search

microsoft / winget-cli

WinGet is the Windows Package Manager. This project includes a CLI (Command Line Interface), PowerShell modules, and a COM (Component Object Model) API (Application Programming Interface).
https://learn.microsoft.com/windows/package-manager/
MIT License
23.15k stars 1.44k forks source link

Unexpected package installation based on tag search #3492

Closed samedder closed 1 year ago

samedder commented 1 year ago

Brief description of your issue

It seems that in general the default search and install behavior is vulnerable to tag squatting. For example, when searching for "chrome" it's plausible the user wants Google.Chrome.Dev Google.Chrome, but instead XP890QTFL1X0D0 from mstore or Dichromate.Browser is returned.

Steps to reproduce

From pwsh:

winget install chrome

Expected behavior

Install Google.Chrome from winget

Actual behavior

PS C:\> winget install chrome
Found 小智双核浏览器 [XP890QTFL1X0D0] Version 6.0.3.16

[...]

Tags:
  chrome,chromium,IE,Camino,Epic,Focos,UR
  Mozilla Firefox,bing,Browser Pro+,Brave
  Yandex,UC,apple Safari,vivaldi,SeaMonkey
  DuckDuckGo,lnternet Explorer,Torch,Avant
  Midjourey,QQ,baidu,2345,X Browser,C Lite
  wikipedia,yahoo,flash,extensions,ChatGPT
  O-browser,Opera GX,BlueSky,BlackHawk,Tor

Environment

PS C:\> winget --info
Windows Package Manager v1.5.1881
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22621.1992
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.20.1881.0
denelon commented 1 year ago

winget show <package> displays metadata for the package to be installed if only one "best match" is available based on sources. The current behavior for the "msstore" source tries to return the "best match", so it's best to search first.

winget search <package> displays the list of packages to help a user determine what is available.

Google.Chrome doesn't have a "moniker" of "chrome" so it doesn't get selected as a best match for disambiguation.

samedder commented 1 year ago

Is the suggestion then for package maintainers to try and obtain a reasonable set of "common" monikers for their package?