Why isn't winget the default installation method?

[akirataguchi115]

The README suggests downloading and installing through releases. What's the reason why the README doesn't just say

winget install nvm-windows

?

[coreybutler]

First, winget doesn't ship with Windows. We don't need to arbitrarily add a dependency. In many enterprises, winget isn't allowed at all, which would create a blocking barrier for nearly half of the NVM4W community. Bottom line: winget is a convenience, not a default. We don't support it, but someone is maintaining a winget release.

With Runtime, we will release on several distribution channels. Winget is one of the channels we'd like to release on.

[akirataguchi115]

I'll mark this as an answer as this might be the closest thing I'll ever get to an answer.

With a quick search winget does ship with Windows. I don't think winget is a dependency but a distribution platform. Those enterprises that don't allow the use of winget should maybe think twice if they allow downloading arbitrary binaries from a browser rather than from winget. Bottom line: winget should be a default. We should encourage enterprises and other entities to download software the modern and safer way.

[coreybutler]

Winget doesn't ship with Windows by default. It's available as an add-on in the Windows Store, as described in the Microsoft Documentation. If NVM4W required winget to be installed, then NVM4W would be dependent on the existence of winget, thus making it a dependency to acquire NVM4W.

Most organizations do not allow arbitrary downloads either. Randomly downloading an executable will not work in typical enterprises. NVM4W is the only Node version manager that code-signs its installers and executables with an extended validation certificate (i.e. we've gone through the trust-verification process for Microsoft). In other words, it's not just a random download, it is a vetted and trusted application. This is why it is allow-listed by thousands of large enterprises.

Winget is no safer than downloading arbitrary code. The Winget registry is an open one, meaning anyone, including bad actors, may contribute malicious applications. The modern safe way for enterprises to install software is through Active Directory. Organizations test/vet software and release it through group policies defined specifically for their organizations. This is why NVM4W ships a "noinstall" version, which has been verified with all of the modern antivirus organizations. Most enterprises use this version to create their own Active Directory deployments. This allows them to install/update applications on employee computers automatically... meaning users don't perform any installations on their own (the software just shows up on their computer).

I'll reiterate that in my opinion, winget is a convenience for developers who are not on Active Directory and seek an experience similar to Homebrew. That's why we're planning to support it in Runtime, but we will still recommend Active Directory deployments as the preferred mechanism for enterprise installations. In that vein, we are planning to switch from an exe-based installer to an MSI-based installer to make this process easier for enterprises. We will continue to code-sign and verify Runtime with antivirus vendors as we have with NVM4W.

[akirataguchi115]

Thanks for the reply.