Add option to install only packages with unknown version (replace them with winget version)

[birbilis]

Description of the new feature / enhancement

I see these options:
--all Update all installed packages to latest if available
--include-unknown Upgrade packages even if their current version cannot be determined

but not an option
--only-unknown Upgrade packages when their current version cannot be determined
that I could combine with --all (or with some selection filter)

Proposed technical implementation details

I would like to have an option where for security concerns I'd like to replace packages with unknown version with their winget versions.

Also when doing list I'd like an option that shows only packages with unknown versions, not sure if there's such option currently (guess the above one would do when combined with "-list")

[denelon]

winget upgrade will show packages with "known" versions available for upgrade.

winget upgrade --include-unknown will show packages with both "known" and "unknown" versions.

winget upgrade --all will upgrade packages with "known" versions.

winget upgrade --all --include-unknown will upgrade both sets of packages.

When looking at the output, the "Version" column will display the version reported in the registry, or the packageVersion from the manifest if there is a matching manifest configured to use the "marketing" version. If you see a "<" symbol, it means the installed version is lower than any "marketing" version we have a manifest for.

When you see "Unknown", it means the software version isn't being reported by the package in the registry, so we don't have a way to reason about the installed version. Even if the source has a manifest which displays an "Available" version in winget upgrade, there is no guarantee that the package installer will correctly report the version.

It's always possible to winget upgrade <packageID> to trigger the installation of the latest version of an application. Unfortunately, the installer may still not report the installed version to the registry. This causes a loop condition where users would run winget upgrade --all and the package will still show an "Unknown" version after the upgrade. The "--include-unknown" argument was created to avoid that loop, but users can still run the upgrade on all packages.

[birbilis]

The problem I have is that winget upgrade --all is broken anyway in that it downloads and reinstalls the same known version packages again and again (including huge ones like Unity), whereas I'd like to focus on the ones that are detected but with "unknown" version to winget. Seems to be impossible to ignore the other (of known version) packages and focus just on those with "unknown" version (either list or upgrade just those).

[denelon]

I'd call that a "bug", and it could be related to the installers not writing the correct entries into Apps & Features (via the registry) or dealing with "side by side" packages where the newer one is installed in addition to the older one and we don't check to see if the latest one is already installed (we're working on that now).

• winget should not install an already installed package #929
• winget install should optionally upgrade only if a newer version is available #1411
• Better support for Side by Side packages #2129

I see more value in getting those "Unknown" version packages fixed by the publisher rather than add an "--only-unknown" argument to "upgrade". I'm not sure about the long-term value of doing that vs. just listing them out with "--include-unknown" and running winget upgrade <package> for each of the ones that are "unknown". I'm happy to leave this issue open to see if others feel this is higher priority than other things on the backlog.

[birbilis]

Is there some documentation on how WinGet detects those "unknown version" installations? Do the publishers of packages prescribe (declaratively I guess) how they are detected and how the "version" (when something has been installed outside of winget) is fetched?

[Masamune3210]

Unknown version is shown when there is no ProductVersion set in the registry for that application. As to how they are fetched when trying to upgrade them, it's the same as any app, the link is in the manifest with the reported version. It's up to the installer itself to set the ProductVersion though, so if it doesn't, it appears to WinGet that it was never upgraded