1

I am attempting to install Conemu using Chocolatey. It appears that the Canonical package references SourceForge, a know malware/spyware source:

$package = 'ConEmu'
$version = '15.06.29'
$stage   = 'Preview'
$isSytem32Bit = (($Env:PROCESSOR_ARCHITECTURE -eq 'x86') -and `
  ($Env:PROCESSOR_ARCHITEW6432 -eq $null))
$os = if ($isSytem32Bit) { "x86" } else { "x64" }
$url = "https://downloads.sf.net/project/conemu/$stage/ConEmuSetup.$($version.replace('.','')).exe?use_mirror=autoselect"

# MSI installer, but packed inside wrapper to select x86 or x64
# version. Therefore, treat it as EXE type.
$params = @{
  PackageName = $package;
  FileType = 'exe';
  SilentArgs = "/p:$os /passive";
  Url = $url;
  Url64bit = $url;
}
Install-ChocolateyPackage @params

# Done

As a result, attempts to install Conemu fails in a corporate environment (sf.net is blocked by the firewall).

I've attempted to specify the latest GitHub package, but have been unsuccessful:

PS> choco install conemu -s "https://github.com/Maximus5/ConEmu/releases/download/v15.06.29/ConEmuSetup.150629.exe" --version=15.06.29

Chocolatey v0.9.9.8 Installing the following packages: conemu By installing you accept licenses for the packages. conemu not installed. The package was not found with the source(s) listed. If you specified a particular version and are receiving this message, it is possible that the package name exists but the version does not. Version: "15.06.29" Source(s): "https://github.com/Maximus5/ConEmu/releases/download/v15.06.29/ConEmuSetup.150629.exe"

Chocolatey installed 0/1 package(s). 1 package(s) failed. See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log). Failures: - conemu

What am I missing?

7
  • BTW, what's a crazy corporate decision to ban whole site in case of a few pages had adware? There is no guarantee at all that other sites, github for example, have no adware in users' binaries!
    – Maximus
    Jul 1, 2015 at 15:30
  • Seems like a reasonable policy to me. I spent an hour trying to remove adware from one of my relative's macs. Now imaging the time it would take to do that if 1000s of workstations are infected. While the Github repo may have included that in the project, Github itself doesn't do that.
    – Craig
    Jul 1, 2015 at 16:52
  • 1
    In a corporate environment, I would expect folks not to be using/depending on the community feed and instead creating their own packages, hosting the underlying native installer binaries (or embedding them in the pkgs), and hosting their own internal choco server. Trusting the internet is kind of a scary proposition, especially for production purposes. But I am not sure what the OPs use is. Jul 2, 2015 at 3:39
  • I'm guessing based on installing ConEmu is that it is more end user (developer) driven and you are just running into corporate policy? Jul 2, 2015 at 3:43
  • @Maximus apparently sourceforge malware in one case at least, is so pervasive even a techie can shoot himself. blog.tedd.no/2014/11/25/sourceforge-malware
    – barlop
    Jul 2, 2015 at 9:45

1 Answer 1

2

By "package source" Chocolatey means the location of the *.nupkg file. But it is stored in the chocolatey.org site and nowhere else. The package itself does not provide an option to change the location of the distribution itself.

Manual download/installation is the only solution.

Update

Since build 15.07.01 the download location for choco moved to GitHub.

3
  • Could I create a local package, with the desired source, and reference it instead? Are you planning to update the .NUPKG file to reference the Github package?
    – Craig
    Jul 1, 2015 at 14:47
  • 1
    One can download and edit the nupkg and even host it on your internal nuget/chocolatey server. Nothing prevents you from doing this - choco can install from local file/folder/unc sources to nuget odata compatible web feeds. Creating a custom one is quite easy these days Jul 2, 2015 at 3:44
  • Changing the package's location to Github solved the problem.
    – Craig
    Jul 2, 2015 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .