Feature request: Allow to upload package as unlisted.

[gerardog]

First of all, thanks to all the team behind Chocolatey. It rocks!

As a software developer, I sometimes find it useful to upload pre-release packages for open-beta testing.
For example pushing a pre-release with choco push gsudo.1.2.0-alpha1.nupkg. Nonetheless, this package gets listed on Google Search, and to make matters worse, it may appear first in the search results.

The solution I found, is to unlist such package. Unfortunatelly, this is not possible via choco push command, nor via the web site, which says Until this package is approved, it is not allowed to be listed. when I try to unlist it.

This forces me to wait until it is approved, which is unpredictable, as it depends on how busy choco servers and moderators are.

A flag to upload as unlisted is desirable. Or a way to set as unlisted, before the package has passed automated testing.

Furthermore: A new status for packages such as 'draft' would be nice. It would work similar to how a package works before automated testing is approved. In such status, the package is unlisted, the owner would be able to install the draft package (using -pre and/or --version=SpecificVersionNumber) and, if necessary, re-upload a fixed version. When the owner clicks 'publish' button (or choco command), it will leave the draft status and become listed.

Thanks!

[pauby]

@gerardog I'm trying to understand the use case here. It sounds like you're using the Chocolatey Community Repository in a way that may not be desirable, hence why I'd like to know more.

[gerardog]

Assumptions:

• Once a package is submitted, time for package approval is unknown for the software vendor. Also can't be scheduled.
• The vendor can't unlist it before choco moderators/bots approval, and when approved it becomes listed immediately. So, once submitted, the vendor can't unlist it, before it's public (at least for a while).
• Once Listed, if captured by Google robot, it will appear forever in search results. ( Try to google gsudo, you will see version 0.2.0.0 as a result, after months being unlisted. Unfortunate google crawlink sometimes make old versions popup on the search results. People do click those links once in a while and they install that old version. Believe it or not it happens.
• Hence, once submitted, will get listed, at an unknown time.

Feature description:

Two possible specs for this feature come to my mind. Either:

• Allow upload as draft:

  • For example via choco push gsudo.%version%.nupkg --draft
  • In this state, the new version is in draft status, until the package owner Publishes it. It still can be installed while in draft if the correct exact version is specified (same as unlisted).
  • A re-upload is still possible (same as before validations pass)
  • Maybe package deletion could be enabled too if still in draft (just my opinion).
  • Automated testing can be engaged while in draft, but if manual moderation is required. Optionally it may not be listed in the moderation queue until published (not-draft), to not put moderation efforts until not-draft.

• OR Allow upload as unlisted:

  • For example via choco push gsudo.%version%.nupkg --unlisted
  • All workflow as usual, except that after automated testing pass/moderator pass it becomes 'approved', but still unlisted.
  • It becomes listed only after the package owner checks 'List XXX in search results.'

But why?

There could be many reasons for requesting this:

• Controlled release date/time: Allow release at a controlled date/time. (For example, upload but publish at same time backend services are scheduled to be deployed)
• Release pre-approval: Allow package-owner-initiated manual approval before going Listed.
• Failed Submission management: If package owner detects the submission is flawed before automated testing pass/moderators approval, allow it to disable the automatic listing (that occurs after all validations pass).
• Pre-release closed beta: To let a small number of users (who knows a pre-release tag) to test a specific pre-release. For example, see Issue: Chocolatey - Unable to install/uninstall if gsudo is running gerardog/gsudo#74 where users were specifically testing a change in the choco package installation scripts, that would allow gsudo choco upgrade gsudo (i.e. upgrade the app while the app is running). For an open source project with no budget, testing is limited and the community brings great feedback.
  • Not to be confused with an open beta. (for example with Listed=true) where anyone can choco upgrade xxx -pre. This approach doesn't fit my own specific needs because I think many people do choco upgrade all -pre without really knowing what they are upgrading my package, and if this breaks a few workflows unexpectedly, will generate a negative experience/perception of quality, instead of the desired conscious testing and feedback.

It's ok if you find one or more of this reasons not applicable for Chocolatey vision/roadmap, but I hope at least one of them do ring a bell for you.

Thanks!

[pauby]

There is a lot to consider here but I wanted to pick up on a couple of points.

I think there is a confusion on what 'Unlisted' means or a misunderstanding. When packages are submitted they are unlisted until they are Approved or Exampted. See the Mumble package below just as an example:

The Package has not been approved and has failed the Verification test, so is unlisted. What that means is that Chocolatey CLI cannot see it (to install, for example):

> choco list mumble --exact
Chocolatey v0.12.0
mumble 1.3.4 [Approved]
1 packages found.

unless I provide the version:

> choco list mumble --exact --version 1.4.230
Chocolatey v0.12.0 Business
mumble 1.4.230 - Possibly broken
1 packages found.

What I think you mean is that the web page for a package that is unlisted is not available and therefore wouldn't be indexed by search engine. That's problematic as we have to show the latest package version if it's in a specific state (in the case of Mumble, it's waiting for maintainer).

From the other comments you make it sounds like you want to do a release / announcement and then release the package. Or a closed beta. This is not in the spirit of what Chocolatey Community Repository is for - community packages, managed and maintained by the community. The solution to this would be to stand up your own repository using Sonatype Nexus, Artifactory etc. and you would have much more control over it.

[gerardog]

When packages are submitted they are unlisted until they are Approved or Exampted.

Exactly. that is the problem. That I don't want it to become listed automatically (sometime in the future). For example I can not retract the submission if it is flawed (I have to wait maybe hours until the 'unlist' button is enabled). And when the button is enabled, some bots are already tweeting about the new release, which i want to retract.

[pauby]

That I don't want it to become listed automatically.

I'm a little confused. Packages are unlisted until they are Approved or Exempted. A package will be automatically Exempted if it's a prerelease. A non-prerelease package will be Approved only after moderation. During that time the package is unlisted.

If you want to stop a package going through the process, you should be able to reject it (either doing this yourself or reaching out to the moderators, depending on the package status).

[TheCakeIsNaOH]

Once Listed, if captured by Google robot, it will appear forever in search results. ( Try to google gsudo, you will see version 0.2.0.0 as a result, after months being unlisted. Unfortunate google crawlink sometimes make old versions popup on the search results. People do click those links once in a while and they install that old version. Believe it or not gerardog/gsudo#57 (comment).

There is a banner that lets users know that a version is outdated:

Perhaps should that message be made more obvious?

[pauby]

Unless people run choco install gsudo --version 0.2.0.0 rather than choco install gsudo I'm unsure what the benefit would be?

[gerardog]

No benefit at all and it looks obvious already. It is simply human error, not paying enough attention.

[gerardog]

Perhaps should that message be made more obvious?

If I could suggest a change, that would be to add <meta name="robots" content="noindex"> to unlisted package versions
as described here.

That should unlist from search engines the results for package versions unlisted in choco.

[pauby]

That should unlist from search engines the results for package versions unlisted in choco.

I think that's a good idea. Can you raise an issue for that?

[gerardog]

Sure, whats the proper repo for the web page?

[pauby]

It's in this repository, just click the Issues tab.