search

mandiant / flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Apache License 2.0
6.34k stars 896 forks source link

WinGet Prospects? #482

Open ElliotKillick opened 1 year ago

ElliotKillick commented 1 year ago

WinGet is quite mainstream now and a lot of packages are available in the official Microsoft repositories.

There's some notable benefits to WinGet such as:

The only con I can think of is that I don't think WinGet supports Windows 8/8.1. However, that version of Windows has been out of support now for a while anyway. There may also be some packages used by Flare VM which haven't made their way to official WinGet repositories yet (this should probably be checked as the first step).

I'm just throwing the idea out there to get Flare VM's prospects on this matter. If a port is planned then it would probably take a decent amount of effort to get done.

Thanks!

mr-tz commented 1 year ago

Hey, thanks for the great idea. That could be a way forward and I think we'd be open to support this - especially with contributions from the community around it. First, being the research on package availability on WinGet vs. Chocolatey.

Ana06 commented 11 months ago

Thanks for sharing this idea and for offering your help @ElliotKillick. But this would imply rewriting all the packages in VM-Packages as well as rewriting most of the scripts and CI. That is a huge amount of work/time.

Most packages are maintained by their own upstream (this avoids the common issue of the Chocolatey package being out of date)

Is there any concrete package that we use that is affected by this?

I don't think WinGet supports Windows 8/8.1.

FLARE-VM does not support Windows 8.

necrose99 commented 10 months ago

Winget can be added for some packages or updates.. On my system i use both as a more complete upgrade packages.. Also powershell scripts or libraries to automagic-icate this too.. on github .. At times winget is = to choco or >= a tad newer.

However winget has certificate 📌 📍 pinned issue.. Which one has to force kill the defacto repo... and force use a certbot enabled.. proxy (work arround) ms-cert issued/pinned cert has expired... , thier are a few tray-gui tools one based in python.. or etc.. Or etc , that will run chocolatey, winget node.js , paket /cake. .net (dotnet building deps) , *etc updates onto system.. at start-up.. /login

rethinksec commented 8 months ago

The package rewrite can be in a way quite straight forward as there share the similar pattern (XML on Chocolatey vs YAML on winget). At the same time, we can also set our own YAML file so that winget reads the config & perform the installation accordingly (Source: https://learn.microsoft.com/en-us/windows/package-manager/winget/install#options). In my personal experience also has a higher successful rate in terms of installation as compared to Chocolatey (I always need to perform manual installation for certain tools because they have failed due to hash mismatch, or the link not working as taken down by original author etc). Winget can defintely helps in making installation more sustainable & stable (especially for Microsoft related applications).