If the same people whose shitty apps gave us email viruses and pop-ups want to drag out the crayons and make a packager, that'd be cool. This one isn't sound or complete yet, from what I hear on the inside.

scoop

Scoop looks cute, but if I'm reading it right the manifest (where the pre-install and hash is) isn't itself signed. It presents some neat-o attack space in addition to the supply-chain attack (always, always cringe whenever installers go out and automatically find dependencies for you without you firmly specifying source) make me think this one has some work to do yet. By comparison, prior art for both of those existed in Linux land for about 2 decades, along with simple local repo caching.

I see there's talk of merging or feeding into either choco or winget already, despite the loss of superior layout it has over choco or the superior packaging and management it has over winget .

Scoop is neat, but it could look to its counterparts for improvement potential.