a long time.

For power users on any modern Windows 10/Windows 11 there is at least WinGet now. Its manifests repo is becoming a very interesting (open) source of truth for common Windows applications. Admittedly, it in most cases doesn't seem to be checking specific code signatures in most cases either, but at least includes SHA checksums.

For instance, 7zip's manifests: https://github.com/microsoft/winget-pkgs/tree/master/manifes...

It's too bad there's still not a great option for "average user that doesn't know/trust how to use a CLI", given how sadly polluted the Microsoft Store can be for many common, especially Open Source, applications. For direct instance, because winget kindly includes Microsoft Store results when searching, there is a "7zip 22" in the Microsoft Store that costs some amount of money (winget details say "PaidUnknownPrice" for the pricing information; I'm on a corporate machine right now with the actual Store access locked so can't search in the actual Store right now) and the Publisher is listed as RepackagerExpress.com. (That website currently doesn't go anywhere, giving it a spot check.)

Having seen this, I may boot up my personal machine and try to report this specific Store listing for violating the Store's Open Source policies, though I'm unsure if such whackamole is all that useful. (Seems like it might be a useful winget feature request for it to provide Store Report URLs.)

For example, see that Firefox has /S here.