How to Use Windows Package Manager

Microsoft recently announced at Build 2020 that it is working on a native open-source package manager for Windows. Due to hit general availability in May 2021, Windows Package Manager is now accessible on GitHub and for Windows Insiders in preview. In this article, I will show you how to use Windows Package Manager (WPM) to search the repository and install apps.

For more information on the Build announcement, see Microsoft is Finally Building a Native Package Manager in Windows on Petri.

Before you start using WPM, bear in mind that this is a preview version of WPM and much of the functionality is yet to be fleshed out.

How to get Windows Package Manager

Before you can use Windows Package Manager, you need to install it on your system. WPM consists of two components: the Package Manager service and the winget client tool. Winget is included in the preview version of App Installer, which is an app available via the Microsoft Store. To get the preview version of App Installer, the device on which you install it must be registered for Windows Insider updates.

For complete instructions on how to become a Windows Insider and register a device for Windows Insider updates, see Microsoft’s website here.

Get Windows Package Manager from the Microsoft Store

Getting WPM from the Microsoft Store is the recommended method. To download the preview version of App Installer, follow these instructions:

  • Type store into the search box in the bottom left of the taskbar and click Microsoft Store in the list of results.
  • In the Store window, click Search in the top right corner, and type App Installer into the Search box.
  • Click App Installer as it appears below the Search box.
  • On the App Installer page, click Get to install it.
  • Once App Installer has installed, you can start using WPM.
  • Close the Store window.
Image #1 Expand
Figure1 9
How to Use Windows Package Manager (Image Credit: Russell Smith)

Get Windows Package Manager from GitHub

Alternatively, if you don’t want to register a device for Windows Insider updates, you can build the client yourself. It requires Windows 10 version 1709 or later. For more details, check out GitHub.

Searching for apps in the WPM repository

Microsoft chose not to contribute to existing open-source package managers partly because it wanted to create a repository of trusted applications. Microsoft’s WPM repo includes app manifests that are automatically checked using SmartScreen, static analysis, SHA256 hash validation, and a few other processes to limit the chances of malware getting into the repository.

To search the repository for apps, open a command prompt or PowerShell, and use the following command to list all apps in the repo:

winget search
Image #2 Expand
Figure2 6
How to Use Windows Package Manager (Image Credit: Russell Smith)

If you want to search for something specific, you can type the exact name or part of the name. Both commands return Windows Terminal.

winget search "windows terminal"

winget search terminal

For a complete list of what is possible with search type:

winget search --help

If you need more information about an app, like the version number, SHA265 hash, and other metadata that might be provided, use winget show:

winget show "windows terminal"

Installing apps using Windows Package Manager

Once you know the name of an app in the repository, you can install it. The following command installs Windows Terminal.

Image #3 Expand
Figure3 4
How to Use Windows Package Manager (Image Credit: Russell Smith)

Additional options can be specified to control which app gets installed. For example, you can specify a repository using -source, –version can be used to specify an exact version to install, and -silent used to run the installer in silent mode. For a complete list of the options available, use:

winget install --help

Creating your own installers

The hash and validate commands can be used if you want to create a manifest file for submitting software to the Microsoft Community Package Manifest Repository on GitHub. The hash command generates the SHA265 hash for an installer. If you specify the –msix option, it can also create a SHA256 SignatureSha256 for MSIX installers.

The validate command is used for validating application manifest files. Manifest files are written in YAML and include a set of required items. For a complete list of required and optional items, see the YAML specification on GitHub.

Once you have created a package manifest, it can be uploaded to repository on GitHub. You need to submit a pull request to add your manifest to the repo. The request triggers an automated process for validating the manifest and package. For complete instructions on submitting manifests, see Microsoft’s website here.

Windows Package Manager has been a long time coming

As you can see, there is still quite a lot of important functionality missing from WPM. Like the ability to remove apps. WPM can be used to install apps from the WPM repo on GitHub or from local packages. Microsoft is also promising that WPM will be able to install apps from the Microsoft Store at some point in the future.

We need to wait another year before WPM makes general availability. If you are interested in a more mature package manager for Windows in the meantime, check out Chocolately.

Related Article: