[New Feature]: Script to detect opportunities to contribute to winget-pkgs

[simonhollingshead]

Description of the new feature/enhancement

When a developer doesn't contribute to winget-pkgs, it's members of the community that make the manifest instead. In these cases, especially since you're relying on a user discovering by themselves that winget's data is out of date, I feel that you need to make the path to contributing the absolute lowest effort possible.

For example, if I want to spend a lot of time looking into it, I can iterate all the things installed on my machine to find what things are newer for me than for winget. If I manually look into it, winget thinks Wireshark is 4.0.5.0 while I'm on 4.0.6:

> winget show WiresharkFoundation.Wireshark
Found Wireshark [WiresharkFoundation.Wireshark]
Version: 4.0.5.0
...

> winget list -q wireshark
Name                   Id                            Version Source
--------------------------------------------------------------------
Wireshark 4.0.6 64-bit WiresharkFoundation.Wireshark 4.0.6   winget

However, as far as I can see, winget-pkgs does not provide any easy runnable script that can spit out a list of "hey, you seem to have these newer packages, if you want to be awesome and contribute then these are the best ones to look at" (and possibly "Hey, you have these packages we've never seen before, would you consider contributing manifests for these?") and I feel like that's a bit of a feature gap - the simpler you make it to discover ways to contribute, the more likely you are that someone will.

Proposed technical implementation details (optional)

I don't know how easy it is to run the prerequisite commands, but I'm thinking of something like

• Enumerate all known packages on the machine and their current versions
• Enumerate the winget known version for all those packages
• Discard all packages which are outdated or at the latest version
• For all other packages, print to the screen enough data to help the user to contribute, for example:

Potential updates:
WiresharkFoundation.Wireshark 4.0.5.0 -> 4.0.6
...

Unknown packages:
Kartridge (0.5.2)
...

[stephengillie]

I like the goal of streamlining manifest creation. An implementation challenge is that manifests need the ISV's hosting URL. What could fill that need might be some kind of browser plugin, that monitors EXE and other installable file types, and offers to build a manifest based on this - using the page you're on as the PackageUrl and the URL downloaded as the InstallerUrl. Maybe like a one-click interface - goto a website, download something, and click the browser plugin to submit a manifest PR.

[simonhollingshead]

While I also support the idea of making manifest creation easier, here's my perspective on it:

If you don't help a user realise which manifests need updating, but you make manifests easy to create, you haven't solved the discoverability problem that opens the floodgates. You're making it easier for those who already know what they want to, and intend to, update.

If you help a user realise which manifests need updating (and the manifests in need of updating are sourced from their own PC, implying they're a user of that software and they care about it being well maintained) but it's still quite a manual process, you'll still get benefit from people who want to contribute despite the manual effort.

Of course, I don't have a feeling for the comparative sizes of these two populations, though.

[denelon]

@simonhollingshead this is a cool idea!

One of features on the winget-cli Issues is:

• Provide mechanism to report SHA256 mismatch winget-cli#870

You inspired me to add:

• Package submission suggestion winget-cli#3327

[denelon]

@simonhollingshead do those two issues cover what you're looking for well enough in the winget-cli repository to close this one at winget-pkgs?

[microsoft-github-policy-service]

Hello @simonhollingshead,

It seems that your input is required to address the reported issue.

Template: msftbot/needsAuthorFeedback

[simonhollingshead]

I think that the second of the two is sufficient, yes. I filed it here wondering if it'd be something that was specific to winget-pkgs but it sounds like winget-cli is a better place for that FR to sit. Closing.