From 4f3357fd10e56ddf37b31c64a34ae8eb92474924 Mon Sep 17 00:00:00 2001 From: Zoltan Csizmadia Date: Tue, 13 Oct 2026 20:47:20 -0500 Subject: [PATCH] docs: winget package is published wslkit.skrog 0.8.0 merged in microsoft/winget-pkgs#436048. Adds winget as an install route, drops the 'on the way' wording, and documents what happens with two installs side by side. Closes #412 --- README.md | 15 +++++++++++--- docs/install.md | 52 ++++++++++++++++++++++++++++++++++++++----------- 2 files changed, 53 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index eb73e54..a19aea7 100644 --- a/README.md +++ b/README.md @@ -59,6 +59,12 @@ fetches the upstream tools — see [docs/docker-cli.md](docs/docker-cli.md). irm https://wslkit.github.io/skrog/install.ps1 | iex ``` +Or with winget: + +```powershell +winget install wslkit.skrog +``` + Or with [scoop](https://github.com/wslkit/scoop-skrog): ```powershell @@ -66,6 +72,9 @@ scoop bucket add skrog https://github.com/wslkit/scoop-skrog scoop install skrog ``` +Use one of the three, not several — see +[pick one way to install](docs/install.md#pick-one-way-to-install). + The one-liner downloads the newest release, **verifies it against the release's `SHA256SUMS`**, unpacks it to `%LOCALAPPDATA%\Programs\skrog` and adds it to your PATH. It stops there on purpose — it does not provision anything. Then: @@ -89,8 +98,8 @@ Binaries are **not Authenticode-signed**, so SmartScreen warns on first run. The for projects with an established user base — and invited a reapplication as visibility grows; paying for a certificate is the other route and needs nobody's approval. Which one, and when, is [#358](https://github.com/wslkit/skrog/issues/358). An MSI waits on the -same answer, since an unsigned installer asking for elevation is worse than a zip; a -winget package does not, and one is on the way. The +same answer, since an unsigned installer asking for elevation is worse than a zip; the +winget package did not, and is published. The [code signing policy](docs/code-signing.md) says who could produce a signed binary and how. What every release **does** carry today is SLSA build provenance and a cosign-signed `SHA256SUMS` — two checks an Authenticode signature does @@ -298,7 +307,7 @@ docker context. Nothing else on the system is touched. ## What's ahead -A winget package, and signed installers beyond it — tracked in the +Signed binaries, and an MSI once they are — tracked in the [issue tracker](https://github.com/wslkit/skrog/issues). Data-dir relocation shipped: see [`skrog relocate`](docs/housekeeping.md). diff --git a/docs/install.md b/docs/install.md index a3c63dc..ede6ec3 100644 --- a/docs/install.md +++ b/docs/install.md @@ -83,6 +83,22 @@ counts pre-releases too, so it can tell you a preview exists on a machine this script put on the stable build — first contact should be stable, an explicit "what is new?" should be complete. +### Or with winget + +```powershell +winget install wslkit.skrog +``` + +It installs per-user with no elevation, and puts a `skrog` alias in +`%LOCALAPPDATA%\Microsoft\WinGet\Links`. Open a new shell afterwards — winget +adds that folder to PATH, and a shell that was already open does not see it. +Then `winget upgrade wslkit.skrog` keeps it current. + +A new release reaches winget only after its manifest passes review in +[microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs), so winget +can trail the [latest release](https://github.com/wslkit/skrog/releases) by +days. `winget show wslkit.skrog` says which version it has. + ### Or with scoop ```powershell @@ -90,13 +106,23 @@ scoop bucket add skrog https://github.com/wslkit/scoop-skrog scoop install skrog ``` -Then `scoop update skrog` keeps it current. Skrog notices it is managed — -`skrog upgrade --apply` refuses inside a package-manager directory and tells -you to use scoop instead, rather than fighting it for the same files. +Then `scoop update skrog` keeps it current. + +Skrog notices when winget or scoop manages it — `skrog upgrade --apply` +refuses inside a package-manager directory and names the manager's own upgrade +command, rather than fighting it for the same files. Neither package is +blocked on code signing, which this project believed for longer than it should +have; only the MSI is. + +### Pick one way to install -A winget package is [#412](https://github.com/wslkit/skrog/issues/412). Neither -is blocked on code signing, which this project believed for longer than it -should have; only the MSI is. +A second install does not replace the first: you get two copies, and whichever +folder comes first on your PATH wins. The install script and winget both append +their folder to the user PATH, so the one you ran *first* keeps winning — run the install +script and later `winget install`, and a plain `skrog` still runs the script's +copy, at whatever version that was. Remove one — +`winget uninstall wslkit.skrog`, or delete `%LOCALAPPDATA%\Programs\skrog` and +its PATH entry — and check with `Get-Command skrog -All`. ### Or by hand @@ -138,9 +164,10 @@ and `README.md`. Keep them together. > An **MSI** waits on the same answer, because an installer that asks for > elevation unsigned is a worse experience than a zip, not a better one. A > **winget** package does not — winget's `portable` type unpacks per-user and -> needs no elevation or signature — and one is on the way; until it lands it is -> download-and-unpack, which is exactly why the checksum step above is written -> out in full rather than waved at. +> needs no elevation or signature — and [it is published](#or-with-winget). +> winget checks the zip against the hash in its manifest before unpacking; by +> hand, that check is yours, which is why the step above is written out in full +> rather than waved at. > > What every release *does* carry today is **SLSA build provenance** and a > **cosign-signed `SHA256SUMS`** — two things an Authenticode signature does not @@ -269,7 +296,9 @@ never costs you a cold start. skrog upgrade --apply ``` -That replaces `skrog.exe` itself. The engine is a separate, pinned thing: +That replaces `skrog.exe` itself — unless winget or scoop installed it, in +which case `winget upgrade wslkit.skrog` or `scoop update skrog` does, and +`--apply` refuses and says so. The engine is a separate, pinned thing: `skrog engine list`, `skrog engine upgrade`, `skrog engine rollback`. See [upgrading.md](upgrading.md) and [engine-upgrade.md](engine-upgrade.md). @@ -281,7 +310,8 @@ skrog uninstall Removes the distro, the supervisor registration and the docker context. It asks before deleting engine data — images and volumes — because that is not -recoverable. Then delete the folder from step 1. +recoverable. Then remove `skrog.exe` the way it arrived: delete the folder from +step 1, or `winget uninstall wslkit.skrog`, or `scoop uninstall skrog`. ## If something goes wrong