Skip to content

Auto-detect PackageDependencies from installer PE import table #676

@kalmix

Description

@kalmix

Description of the new feature / enhancement

When a package links against common runtimes like VCRedist or .NET, the
PackageDependencies field must be filled in manually. There's no tooling
to catch missing dependencies, so publishers often omit them unknowingly
and only find out during PR review when a maintainer flags it causing
unnecessary roundtrips.

winget-create already downloads the installer/executable, so it has everything it
needs to detect this automatically.

Proposed technical implementation details

After downloading the installer, if it's a PE binary (.exe/.dll), parse
its import table using System.Reflection.PortableExecutable.PEReader
and match imported DLLs against a known mapping:

Imported DLL WinGet Package
VCRUNTIME140.dll Microsoft.VCRedist.2015+.x64
MSVCP140.dll Microsoft.VCRedist.2015+.x64
VCRUNTIME140.dll (x86 binary) Microsoft.VCRedist.2015+.x86
MSVCP140.dll (x86 binary) Microsoft.VCRedist.2015+.x86
VCRUNTIME140_1.dll Microsoft.VCRedist.2015+.x64

If a match is found, either auto-populate PackageDependencies in the
generated manifest, or prompt the user to confirm before adding it.

This came up during a winget-pkgs PR review (microsoft/winget-pkgs#389270)
where a reviewer had to manually flag a missing VCRedist dependency.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Issue-FeatureComplex enough to require an in depth planning process and actual budgeted, scheduled work.Needs-Triage
    No fields configured for Feature.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions