1

I am attempting to install Conemu using Chocolatey. It appears that the Canonical package references SourceForge, a know malware/spyware source:

$package = 'ConEmu'
$version = '15.06.29'
$stage   = 'Preview'
$isSytem32Bit = (($Env:PROCESSOR_ARCHITECTURE -eq 'x86') -and `
  ($Env:PROCESSOR_ARCHITEW6432 -eq $null))
$os = if ($isSytem32Bit) { "x86" } else { "x64" }
$url = "https://downloads.sf.net/project/conemu/$stage/ConEmuSetup.$($version.replace('.','')).exe?use_mirror=autoselect"

# MSI installer, but packed inside wrapper to select x86 or x64
# version. Therefore, treat it as EXE type.
$params = @{
  PackageName = $package;
  FileType = 'exe';
  SilentArgs = "/p:$os /passive";
  Url = $url;
  Url64bit = $url;
}
Install-ChocolateyPackage @params

# Done

As a result, attempts to install Conemu fails in a corporate environment (sf.net is blocked by the firewall).

I've attempted to specify the latest GitHub package, but have been unsuccessful:

PS> choco install conemu -s "https://github.com/Maximus5/ConEmu/releases/download/v15.06.29/ConEmuSetup.150629.exe" --version=15.06.29

Chocolatey v0.9.9.8 Installing the following packages: conemu By installing you accept licenses for the packages. conemu not installed. The package was not found with the source(s) listed. If you specified a particular version and are receiving this message, it is possible that the package name exists but the version does not. Version: "15.06.29" Source(s): "https://github.com/Maximus5/ConEmu/releases/download/v15.06.29/ConEmuSetup.150629.exe"

Chocolatey installed 0/1 package(s). 1 package(s) failed. See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log). Failures: - conemu

What am I missing?

  • BTW, what's a crazy corporate decision to ban whole site in case of a few pages had adware? There is no guarantee at all that other sites, github for example, have no adware in users' binaries! – Maximus Jul 1 '15 at 15:30
  • Seems like a reasonable policy to me. I spent an hour trying to remove adware from one of my relative's macs. Now imaging the time it would take to do that if 1000s of workstations are infected. While the Github repo may have included that in the project, Github itself doesn't do that. – Craig Jul 1 '15 at 16:52
  • In a corporate environment, I would expect folks not to be using/depending on the community feed and instead creating their own packages, hosting the underlying native installer binaries (or embedding them in the pkgs), and hosting their own internal choco server. Trusting the internet is kind of a scary proposition, especially for production purposes. But I am not sure what the OPs use is. – ferventcoder Jul 2 '15 at 3:39
  • I'm guessing based on installing ConEmu is that it is more end user (developer) driven and you are just running into corporate policy? – ferventcoder Jul 2 '15 at 3:43
  • @Maximus apparently sourceforge malware in one case at least, is so pervasive even a techie can shoot himself. blog.tedd.no/2014/11/25/sourceforge-malware – barlop Jul 2 '15 at 9:45
2

By "package source" Chocolatey means the location of the *.nupkg file. But it is stored in the chocolatey.org site and nowhere else. The package itself does not provide an option to change the location of the distribution itself.

Manual download/installation is the only solution.

Update

Since build 15.07.01 the download location for choco moved to GitHub.

  • Could I create a local package, with the desired source, and reference it instead? Are you planning to update the .NUPKG file to reference the Github package? – Craig Jul 1 '15 at 14:47
  • 1
    One can download and edit the nupkg and even host it on your internal nuget/chocolatey server. Nothing prevents you from doing this - choco can install from local file/folder/unc sources to nuget odata compatible web feeds. Creating a custom one is quite easy these days – ferventcoder Jul 2 '15 at 3:44
  • Changing the package's location to Github solved the problem. – Craig Jul 2 '15 at 13:42

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.