appget VS winget-pkgs

It has been admitted.

This is what an 'extinguish' looks like after embracing the idea of a Windows package manager by interviewing the creator of AppGet [0][1] and then dumping him to skip the extend part to full on copy it [2] with no credit and bundling it in the OS.

This is a rare straight extinguish after an embrace, especially in open source.

[0] https://keivan.io/the-day-appget-died/

[1] https://appget.net/

[2] https://www.theverge.com/2020/5/28/21272964/microsoft-winget...

One thing to keep an eye on is Microsoft's winget. Based off 'AppGet' but unfortunately MS don't prominently allude to winget's origins, although they have offhand mentioned it.

I never used winget, but probably: - https://github.com/microsoft/winget-pkgs/issues/107858 - https://github.com/Genymobile/scrcpy/issues/4027

It's probably not on the Store, winget pulls from both the Store and a community collection of manifests on GitHub: https://github.com/microsoft/winget-pkgs

I think that's part of the problem, if you don't have that package manager to bootstrap your signature key ring, DNS is your next best bootstrap. It is, of course, a terrible bootstrap for trust, but it is one so many users on Windows have been relying on for such a long time.

For power users on any modern Windows 10/Windows 11 there is at least WinGet now. Its manifests repo is becoming a very interesting (open) source of truth for common Windows applications. Admittedly, it in most cases doesn't seem to be checking specific code signatures in most cases either, but at least includes SHA checksums.

For instance, 7zip's manifests: https://github.com/microsoft/winget-pkgs/tree/master/manifes...

It's too bad there's still not a great option for "average user that doesn't know/trust how to use a CLI", given how sadly polluted the Microsoft Store can be for many common, especially Open Source, applications. For direct instance, because winget kindly includes Microsoft Store results when searching, there is a "7zip 22" in the Microsoft Store that costs some amount of money (winget details say "PaidUnknownPrice" for the pricing information; I'm on a corporate machine right now with the actual Store access locked so can't search in the actual Store right now) and the Publisher is listed as RepackagerExpress.com. (That website currently doesn't go anywhere, giving it a spot check.)

Having seen this, I may boot up my personal machine and try to report this specific Store listing for violating the Store's Open Source policies, though I'm unsure if such whackamole is all that useful. (Seems like it might be a useful winget feature request for it to provide Store Report URLs.)

I would like to create a local winget source where I add manifests that my company accepts. To begin with it should only include jdk 8 from eclipse adoptium temurin. https://github.com/microsoft/winget-pkgs/blob/master/manifests/e/EclipseAdoptium/Temurin/8/JDK/8.0.302.8/EclipseAdoptium.Temurin.8.JDK.installer.yaml

It's community driven, see https://github.com/microsoft/winget-pkgs