In this issue WINDOWS: Getting started with winget Additional articles in the PLUS issue • Get Plus! PUBLIC DEFENDER: No NumLock key? Problem solved! Here’s the fix. HARDWARE DIY: Windows Storage Spaces ON SECURITY: Is Secure Boot important for security?
WINDOWS Getting started with winget
By Simon Bisson If you’ve used Linux, you’ll be familiar with package managers such as Debian’s apt and Red Hat’s yum. They keep track of what’s installed on your computer — downloading updates and installing new software, managing dependencies so you always have the right libraries for your code. Drop into your command line, type a few keystrokes, and you’re automatically up to date. Windows hasn’t really had the same design philosophy. Software comes from distributors, on CD, on DVD, and from Microsoft’s own websites. Microsoft’s app store was initially only for packages built using Windows 8’s APPX (though over time it’s expanded to support MSI and MSIX) as well as installers built using the WIX toolkit. But there are still many programs that don’t come from the store — especially all those little utilities that make your life easier. There are others that can’t be distributed that way at all, such as a business’s own internal tools or applications distributed with enterprise licenses. The store model doesn’t provide an easy way to set up all your usual tools on a new PC, keeping an inventory and automatically installing everything you regularly use. Windows has long needed the same sort of package-management tooling as Linux. Although there have been plenty of third-party options over the years, only Chocolatey has had any traction — and there, mainly with developers and system admins. If you’ve ever gone out to find a Windows package manager, you must have truly wanted one, making them tools for IT pros. Linux’s tools are baked into the main distributions. That’s what Windows needs, too — to get package managers into everyone’s workflow. With Windows 11 opening up its store to a wider selection of software, and even providing direct links to downloads from vendors’ own repositories, there’s an opportunity to change completely the way we work with Windows applications. Introducing winget
Microsoft unveiled its Windows package manager, winget, at its Build conference in 2020, with open-source code available on GitHub. It’s now bundled in the Microsoft App Installer, which is used to sideload¹ Microsoft Store apps and runs in all versions of Windows above Windows 10 1709. There are regular preview versions that can be downloaded from GitHub as a one-off install; or, if you prefer to keep your PCs updated with preview builds, you can sign up for the Windows Package Manager Insider program that runs separately from the main Windows Insider program. Winget is a command-line tool; it hooks into the Windows installer service to access what’s installed on your PC. That lets you quickly list what’s already on your machine, as well as look for updates in its repositories. Out of the box, those repositories are Microsoft’s own GitHub-hosted list of packages and the Windows Store. Recent versions have added support for private repositories, and there are already companies offering hosted repository services that can simplify managing your software distributions. The obvious use for winget is to quickly build a list of the software that’s installed on a PC and update it automatically. The most useful winget commands
All you need to do is open a command-line window (Windows 11 comes with the new Windows Terminal for cmd, PowerShell, WSL, and more) and type winget list. This runs a discovery process to see which applications are installed, displaying names along with their winget repository app ID, the current version, update availability, and any sources. Not everything listed is available through winget; some apps have their own update tools, others come from the Microsoft Store. An example of this command’s output is shown in Figure 1.
Having a list of installed software is useful, especially as you can export it and use that data to set up a new PC. Even though the list it produces is limited only to software that’s managed by the Windows installer service, it’s enough to get you started. Microsoft is working on a PowerShell module that should simplify using winget in any scripts, offering commands for most common operations. However, it’s still available only as part of the preview release and requires PowerShell version 7. You can find details of a specific application by using winget show with the app ID. This shows who published the code, what it does, the installer type and download URL, and links to any license and policy details. Winget lets publishers tag their installers to help with search, and there’s even an SHA-256 hash that is used to verify downloads before they’re installed. It is possible to get a list of all available applications in your current repositories by using the winget search command, giving it a wildcard search term as follows:
If using PowerShell, you’ll need to escape the wildcard with tick marks:
This can be a very long list, so make sure you have plenty of terminal history available! By default, winget uses the Microsoft Store and its own repository, which you can check using winget source list. If you want to add a new private repository for your own applications, use winget source add along with the URL of the repository. This must be done with administrator privileges, to reduce the risks of third parties’ adding new repositories without your noticing. That’s much like adding new sources to apt or yum on Linux. The winget install command loads new software packages, automatically running the installer. Usefully, it’s also a search command, so you don’t need to know the full name of an application. If the package found isn’t the one you want, it’s simple enough to cancel the install. Also, if you’re scripting installs, you can choose the –silent option to suppress the installer UI. Other options allow you to choose a specific version as well as automatically accept license agreements. If you’re using an ARM PC, you can choose to install only ARM64 versions to avoid the overhead that comes with x64 emulation. Of course, there’s an uninstall option too, which requires the exact name of the application to be uninstalled. Its most useful feature is probably winget upgrade, especially with the –all option. This updates every application it can, in one go. It’s worth scheduling this weekly to keep up with the latest versions of your everyday applications. Although it uses the version numbers in app manifests, you can force it to try releases that may not include a valid version number. Upgrades can be tied to a specific version number — where you’re pushing bug fixes and want all your users to move away from one that’s known to be bad — or by using the app ID. You can quickly see a list of all pending updates by running the command without any arguments. To see the complete list of winget commands, simply enter winget. Use winget to set up PCs
Winget proves very useful when moving to a new PC. Use winget export to create a machine-readable file of all your apps, ready to copy onto a flash drive or email to yourself, and then winget import to install them all. It can save a lot of time when rebuilding new hardware. For apps that can’t be installed this way, you can use the output of winget list to at least know what else to look for. Because the export file can be edited, it becomes a good way to bring new team members up to speed, especially when used to share things such as development toolchains. One useful option is the ability to use PowerShell to install winget in the Windows Sandbox, allowing you to test installation scripts before making them part of a build process or before deploying them to users. Keeping your tests isolated from your desktop environment in an isolated, sacrificial sandbox makes a lot of sense: you can see if an installer works silently and can experiment with your own packages and repositories. If anything goes wrong, just create a new Sandbox. As the amount of software available through public and private repositories grows, winget is a tool that’s going to become increasingly important. With Microsoft shutting down the Windows Store for Business, it’s likely to become the most effective way to script software delivery, especially when used in conjunction with the new generation of Windows system-management tooling. The result is that rare thing — a Windows utility that’s as useful for the home user as it is for the IT pro. Resources
Footnotes ¹ “Sideloading” means installing an app without using a vendor’s store (e.g., Google Play, Apple App store, Microsoft App store). It usually involves downloading an app’s install file, then manually installing the program.
Simon Bisson is a freelance technology writer living in London. He has been writing about Microsoft tools and technologies since the 1990s — and using them even longer.
The AskWoody Newsletters are published by AskWoody Tech LLC, Fresno, CA USA.
Your subscription:
Microsoft and Windows are registered trademarks of Microsoft Corporation. AskWoody, AskWoody.com, Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Perimeter Scan, Wacky Web Week, the Windows Secrets Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of AskWoody Tech LLC. All other marks are the trademarks or service marks of their respective owners. Copyright ©2023 AskWoody Tech LLC. All rights reserved. |