Verification/audit/review process?

[Brandon H (brandonh-msft)]

Who or what is actually vetting packages to make sure they're not malware/spyware/malicious? Seeing things like this makes me extremely skeptical of what's landing in the pkg feed.

[Kaleb Luedtke (Trenly)]

https://github.com/microsoft/winget-pkgs/blob/master/doc/FAQ.md#how-do-i-know-the-packages-in-the-community-repository-are-safe

[Imre Eilertsen (DandelionSprout)]

When it comes to new packages and to new versions of packages, the installer is run through all sorts of antivirus engines, even including ones that have been a bit overzealous with false positive detections from time to time such as ESET.

[Brandon H (brandonh-msft)]

k so that answers the safety thing but what is being done to avoid what is seen in the screenshot? It hurts the user experience of winget if there are numerous copies of the same app

[Imre Eilertsen (DandelionSprout)]

There's been a disastrous inflow this summer of PRs from app devs who have little clue what their apps actually are or do, or even about whether they work or not:

• Time to address the 2nd elephant in the room: There are too many really bad and/or pointless vibecoded PRs for vibecoded new apps. #436255

Thus, checking them (except DeepSeek-TUI) real quick, and then calculating by (and sorting by) amount of stars, and secondarily by other things:

• ningbainb.DeepSeekHarnessDesktop: 714★, seems to have many users. Should in my opinion remain as-is.
• Sakana-yuyu.DeepSeekHarnessDesktop: 56★. Supposedly a direct and somewhat-oft-synced fork from the main DeepSeek repo, so I have to presume the user (Sakana-yuyu) know what they're doing. Could probably be renamed to "DeepSeek Harness Desktop (Sakana-yuyu)".
• hongfeiyucode.DeepSeekHarnessDesktop: 36★. Has a suspiciously low amount of commits, and has only 1 contributor. Should be removed from the repo.
• zcx960.DeepSeekDesktop: 7★. Has far more contributors than I'd have expected from such a lowly starred repo, so it's not one person's clueless vibecoding. Judging by its Readme, it should be renamed to "DeepSeek Desktop Chat".
• Buktal.DeepSeekDesktop: 4★, 1 contributor, no apparent signs that anyone but Buktal has used it. Should be removed from the repo.

[Brandon H (brandonh-msft)]

sure, but I have to believe you're not suggesting that everybody operating winget go through this exercise for variant of every pkg they want to consume ... right?
FWIW I 👍🏻 the linked issue. totally agree.

[Imre Eilertsen (DandelionSprout)]

I at least haven't heard of any rules against having similar builds by different devs of the same app; FFmpeg and MPV are the most prominent cases I know of.

But one thing that most certainly isn't making it any easier to delete particularly poor builds, is because apparently the by-now-legendarily extremely overworked admins need to approve each case in which an entire app is removed from winget-pkgs. And "extremely" is an understatement, considering the general tone throughout the following thread:

• Time to address the elephant in the room: There are too few users with PR merging rights who merge PRs. #333858.

[Charlie Chen (SpecterShell)]

sure, but I have to believe you're not suggesting that everybody operating winget go through this exercise for variant of every pkg they want to consume ... right?

DeepSeek Harness hadn't had its official desktop client since its debut (until recently), which is the reason many (I've seen 10+) 3rd-party desktop clients show up. While some of them may have advantages over the others, even including the official npm version of DSH, we can't simply propose any of them and make it like the official one. Users have to carefully select the 3rd-party variant that meet their needs well, or wait for the official one to come.

I at least haven't heard of any rules against having similar builds by different devs of the same app; FFmpeg and MPV are the most prominent cases I know of.

Other examples include:

• Apache NetBeans
• MinGW