Leave old manifests, or accept updates ones even though their extend may be reduced?

[borque]

Hello and happy new year!

Perhaps the following seems more serious to me than it really is, but anyway I need some guidance here (my apologies if this already has been discussed and decided upon):

As Winget-manifests is a mostly community-driven project the quality and refresh frequency have a wide span.

Some packages are seemingly abandoned after one ore some initial submissions, others are updated but are missing importand security updates for longer times (relative to the importance).

An example for the first category is geeksoftwareGmbH.PDF24Creator where there were no new submissions for month after 11.3.0, for the second category Mozilla.Thunderbird and Mozilla.Firefox.ESR are examples.

As I use this software I noticed the lack of updates and created a series of updated manifests, but due to a lack of time and download-bandwith slightly reduced them, i.e. removed exe-installers and/or some languages.

@mdanish-kh brought to my attention that these reduced manifests caused issues for some users ( #92590 ).

IMO this raises the fundamental question whether it is preferred here to keep the manifests up-to-date as good as possible even though there might be a reduced extend or whether the old manifests should remain the current ones to prevnt bad update experiences as mentioned above.

But aside from this for especially for the issue mentioned above a technical solution within winget might be preferable?

Thanks!

[mdanish-kh]

Some packages are seemingly abandoned after one ore some initial submissions, others are updated but are missing importand security updates for longer times (relative to the importance).

As we currently don't have advanced automation for packages, the best way to keep a package up to date is when the user of the package notices there is an update available.

IMO this raises the fundamental question whether it is preferred here to keep the manifests up-to-date as good as possible even though there might be a reduced extend or whether the old manifests should remain the current ones to prevnt bad update experiences as mentioned above.

We generally prefer complete manifests that include all InstallerTypes and all locales the package ships with but we do realize that it's a very daunting task to manually update some packages like as you mentioned the ones from Mozilla i.e., Firefox, Thunderbird.. (that have even forced us to increase the installer nodes limit in the schema😄). You can take a look at #13266 where this has been partially discussed. So, currently for these packages only user-requested locales are added to the manifest because there are simply too many of them. The actual solution is to have automation take care of these packages.

As I use this software I noticed the lack of updates and created a series of updated manifests, but due to a lack of time and download-bandwith slightly reduced them, i.e. removed exe-installers and/or some languages.

A better way would be to create an issue if you find an outdated package. This would notify other contributors (that are not necessarily the users of that package) who can assist you with the manifest submission. Issues are prioritized and simple ones like updating an outdated package are generally resolved quickly.

Edit: Happy New Year!

[borque]

This sound like a reasonable approach to the problem. Which practical way do you consider best:
a)
Simply create an issue about the oudated package and wait for someone else with more resources to create it
b)
Create the package as far as possible, create a pull request and state in the initial declaration that some parts (installers/languages/...) are missing
c) Create the package as far as possible, create a pull request and a parallel issue ("Help wanted") about the missing aspects pointing to that pull request

Btw: Have the manifest updates for Mozilla been automated meanwhile?

[mdanish-kh]

I feel like just making an issue about it would suffice. Don't get me wrong, I don't want to stop you from making PRs. If you have the resources, by all means go for it. But I feel like this approach would be faster for everyone involved. The reviewer wouldn't have to figure out which installers are missing and manually suggest changes. A simple Quick Update from YamlCreate.ps1 or wingetcreate would be much faster.

Btw: Have the manifest updates for Mozilla been automated meanwhile?

Not that I'm aware of.