Windows 10 Gets a Package Manager For the Command Line 230
aojensen writes: ExtremeTech reports that the most recent build of Windows 10 Technical Preview shows that Windows is finally getting a package manager. The package manager is built for the PowerShell command line based on OneGet. OneGet is a command line utility for PowerShell very similar to classic Linux utilities such as apt-get and yum, which enable administrators and power users comfortable with the command line to install software packages without the need for a graphical installer. ExtremeTech emphasizes that "you can open up PowerShell and use OneGet to install thousands of applications with commands such as Find-Package VLC and Install-Package Firefox." It's a missing feature Linux advocates have long used to argue against Windows in terms of automation and scale. The package manage is open to any software repository and is based on the Chocolatey format for defining package repositories."
We can do that thing you like (Score:5, Insightful)
Everything except open-sourcing the code that is.
Re:We can do that thing you like (Score:5, Insightful)
Installing via the command line is nice. But it isn't what I want.
I want a package system that locks the files down so that package X owns abc.dll and will not allow package Y to overwrite it.
And searchable. What package installed abc.dll? What packages depend upon that package?
Re: (Score:3)
The installer should put abc.dll in the same directory as the .exe file instead of a shared location.
Re: (Score:3)
...leaving you with many identical abc.dll files spread throughout the storage system. Not sure I like this.
Ideally I would love file versioning with diffs, but that's just unobtainable.
Re: (Score:3)
But disk space is really cheap these days. The lost disk space seems like a small price to pay to avoid DLL Hell. Of course static linking would also remove the whole problem.
Re: (Score:2, Insightful)
Disk space ain't that cheap, especially if you install the applications on a SSD. Furthermore, a large application is using literally gigabytes of shared DLLs which would otherwise be saved separately. Disk space usage would astronomically increase.
Re: (Score:3)
Its actually how the Macs have been doing it since forever. You know those .app files macs use? They are actually directories with a little XML file telling the OS how to run them. Its traditional to include the .dylink and .so files (the macs version of .dll) in
Re:We can do that thing you like (Score:4, Interesting)
Re:We can do that thing you like (Score:5, Informative)
DLL hell was *very* real in the Windows 9x days. Side-by-side assemblies was introduced with Windows 98SE (IIRC) - but really only became de rigueur with Windows XP. During the 9x days, software developers took advantage of the fact that nothing prevented them from writing files to the system directories. When they encountered a problem where they needed a DLL - they simply installed it in the system directory - often overwriting whatever was there before. Obviously this caused all sorts of problems where only the latest installed product had a robust state.
To add to this, Microsoft shipped a faulty copy of mfc42.dll with Visual C++ 6. It removed a bunch of functions.
Now, keep in mind that mfc42.dll was used by any MFC applications compiled by Visual C++ 4.2-6.x... including Netscape, Microsoft Publisher, and a number of other programs.
Oh, did I mention that MFC was the recommended way of writing Windows programs back then?
Incidentally, Microsoft started including the VC++ version number in its DLL names again after this thanks to that screwup... which they had done before (vc++ 4.1 had mfc41.dll, etc...)
Re: (Score:3)
Data deduplication is supported in Windows Server, although I have no idea if it will be directly supported by Windows 10.
Re: (Score:2, Interesting)
In which case it would make no sense for each application to try and store the DLL locally. I shiver when I imagine an application being uninstalled and removing deduplicated DSLLs that every other application uses, simply because its developer was cutting corners or incompetent.
Re: (Score:3)
The file system manages data deduplication via garbage collection. http://msdn.microsoft.com/en-u... [microsoft.com]
When an optimized file is deleted from the data deduplication-enabled volume, its reparse point is deleted, but its data chunks are not immediately deleted from the chunk store. The data deduplication feature's garbage collection job reclaims the unreferenced chunks.
Re:We can do that thing you like (Score:4, Informative)
The installer should put abc.dll in the same directory as the .exe file instead of a shared location.
No!
If the DLL is indeed candidate for being shared (e.g. part of a shared product) it should put the assembly/DLL in the Global Assembly Cache (GAC). This is a side-by-side store where the same assembly/DLL can exist in multiple versions.
If security vulnerabilities are found and a patch is released, only the version in the GAC needs to be updated, often by registering a new version with a manifest/redirection that will ensure that anyone requesting the old (vulnerable) version will be treated to the new (fixed) version.
Windows Installer does this. And supports patching.
Re:We can do that thing you like (Score:5, Informative)
https://en.wikipedia.org/wiki/... [wikipedia.org]
Rather than leaving the dependency resolving responsibility to package maintainers, the Windows OS contains a brokering mechanism that will load the correct version of an assembly - even if multiple versions of the same assembly exists in the global assembly.
Linux package managers have dual responsibilities: Provide available software (with update mechanism) and ensure dependency hell does not rear its ugly head. Linux dependency hell is very real, once you step outside the repositories.
Windows has binary compatibility with software that was developed for Windows 95 / Windows NT 3.1 (where Win32 debuted). The dependency problem (called DLL hell in Windows) was solved with the SxS and the broader use of the Windows Installer package manager, which integrated with SxS.
Re: (Score:2)
They're late comers to this party: We already have community repos. Chocolatey and BoxStarter. Why would we need OneGet?
It's Internet Explorer vs Netscape all over again :)
Re: (Score:2)
I guess if you could set up your own repository, this could be a useful tool for enterprises.
Re:We can do that thing you like (Score:5, Informative)
Actually, to be perfectly clear, OneGet isn't really a package manager.
It's a package-manager-manager -- It's a unified way of installing packages of software regardless of the how-it's-implemented-on-the-back-end.
The first real package provider plugin is a Chocolatey one. Why re-invent the wheel when the wheel already works?
The purpose here is to leverage all these different sources of software using a common set of commands and APIs.
Anything that can be represented as a 'source' of software can be plugged in on the back end. I'm aiming for plugins for NPM, Ruby Gems, Python, on top of the expected MSI, Chocolatey, NuGet, etc...
Plugins can be written by anyone, and I'm going to great lengths to make it as simple as possible -- it's about ~15 or so functions to implement and we can plug in virtually any package format or service into OneGet.
Re: (Score:2)
Typical MS. They just love create stuff in which other people can do stuff, instead of just doing the stuff. Can they create a package mangement tool? NO! They have to do something on top of that. For the love of pete, just *do* something. Stop doing stuff that allows other people to do stuff (that they will never do).
Re:We can do that thing you like (Score:4, Interesting)
What makes you think they won't open it up?
MS has done a pretty abrupt about-face over the past couple of years. MVC/WebAPI, Roslyn, EntLib, EF, WinJS, etc. are open source. Much of the .NET stack is open source. You can easily stand up an entirely open system on Azure (Mongo/Hadoop/Node, many other options).
They've even got internal movements going to open up some of their popular but unsupported software, like LiveWriter.
Re: (Score:3)
Hang on a second. Microsoft is a proprietary software vendor and will attack anything that jeopardizes their revenue stream. They're putting the "free candy" sign on the outside of their van based on a business decision, not because they want to create some warm and fuzzy community effort (i.e. actually give out free candy!).
It's in their DNA to only promote things that will further generating revenue because their shareholders require it (and rightfully so, they are the owners).
Point being, they must hav
Re: (Score:2, Informative)
What this article forgot to mention is that this project actully IS Open Source, under tha Apache v1.2 licence and hosted on GitHub.
https://github.com/OneGet/oneget
Re: (Score:2)
Thats something very odd by Microsoft. I just think: WTF? Microsoft and Open source? and even more: Microsoft and open source that ships with windows?? Really, something has moved in redmond.
Re: (Score:3)
Possibly. It seems the new CEO is himself far more in touch with modern software development, whereas Ballmer was basically just a salesman. But I think what is probably more important than that is that Stephen Sinofsky is gone. Apparently he was a total dick, made a lot of unilateral decisions, and was actively hostile against anybody who suggested any big changes.
IMO somebody like him would reject OneGet (probably suggesting to use the Microsoft Update system instead.)
Oh boy, another infection vector (Score:3, Insightful)
This is just an easy way to install software without much popping up on the screen to alert the users. I wonder how long it'll be before reports of infections using this installation method. What we really want is someone typing Install-Package Chrom and getting infected because of a typo.
Re: (Score:3)
This is just an easy way to install software without much popping up on the screen to alert the users. I wonder how long it'll be before reports of infections using this installation method. What we really want is someone typing Install-Package Chrom and getting infected because of a typo.
LOL security through pop up tick boxes.
Re: (Score:3)
Re: (Score:2)
I really doubt most clueless users will suddenly be taking to the command line to install stuff. In any case, this doesn't bypass the usual security warnings like UAC prompts or the need for the administrator password.
Personally I welcome it as it means Internet Explorer will no longer be required to download Chrome every time I do a fresh install.
Re: Oh boy, another infection vector (Score:4, Funny)
It's not a problem on linux because the community manages the software repository.
And as the half dozen or so people in the community all know each other, it's not likely they're going to shit on their friends.
Re: (Score:2)
attempts to subvert it and get malicious software in there. Just like with the Apple App Store.
And sometimes they will succeed but overall this is a brave move of them.
Just like their new implemention of Virtual Desktops. I applaud it.
Re: (Score:2)
And how long until all a virus does is point to a different repo & install unmanaged software? Just like android & third party repos.
Re: (Score:2)
Well, considering that the chocolatey provider for OneGet points to the community-controlled repository, I'll have to take that as a win :)
The concept of curated repositories is one that we're really trying to come up without screwing it up.
Regardless, with OneGet, the *user* maintains control. Which repositories they connect to, what software they install.
Re: Oh boy, another infection vector (Score:5, Interesting)
The problem with user controlled is that the user will add a repository and forget about it.
It happens on the Linux side as well. It just doesn't make news because there it's mostly white hats and not black hats.
Imagine this scenario: A website says it is packaging Windows10 versions of VLC with special added codecs to play stuff it otherwise doesn't play. People then add the repository and all is well. A year later, the repo gets hijacked by a virus and adds a version of GIMP v999 with the virus. Since it's a newer version of GIMP than what everyone has, they download it automatically and are infected en mass. People aren't looking for it since they already vetted the repo.
It happened with Ubuntu a while back, where some guy noticed his private repo was getting thousands of hits. So he put a new version of the default desktop background picture in it telling people to get off his repo.
Re: (Score:2)
You've got a really good point.
We're tossing around some notions about different factors that make a 'package' or 'repository' trustworthy.
I'm sure we can do some stuff with signed repositories and signed packages to detect when things 'change' and/or keep unsigned repositories 'untrusted'.
Really, our first target for this stuff is developers and admins, not my mom...
Re: (Score:3)
We're tossing around some notions about different factors that make a 'package' or 'repository' trustworthy.
A very simple solution is to prohibit a package from Repository B from overwriting the already-installed same-named package from Repository A. Then, add a command line parameter to override the prohibition. I know that yum keeps track of which repo a package came from, and the user can set up this kind of protection, but it isn't the default.
This doesn't protect against installing malware if it's the first time you installed a package, and doesn't stop malware from making it's way into a "trusted" reposit
Re: (Score:2)
I'm sure we can do some stuff with signed repositories and signed packages to detect when things 'change' and/or keep unsigned repositories 'untrusted'.
Suggestion: For "trusted" repositories, toenable automatic updating, developers must sign the original install package with a certificate. Self-issued certs could be ok for this part. Any subsequent updates must be signed with the *same* certificate. If not, it will *not* automatically update - even if the repository is "trusted". OneGet clients will only allow auto-update if the product/vendor names are the same and the certificate public key is the same. Otherwise a warning should be issued and the local
Re: (Score:2)
Re: (Score:3)
1. Nobody said he was a linux user. In fact, judging from a 5-second reading of his post history, it looks like he's a Windows fan.
2. This is not an apt analogue. It doesn't do dependency management, otherwise known as the main thing people like about apt. All this is, is a way to download and run the installer with a single command. The packages downloaded from this can still shit all over your system.
3. Who's controlling the main repository? Is is Microsoft? Because if it is, they haven't had a very good
Re: (Score:2)
But are there any dependency issues in Windows? Been ages since I've used it, but I don't recall having to chase down DLL files, other installers, etc. to get something to install or run properly....
(oh, and on the similar story the other day I got a -1 troll for asking if we could check out c:\windows\system32\drivers\etc\apt\sources.list)
Re: (Score:3)
'Approved' isn't the right word.
OneGet has the notion of 'trusted' repositories. We're likely to expand this concept a bit in the future, but for now, that's what it is.
Built-in package sources from reputable sources may be marked as 'trusted' by default, but the majority of sources should be 'untrusted' until the user makes that change.
The real trick is getting package provider plugins to tell OneGet the truth if a repository is trusted or not.
I suspect that we're going to have to introduce a level of trus
Yay! Another Unix! (Score:5, Funny)
Now that Windows is kinda-sorta-Unix-like, should it be on DistroWatch.com? </sarcasm>
Re: (Score:3, Insightful)
Since when were package managers a UNIX thing?
Re: (Score:2)
That would make it a non-Windows thing, not a Linux thing.
Re: (Score:2)
Nah! Windows can never be considered Unix-y.
It's never done just one thing and it's never done those things well.
Respect (Score:5, Informative)
I really respect this move from Microsoft. It's something they should have done a while ago, but better late than never. It has the potential to make administration much easier. They should also maintain their own repo of patches as an optional replacement for Windows Update.
Re:Respect (Score:4, Informative)
[FYI -- I'm @FearTheCowboy everywhere else, my /. id is so old that my name got trimmed from "His Name Cannot Be Spoken" 15ish years ago when they did a database adjustment... ]
I have had thoughts on how to do this; I suspect that while we may not set up a repo to do that, I may hack out the instructions on how that could be done easily if one wanted to maintain their own.
It really boils down to how much time I can throw at that.
Of course, we also want it to plug into WU and WSUS, but that'll be a bit more down the road.
Re: (Score:2)
Re: (Score:2)
I would imagine build on it.
Re: (Score:2)
Re: (Score:3)
Good to know. So I take it you're somewhat responsible for this? I love you then. As a systems/network admin, this has long been on my wishlist.
I wouldn't mind running my own repo for Windows patches, as long as there are tools to make it easy, including some way of automating pulling patches into my repo.
As far as integration with WSUS, I wouldn't mind seeing WSUS replaced/melded into a single solution, but I'm less interested in maintaining two different update solutions that plug into each other. E
What sort of apps? (Score:3)
Re: (Score:2)
The current repository is added to by users. Microsoft seem like they want to keep it that way, although of course I'm sure they will take over maintenance of their own products. I had a quick look and Visual Studio is already on there.
almost useless (Score:3)
Have you ever tried to make your application a debian package or RPM? It's a royal pain in the ass. Windows developers are not going to do whatever it takes to make this go smoothly on Windows.
There is a 100% chance that nearly every "Package-Install" command will just be downloading the app for you and launching the graphical installer you normally see.
People in charge of deploying software on windows are miserable people.
Re: (Score:2)
There is a 100% chance that nearly every "Package-Install" command will just be downloading the app for you and launching the graphical installer you normally see.
Tell me more about this 100% chance of a graphical installer on Windows Core (non-GUI).
If they have to make it work in core, why would it fire up a graphical installer?
I'll take any bet that it is something less than 100%....
Re: (Score:2)
What percentage of windows installs are Windows Core? Can you round it up to 1%?
Re: (Score:2)
Relative to ALL windows installs?
Yes, they are rare.
Re: (Score:2)
Re: (Score:2)
I can say I have. I couldn't wrap my head around RPM, but I didn't try that hard. Debs on the other hand are easy as pie. It takes me about 5 minutes to refresh my memory on dh_make (man dh_make), then create a deb using dpkg-buildpackage -rfakeroot -b -us -uc (if you actually want signatures it still doesn't get much harder). No pain in the ass at all, royal or otherwise.
Re: (Score:2)
Have you ever tried to make your application a debian package
Yes, it's essentially a compressed directory, combined with a dependency list and a version number. You don't even need the specialized Debian tools to build them, although they make things easier. I'm kind of surprised you found it difficult, actually.
Re: (Score:2)
There is a 100% chance that nearly every "Package-Install" command will just be downloading the app for you and launching the graphical installer you normally see.
Most of them download the MSI and do a silent install. There will still be UAC/admin password prompts, unless you disable them first. Many programs provide MSI installers already because they are very popular with organizations that want to deploy software over their network.
Re: (Score:3)
On other words ... (Score:5, Funny)
sudo apt-get install malware
Re: (Score:2)
FTFY
Re: (Score:2)
Because it's been a problem up to this point...not the corporate repository- just about any twit could make an installer/injector that was transparently fire and forget for Windows. Because of the design, it's a bit harder with most Linux distributions whether you're talking about RPM, DEB, or any other packaging system. But, for windows, whether it was GUI or not, it's just simply there. If it wasn't, you wouldn't need AVG/Avast/Avira/etc. or MalwareBytes/etc.
As such, it's a joke. Not liking it? Get M
Re: (Score:2)
History. the current Microsoft app store is a mess.
Re: (Score:2)
All app stores are a mess.
Re: (Score:2)
No, the viruses will have the installer point to their own repos. Probably named similarly. WindowsInstllServer for example
And that's all they need to do.
Re: (Score:2)
Like intentionally malicious USB drivers that will nuke the hardware people bought? All it needs is some crazy asshole with the keys to the castle.
Clap clap clap (Score:2)
Real leadership here. Basically the Chocolatey folks did it for them and only after facing the threat of not controlling the dominate package manager on their own platform do they finally after decades offer a solution.
Basically what this tells me is they were trying to avoid competing with their App Store clone BS and are now having their hand forced. Way to go MS way to go.
Chocolatey? (Score:2)
Alternative - Chocolatey (Score:2)
Is this the year of the Windows Desktop? (Score:4, Funny)
we've been saying it for years and years but now that Microosft Windows has a package manager, is 2014 finally the year of the Windows desktop?
Convergence of features is good (Score:2)
The reason I expect this has been delayed for so long is that features like these will make windows administrators more at home on Unix and Linux. It does show (as other things do as well), that for professional work, Unix had it right all along. On the other hand, this convergence makes (hopefully) working on Windows less of a pain.
Of course I am talking about convergence with regard to work-flows, processes, etc. and not about actual concrete services being the same.
Simply put: O_o (Score:2, Flamebait)
Heh... How long did it take them to get to that? 20 *YEARS* (RHL 1.0 - November 1994) now?
Seriously Microsoft. Took you long enough.
Re: (Score:2, Troll)
Not as long as it (would) take Linux to offer a really good Desktop solution.
Re: (Score:2)
Not as long as it (would) take Linux to offer a really good Desktop solution.
Yeah, Microsoft made a really good desktop solution and then developed a really broken one. Take that, Linux!
command line branding? (Score:2)
Isn't putting branding in a command's name a bit of a hostage to fortune?
If this had come out 10 years ago, would we all be laughing at having to use get.NET / OLEget / ActiveGet / Get95 / etc ?
One of the ways Linux is ahead of Windows. . . (Score:2, Troll)
. . . is that a lot of its software is automatically managed. Windows updates is great (it generally works better than the Linux versions), but it only updates Microsoft components. Other installed programs are responsible for updating themselves, often installing hidden processes that boot at start-up for that purpose.
Linux package managers are nice because they manage a pretty wide-variety of software. Their biggest flaw is that you usually still have to update packages you install yourself manually.
If
Re: (Score:2)
For most well known Windows applications, I'm using Ninite for both automated batch install and automated batch update.
And sshd? (Score:2)
While I'm talking about sysinternals tools, maybe a 64 bit version of psinfo? Psinfo -s still only shows the 32 bit programs installed on a system, ignoring the 64 bit versions.
Praise Jesus (Score:2)
windows is finally growing up. (Score:2, Insightful)
Chocolatey (Score:3)
My experience of chocolatey was not good. Fine to install software, but it's just a wrapper around existing installers. Try to upgrade a package... fail. Try to remove a package... fail. This depends upon the package in question; it works for some, others you have to clean up by hand, worse that having downloaded and installed using the installer by hand.
And no proper support for libraries, dependencies etc. so useless for software development. It certainly meets a need for software deployment, but it's so lacking compared with what dpkg/apt-get provide that it's a joke.
If Windows is to gain a proper package manager, I think they need to do it properly. The existing support is just broken.
A step in the right direction (Score:2, Insightful)
Yes, I much prefer a billion config files littering the file system.
Re: (Score:2)
It's a good thing they don't have something like %APPDATA%, otherwise there would be the worst of both worlds! A registry crammed full of cruft and detritus AND a hundred thousand vendor whatever files laying about.
"Should we put this config option in the registry or the config file?"
"Flip a coin!"
Re: (Score:2)
Except there is no common storage format for configurations. Except there is no per configuration setting ACL permission. Except the text files aren't protected against corruption.
There are many reasons to complain about the registry - too bad almost no-one ever mentions any real problem when complaining.
Re: (Score:2, Interesting)
Re: (Score:2)
You actually have audit log for seeing what exactly failed - but by default its not logging at very granular level. You can turn it on to be waay verbose, drown in the logs and then use arcane filtering techniques to figure out what happened. Or use something like ProcMon / ProcExp combo to try and trace the issue.
The situation is much different where for unix daemon failures you either spend about an hour trying to get the strace command line just right so that the correct bit of failure information is act
Re: (Score:2)
There's no common storage format for configurations?
Hmm, I guess that's why no one uses XML for it.
Re: (Score:2)
They go in /etc, /etc/foo, /etc/default, /etc/alternatives, /usr/share/something, ~/.foo, ~/.config, ~/.config/bar and possibly other things and god help you if you have both dconf and gconf installed.
Some stuff is special : output resolutions are added with xrandr --newmode, xrandr --addmode and not by editing a configuration file (you did so in the times xorg.conf was not hidden). Or some stuff takes effect when you rebuild the initramfs, fine.
I'm not especially complaining (complexity is complex) but it'
Re: (Score:2)
Re: (Score:2)
Think of it this way - your command is using "rpm -hiv /path/to/package.rpm"
Microsoft is adding "yum install package" to the options list.
Re: (Score:2)
We had command line tools for managing packages, but not for searching and installing from a repository.
Re: (Score:2)
Microsoft deprecated their POSIX layer (after making it artificially unavailable in Windows 7 Pro whereas XP Pro could run it)
Ironically, Windows 10 won't be POSIX compatible while earlier Windows version were (not sure about 8.1)
It pissed me off to not be able to install the "Unix" shell in Windows 7 Pro. I only wanted a toy environment with *sh, grep, less, wget, sed etc. and some simple programs, but still. It had a terrible reputation but it would have been interesting to have it. Cygwin sucks and a Vir
Re: (Score:2)
The gnu32 utils were the textutils, fileutils,etc. collections compiled for Win32. I would imagine you can still find them on the interwebs somewhere.
Re: (Score:2)
You already can do POSIX. Just use Cygwin. Of course that is not a solution MS will find palatable, as it exposes those doing it to a far saner and productive environment.
Re: (Score:2)
RTFA...it doesn't look that way
Re: (Score:2)
Windows NT does not use the DOS command line. It uses CMD and POWERSHELL. It also (until Windows 10) had an SUA UNIX subsystem that could implement shells such as BASH.
Windows ME was the last version of Windows to run using the Dos command interpreter. Starting with Windows XP, Command.com was removed from all 64 bit versions of Windows, so your computer probably does not even have a DOS command line.
Re: (Score:2)
It's still the same old DOS terminal. I mean, really, how hard can it be for Microsoft to develop something like Konsole or Yakuake?
Freely resizable window, freely choseable fonts and font sizes, fully supported copy and past, clickable URLs, etc.
Re: (Score:2)
It's fine to ignore it but it can be used for a single purpose it, that is to run the ping command. Very useful.
Re: (Score:2)
including UNIX