Document other types of packaging or distribution of espanso

[AucaCoyan]

With the issue of espanso/espanso#2464 I realized that espanso is automatically added to winget packages, via this bot:

• here is the automated PR to winget
• is run by this bot, whose source config for espanso is here

It grabs the *.msi installer and adds it to winget repository

On the other hand, I know that terrapkgs also have both X11 and wayland versions of the package.

Because we don't maintain these sources officially, I would suggest creating a "community" section, in which we add all these places that we know about.

What do you think?

[Neoniq]

Wait its means if i am updating my packages through winget, i may just get some random dudes fork or malware under what seems official name?

[smeech]

They should be OK if they're downloading the project's official package. winget pulls https://github.com/espanso/espanso/releases/download/v2.2.5/Espanso-Win-Installer-x86_64.exe

The winget method could be added to the documentation, perhaps. I don't know how terrapkg works.

creating a "community" section

What do you mean, @AucaCoyan? Would it not be simpler to include the winget instructions in https://espanso.org/docs/install/win ?

[smeech]

There's also chocolatey espanso/espanso#2464 (comment): https://community.chocolatey.org/packages?q=espanso (I presume the 8,778 downloads includes previous versions), and

scoop espanso/espanso#2142 (comment): https://scoop.sh/#/apps?q=espanso.

[AucaCoyan]

Would it not be simpler to include the winget instructions in windows install docs?

Yeah, now that you say it, it's simpler 😆 . I tripped myself.

The idea of community maintained packages had the goal to declare clearly a better limit about which platforms and packaging strategies we include as "official". Take the ghostty sample: you have the compiled binary created by the ghostty team, and then you have an abstraction layer that the community maintains to fulfill the packaging needs of every distro (debian, fedora, nix, etc etc etc). I think this marks a clear limit on what should be reported as a bug and what is a responsibility of another person.

We don't need to have separate sections for this, just with a (community) appended at the end it shows that we (espanso org) suggest this package method, but we aren't responsible for any damage or misuse created.

Do you think this leads to a better situation than we have today? would you change or improve something?

My end goal is that all the package options appear in our site, while maintaining clear what is endorsed by this org, and what is a fan-made content, if it makes sense

[AucaCoyan]

@Neoniq

Wait its means if i am updating my packages through winget, i may just get some random dudes fork or malware under what seems official name?

Well, that danger certainly exists, but it's unlikely that an issue like that in an accepted bot under the github.com/microsoft/winget repo can get very far without a close fixup.
If you want to be on the secure side, I can recommend downloading the installer.exe from the espanso releases gh page. Again, even that can be hacked so, for me the script to submit the latest release of espanso to winget it's enough. Ask anything you want to!

[smeech]

We need to decide which repositories we publicise. I've used winget and chocolatey for other software in the past, but hadn't heard of scoop.

Helpful opinion piece here.

[AucaCoyan]

Oh, I would put them all! they are very similar products, but with different implementations, just like AppImage, Snaps and Flatpaks.
My preference stays with scoop, but that because I use mostly apps that the scoop library provides. This can be a different story for another user