Windows Package Manager is a comprehensive package manager solution that includes:
- WinGet: The command line tool and client interface for the Windows Package Manager service.
- Submit packages to tát Windows Package Manager: The packaging services for hosting and installing applications on Windows devices.
- WinGet Configuration files: Create a mix of instructions for Windows Package Manager to tát consolidate the steps for manually setting up a device and onboarding to tát a new project to tát a single command that is reliable and repeatable. WinGet Configuration files utilize PowerShell Desired State Configuration (DSC) in combination with YAML formatted instructions and WinGet packages to tát handle your machine mix up.
Windows Package Manager is a helpful tool for:
- Developers who want to tát manage their software applications using the command line.
- Independent Software Vendors (ISVs) who want to tát distribute software.
- Enterprise organizations who want to tát automate device mix up and maintain a secure work environment.
Understanding package managers
A package manager is a system or mix of tools used to tát automate installing, upgrading, configuring and using software. Most package managers are designed for discovering and installing developer tools.
Ideally, developers use a package manager to tát specify the prerequisites for the tools they need to tát develop solutions for a given project. The package manager then follows the declarative instructions to tát install and configure the tools. The package manager reduces the time spent getting an environment ready, and it helps ensure the same versions of packages are installed on their machine.
Third buổi tiệc nhỏ package managers can leverage the Microsoft Community Package Manifest Repository to tát increase the size of their software catalog.
Windows Package Manager for developers
Developers use the winget command line tool to tát discover, install, upgrade, remove and configure a curated mix of applications. After it is installed, developers can access winget via the Windows Terminal, PowerShell, or the Command Prompt.
For more information, see Use the winget tool to tát install and manage applications.
For a video clip tổng quát of winget, see Intro to tát Windows Package Manager.
Find the latest Windows Package Manager announcements and version updates in the Windows Command Line Blog.
Windows Package Manager for ISV software distribution
Independent Software Vendors (ISVs) can use Windows Package Manager as a distribution channel for software packages containing their tools and applications. To submit software packages (containing .msix, .msi, or .exe installers) to tát Windows Package Manager, we provide the open source Microsoft Community Package Manifest Repository on GitHub where ISVs can upload package manifests to tát have their software packages considered for inclusion with Windows Package Manager. Manifests are automatically validated and may also be reviewed manually.
For more information, see Submit packages to tát Windows Package Manager.
Windows Package Manager for Enterprise Security
The WinGet client can be used in the command line to tát install and manage applications across multiple machines. Those responsible for setting up enterprise work environments, such as IT Administrators or Security Analysts, with the goal of maintaining a consistent level of security settings across everyone’s work machine may also be using Microsoft Intune to tát manage security using “Group Policy” settings.
To maintain ongoing security updates, the WinGet client is released using the Microsoft Store and installs applications from the Microsoft Store using the “msstore” source and applying “certificate pinning” to tát ensure that the connection is secure and established with the proper endpoint.
The Group Policy applied by your enterprise organization may be using SSL inspection via a firewall between the WinGet client and the Microsoft Store source that causes a connection error to tát appear in the WinGet client.
For this reason, the Windows Package Manager desktop installer supports a policy setting called: “BypassCertificatePinningForMicrosoftStore”. This policy controls whether the Windows Package Manager will validate the Microsoft Store certificate hash matches to tát a known Microsoft Store certificate when initiating a connection to tát the Microsoft Store Source. The options for this policy include:
- Not configured (default): If you bởi not configure this policy, the Windows Package Manager administrator settings will be adhered to tát. We recommend leaving this policy in the not configured mặc định unless you have a specific need to tát change it.
- Enable: If you enable this policy, the Windows Package Manager will bypass the Microsoft Store certificate validation.
- Disable: If you disable this policy, the Windows Package Manager will validate the Microsoft Store certificate used is valid and belongs to tát the Microsoft Store before communicating with the Microsoft Store source.
“Certificate Pinning” ensures that the package manager connection to tát the Microsoft Store is secure, helping to tát avoid risks associated with attacks such as Man-in-the-Middle (MITM) attacks involving a third buổi tiệc nhỏ inserting themselves between a client (user) and server (application) to tát secretly intercept communication flows to tát steal sensitive data such as login credentials, etc. Disabling “Certificate Pinning” (enabling the bypass) can expose your organization to tát risk in this area and should be avoided.
To learn more about setting up Group Policy for your enterprise organization, see the Microsoft Intune documentation.