rocolatey / rocolatey

🚀 fast Chocolatey queries

ROCOLATEY

Main 🚀

Dev 🚀

What is Rocolatey?

R(ocket-fast) Chocolatey queries.

• mimics output of Chocolatey commands (drop-in replacement)
• doesn't make use of Chocolatey or chocolatey.dll - just looks at the filesystem / does native API call on source feeds.
• can be used to query Chocolatey status while choco.exe is running.
• it's supposed to be much faster for each command that has a Chocolatey counterpart.

Important Notice, March 2024

Due to changes in the OData endpoint of the Chocolatey Community Repository, the main performance benefit of roco when dealing with this feed is gone. - Bulk queries to this repository are not possible anymore. Rocolatey will still be faster than choco with CCR, although only in the --ignore-http-cache mode of choco.exe.

All other NuGetV2 feeds/artifact repositories that I know of still support this feature - roco.exe will outperform choco.exe by factors on any of them, - especially interesting when you're dealing with internal feeds/ caching connectors to the community gallery.

Due to the nature of how Chocolatey handles it's internal cache and the huge amount of wrong results Chocolatey gives when searching for outdated packages, the development of Rocolatey will be continued for the forseeable future.

Installing...

Use Chocolatey!

choco install rocolatey

... or grab the latest binary from here.

Why are Rocolatey queries so much faster than Chocolatey's counterparts?

Rocolatey exploits some suboptimal algorithmic decisions in the original choco.exe (well, NuGet client library actually), it uses SAX parsers instead of reading the whole DOM of nuspec and config files, does a lot less API-calls when talking to Package repositories etc. etc.

What can roco do for me?

Take a look at the help (roco -h), basically roco allows you to list installed packages, list failed package installs, configured sources and check for updates. In addition to that, there may be some hidden gems that are only available in roco, but not in vanilla Chocolatey.

Normally you should not run multiple Chocolatey instances at the same time, however this may be required in certain scenarios. If you wanted to check if updates are available, or simply list all configured sources, roco is there to help you out without worrying of breaking something because you accidentally called choco in parallel.

Another scenario would be when traveling or on commute: checking for outdated packages on a slow network connection with roco.exe works for most users where choco.exe would time out or simply won't work.

seriously, why are you doing this?

I've started roco as a pet-project in late 2019 because I wanted to take a stab at Rust programming, and back then I spend a lot of time automating software deployments with Chocolatey. The more packages and feeds I added to the setup, the more time was lost on doing basic choco commands such as choco list -lo -r, hence I figured it would be a good idea to speed up what I call "Chocolatey queries".

CAN I use Rocolatey in productive environments?

Yes.

SHOULD I use Rocolatey in productive environments?

It depends. (probably yes if do a lot of outdated checks and require up-to-date (non-cached results)) For most use-cases, I would recommend sticking to choco.exe. (note though roco.exe will give up-to-date results always, whereas choco.exe requires --ignore-http-cache for the same results)

How much faster is roco.exe compared to choco.exe?

It very much depends on the number of installed packages and configured feeds, generally speaking roco should always be faster than choco, except for the Chocolatey Community Gallery (starting March 2024). Roco becomes faster when dealing with many packages and feeds.

rocolatey-cli ("roco")

call using roco.exe, see roco -h for help.

roco list

mimics the output of choco list -lo, make sure to use -r switch in automated environments!

roco bad

get a list of packages that failed to install. (basically the same as roco list, but look in lib-bad/ instead of list.)

roco source

mimics the output of choco source list, make sure to use -r switch in automated environments!

roco outdated

mimics the output of choco outdated, make sure to use -r switch in automated environments!

rocolatey-server

exposes a REST api for fetching Chocolatey package info from a host.

currently implemented endpoints:

• rocolatey/local
• rocolatey/local/r
• rocolatey/bad
• rocolatey/bad/r

you can specify which address and port to listen to, use -h to display help text.

GET http://127.0.0.1:8081/rocolatey/local

rocolatey's Issues

Performance of roco 0.9 is worse than 0.8 with _many_ Chocolatey feeds

Rocolatey seems to slow down when dealing with 'many' (let's say more than 5) feeds - this is most likely due to the optimization that's been introduced in version 0.9 in order to counteract degradation of performance when dealing with the CCR.

See this -> will most likely need to put an upper end of chunks here just in case...

roco outdated <pkgid> fails if<pkgid> is not present

currently, roco outdated somepkg always "succeeds" if somepkg is not present on the local system.
usability improvement: early failure if somepkg is currently not installed (cannot be outdated)

improve/fix error handling

check all unsafe unwrap / expect calls and replace with proper error handling/messages.

roco outdated output is incorrect

something seems to be wrong with the semver comparison

roco crashes when feed is not reachable

D:\>roco outdated
thread 'tokio-runtime-worker' panicked at D:\a\rocolatey\rocolatey\rocolatey-lib\src\roco\remote.rs:139:18:
failed to get remote packages: "failed to receive packages from NuGet v2 feed"
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'main' panicked at D:\a\rocolatey\rocolatey\rocolatey-lib\src\roco\remote.rs:144:28:
called `Result::unwrap()` on an `Err` value: JoinError::Panic(Id(22), ...)

outdated -r lists packages that are not available on remote repos

choco does not ..

outdated is missing possible updates for packages that exist in different versions on multiple feeds

choco output

a-test-pkg|6.0.0.20200617|7.0.0.202101113|false
...

roco output

...

add '-l' switch to 'outdated' command

see GH-68

roco outdated -l should simply output a whitespace-separated list of packages that could be updated.

implement verbose mode

i.e.:

• display timestamps/duration for each command.
• roco outdated could/should display ODATA query URLs.
• roco list should print paths of nuspecs found/read
• ...

first ODATA request should not include credentials

... only pass credentials to remote server/feed if first request (without creds) returns a 401

implement 'roco source' as counterpart to 'choco source'

most bits should already be in place (configured feeds are already extracted in roco outdated)

PowerShell tab completion

Would like this.. so used to typing choco outtab 🙂

roco outdated lists installed prereleases as outdated

i.e.
local installed firefox-0.85-beta2 will be listed as outdated, even if firefox-0.84.1 is the latest available on remote feeds.

minimal failing test case:

assert!(semver_is_newer("1.11-alpha", "1.07"));

build and deploy 32 bit version

it occurs some people still have to use 32 bit Windows OS :-/
-> building a x86 executable and including it in the choco package should be trivial.

Please don't add completions on install, and instead make them some command, or notify on first usage

I use PSLazyCompletion and would much prefer to symlink it, but everytime this package updates, it adds this line to my $profile that I have to delete.

rocolatey/nuget/tools/ChocolateyInstall.ps1

Lines 11 to 18 in 3b9ec5b

	### RocolateyTabCompletion ###
	`$RocolateyProfile = "$rocoTabCompletion"
	if (Test-Path(`$RocolateyProfile)) {
	Import-Module "`$RocolateyProfile"
	}`n
	"@ | Out-File $profile -Append -Encoding utf8
	}
	}

Also can be a one liner like

"Import-Module '$rocoTabCompletion' -ErrorAction SilentlyContinue"

or

"Import-Module '$rocoTabCompletion' -ErrorAction Ignore"

Rocolatey is unable to detect outdated packages from Chocolatey Community Repostiory

I am using the following versions:

• Chocolatey v2.2.2
• Rocolatey v0.8.2

Recently, rocolatey is unable to detect outdated chocolatey packages & is failing with the following error:

failed to fetch packages: failed to receive packages from NuGet v2 feed 'https://community.chocolatey.org/api/v2/'

This can can be seen from the below screenshot:

To investigate further I did the following:

• I executed the roco outdated -v to get verbose output which gave the following result (partial screenshot below):

- Upon making the API call with the link from the above screenshot, I found the following result: - This, finally, led me to this link: [Chocolatey API Changes](https://blog.chocolatey.org/2024/03/ccr-api-changes/#api-changes). As far as I understand from this, filtering options are only allowed now using chocolatey CLI & associated library.

Please let me know in case of any further info.

Exception running roco outdated

When running roco outdated I received the following error:

[00:00:08] =================================================================================================================     206/206     receive packages from 'chocolatey'
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: ParseError("expected more input")', rocolatey-lib\src\roco\remote.rs:187:58

Happy to provide debug info if you let me know what you need.

UPDATE: Debug info is in this gist

wrong output in 'outdated' command

❯ Compare-Object $r $c  
InputObject SideIndicator 
----------- ------------- 
Chocolatey v0.10.15 Business => 
Chocolatey has determined 57 package(s) are outdated. => 
7 package(s) had warnings. => 
 Rocolatey has determined 57 package(s) are outdated. <= 
7 packages(s) had warnings. <= 

packages(s)

(choco pkg) add vcredist dependency

add colored text output

as discussed via slack, please implement colored text output like choco.exe supports for subcommands (yellow, green, magenta, etc.)

Outdated does not work with authenticated nexus repository

When running roco outdated on a machine that has an authenticated nexus repository as the only source, it does not find any updates and gives warnings for all packages installed. There are a number of outdated packages found when running choco outdated.

---

Also, this lives up to the hype and is super fast compared to choco with checking the chocolatey.org repo.

Plans to add upgrade support?

Hey, thanks for building this!

Do you plan to add support for upgrading packages? roco upgrade all etc?

allow roco outdated to run for a specific package

Background: many times a user just want's to know if a new version of a specific package is available.
Doing this with Chocolatey like so: choco upgrade <pkgid> --noop takes much longer than necessary, getting worse when dealing with multiple feeds.
As roco does not feature upgrade functionality, extending the outdated command to take in an additional parameter seems to be a good choice.

support NuGet v3 feeds

Chocolatey 2.0 is going to support NuGet v3.
In order to stay compatible/support all feeds from chocolatey.config, rocolatey should also be able to work with v3 feeds.

roco outdated for a single package is too slow

roco outdated pkgid should only do one http request per configured feed, each taking a couple of milliseconds.

known so far:

• there are done two calls per feed, the first one used to determine the "possible bulk query" size for the feed, the second one with the actual odata query.
• starting a PowerShell executable for decrypting secured feed credentials adds the overhead of 1x PowerShell-startup time for each encrypted feed in chocolatey.config

thread 'main' panicked at 'failed to get choco dir: NotPresent' (choco `1.3.1`)

As of the latest choco update, roco panics on roco outdated, seems like the dirs were changed

thread 'main' panicked at 'failed to get choco dir: NotPresent', rocolatey-lib\src\roco\mod.rs:222:42
stack backtrace:
   0:     0x7ff6180e8402 - <unknown>
   1:     0x7ff61810a48b - <unknown>
   2:     0x7ff6180e086a - <unknown>
   3:     0x7ff6180e814b - <unknown>
   4:     0x7ff6180ead59 - <unknown>
   5:     0x7ff6180ea9db - <unknown>
   6:     0x7ff6180eb5f1 - <unknown>
   7:     0x7ff6180eb37e - <unknown>
   8:     0x7ff6180e90ff - <unknown>
   9:     0x7ff6180eb030 - <unknown>
  10:     0x7ff61811f915 - <unknown>
  11:     0x7ff61811fe16 - <unknown>
  12:     0x7ff617ddf705 - <unknown>
  13:     0x7ff617db95d0 - <unknown>
  14:     0x7ff617dc3b96 - <unknown>
  15:     0x7ff617dd6f54 - <unknown>
  16:     0x7ff617ddbaa9 - <unknown>
  17:     0x7ff617dce546 - <unknown>
  18:     0x7ff617daafcc - <unknown>
  19:     0x7ff6180db1fe - <unknown>
  20:     0x7ff617ddbd4c - <unknown>
  21:     0x7ff618112f60 - <unknown>
  22:     0x7ffe3f23117e - BaseThreadInitThunk
  23:     0x7ffe40ba42db - RtlUserThreadStart

Additional cli commands pin/search/find

It may be useful to add pin + find/search functionality

• https://docs.chocolatey.org/en-us/choco/commands/pin
• https://docs.chocolatey.org/en-us/choco/commands/find

add new flags to sub-command outdated

as discussed on slack, please implement -ip, --ignore-pinned and -iu, --ignore-unfound flags to roco outdated to allow unfound packages to be ignored.

currently supported:

choco outdated --ignore-pinned --ignore-unfound

feature request:

roco outdated --ignore-unfound --ignore-pinned

roco outdated -ip -iu #shorthand

roco outdated -ipu|-iup #combined shorthand

roco outdated semver check inconsistency

when two packages with the same id have the same version, but one is built with more digits (i.e. 1.0.0 vs 1.0), rocolatey will happily tell you the version with more digits is greater.

Make --ignore-pinned default

Or make a way to configure it as the default.

Personally I always run roco outdated --ignore-pinned so would be nice to not have to type the extra bits 😄

Rocolatey should check feeds in parallel

currently feeds are processed sequentially, it should be possible to get a notable performance improvement when doing odata/nugetv3 queries in parallel,- if there are multiple feeds configured.

'roco bad' does not list packages in lib-bad

local repository layout was changed in choco2+; - need to adapt to new layout.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update Rust crate clap to v4.4.14

Detected dependencies

cargo

rocolatey-cli/Cargo.toml

• tokio 1.35.1
• clap 4.1.1
• clap 4.1.1
• clap_complete 4.4.6

rocolatey-lib/Cargo.toml

• quick-xml 0.31.0
• glob 0.3.1
• futures 0.3.30
• reqwest 0.11.23
• semver 1.0.21
• regex 1.10.2
• walkdir 2.4.0
• http-auth-basic 0.3.3
• tokio 1.35.1
• serde_json 1.0.111
• serde_with 3.4.0
• serde 1.0.195

rocolatey-server/Cargo.toml

• tokio 1.35.1
• clap 3.2.25
• warp 0.3.6

github-actions

.github/workflows/Rust-Build-Pipeline.yml

• actions/checkout v4
• actions/checkout v4
• actions-rs/toolchain v1
• actions-rs/cargo v1.0.3
• actions/checkout v4
• actions-rs/toolchain v1
• actions-rs/cargo v1
• actions/upload-artifact v4

---

• Check this box to trigger a request for Renovate to run again on this repository

Malware Detection - Backdoor Bladabindi?

https://blog.malwarebytes.com/detections/backdoor-bladabindi/

I'm sure this is explainable, hopefully false positive?... but I am doing my due diligence by bringing this up.... ?

Malwarebytes Detection upon file system scan.

To be clear, this was on
C:\ProgramData\chocolatey\bin\roco.exe which I believe is the shim?
https://www.virustotal.com/gui/file/8f7460994cb21788c1892b2a2951192dd18a247c7a1bb9fd413cdc9f5d2cbd45

Although on the main executable there was also a detection with a score of 100...
C:\ProgramData\chocolatey\lib\rocolatey\tools\roco.exe
https://www.virustotal.com/gui/file/70d23e81d84c3a6c8a20df51707af4618cd42187d49c6db2d0f539b204ccf0f4

Skimming the source, I don't see anything in the source that looks bad. My guess is that it's due to references here to system cryptography.

https://github.com/mwallner/rocolatey/blob/49b22e4536c9a5fe908513b62c04946fdc2ab760/rocolatey-lib/src/roco/mod.rs#L306-L309

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Location: renovate.json
Error type: Invalid JSON (parsing failed)
Message: Syntax error near ", ],

roco outdated also checks disabled sources

roco outdated currently does not validate if a source configured in chocolatey.config is disabled or not - it will always be used.

roco outdated misses updates when dealing with prerelease packages

when a local packages already is installed in a prerelease version (i.e. 1.0.2-beta), roco doesn't recognize the upstream version (i.e. 1.0.2) is newer, if only the prerlease-tag is differnt/missing.

roco cannot use Proxy configured in chocolatey.config

the password that's used for proxy authentication needs to be decrypted prior usage.

see GH-17, will be fixed with GH-17