Manifests and a static winget source for jcollie's Windows programs, built and signed on Linux.

README.md

winget-pkgs #

The winget manifests for the Windows programs Jeff writes, and the tooling that turns them into a winget source served as a static site at https://winget.jcollie.dev/.

git clone https://git.jcollie.dev/jeff/winget-pkgs.git

It is mirrored at https://tangled.org/jcollie.dev/winget-pkgs.

Using the source #

The source is signed with a self-signed certificate, so a Windows machine has to trust that certificate before winget will read it. From an elevated PowerShell:

irm https://winget.jcollie.dev/install.ps1 | iex

That imports the certificate into the machine's Trusted Root and Trusted People stores and adds the source under the name JCOllie, marked --trust-level trusted: winget then marks an installer whose hash matches its manifest as coming from the Trusted Sites zone rather than the Internet, so Windows does not warn about it before it runs. The trust level can only be set when a source is added, so a machine that added the source before it was set gets it by running the script again. After that the packages install and upgrade like any other:

winget install -s JCOllie JCOllie.Clipwatch
winget upgrade --all

Adding a source needs administrator rights, which is winget's rule rather than this source's. https://winget.jcollie.dev/ itself says the same, with the steps for doing it by hand, the certificate's hash to check, how to remove the source again, and every package the source holds.

How it works #

Every package identifier is JCOllie.<Program>. The manifests live under manifests/ in exactly the layout of Microsoft's winget-pkgs repository — manifests/j/JCOllie/<Program>/<Version>/ — as the usual three files: the version file, the installer file and the default locale file. The installers themselves are not here: each manifest points at a release asset on the program's own repository and pins its SHA-256.

A new version arrives as a pull request. A package's first version is written by wingetsource new-package from what is particular to the program — its name, descriptions, license, tags and installers — reading an MSI's codes from the MSI itself; every later one is written by wingetsource new-version, which copies the package's newest version and replaces what changes with the release. A pull request is checked against Microsoft's published manifest JSON schemas and against rules of this repository's own — the identifier and version match the path, the publisher is JCOllie, and each installer downloads from git.jcollie.dev with the hash its manifest gives.

Every push to main rebuilds the whole source on Linux:

a SQLite index of every manifest is written, in winget's schema 1.7;
it is packed into source.msix, versioned from the merge commit's time;
the package is signed;
the package, the manifests, the certificate, install.ps1 and an index.html listing the packages are uploaded to git-pages.

All four steps are done by tools/wingetsource, a small Python program, with osslsigncode for the signature. Because a source can only point at one file per version, each multi-file manifest is published merged into a single ManifestType: merged document, named by its SHA-256 so that a changed manifest is never served from a stale cache. The files whose names never change — source.msix, the certificate, install.ps1 and index.html — are served with Cache-Control: no-cache through a git-pages _headers file, so that winget source update always checks for a new source.msix rather than installing a cached one.

winget reads it as a Microsoft.PreIndexed.Package source, the same kind as Microsoft's own, which needs nothing but plain files over HTTPS. The index has no specification beyond winget-cli's C++, so the writer follows that code: its tables and indices are those of the index inside Microsoft's own published source.msix, and its package name and publisher normalization passes winget-cli's own test data. Why it is built this way rather than with a REST server or Microsoft's Windows-only tools is recorded in docs/adr/.