Package Management in 2026 with Gary Ewan Park - .NET Rocks! Recap

Podcast: .NET Rocks!

Published: 2025-12-11

Duration: 1 hr 1 min

Guests: Gary Ewan Park

Summary

Gary Ewan Park discusses the evolution and future of package management on Windows platforms, focusing on Chocolaty's role and new developments in the field.

What Happened

Gary Ewan Park joined .NET Rocks! to discuss the landscape of package management. He explained how Chocolaty, a Windows package manager, originated from the need to automate software installations similar to how NuGet handles library dependencies. Gary shared that Chocolaty has grown to support various applications and is commonly used to automate VM setups in the cloud. New versions of Chocolaty's core products were recently released, including Chocolaty CLI and Chocolaty GUI, which provide a graphical interface for managing packages. The episode delved into the challenges of maintaining older operating systems, such as Windows Server 2012, which Chocolaty still supports due to customer demand. Gary highlighted the importance of administrator rights in Chocolaty's operations, noting that most packages require elevated permissions for installation. He also mentioned the use of AutoHotKey for automating GUI-only installers, although this approach can be brittle. The conversation touched on the risks of supply chain attacks, emphasizing the need for careful vetting of packages, especially those from the Chocolaty Community Repository. Gary noted the increasing complexity of CI/CD pipelines and the importance of maintaining backward compatibility in Chocolaty's offerings. Despite the challenges, the demand for Chocolaty's solutions continues to grow, with more people and organizations adopting it for their package management needs.

Key Insights

• Chocolaty originated from the need to automate software installations on Windows, similar to NuGet's handling of library dependencies. It has since expanded to support various applications and is widely used for automating virtual machine setups in the cloud.
• Chocolaty's recent updates include new versions of its core products, Chocolaty CLI and Chocolaty GUI, which offer a graphical interface for package management. These tools enhance user experience by simplifying the process of managing software packages.
• Despite the challenges of maintaining older operating systems like Windows Server 2012, Chocolaty continues to support them due to customer demand. This support requires careful consideration of backward compatibility and security risks.
• Supply chain attacks pose significant risks in package management, making it crucial to vet packages, especially those from the Chocolaty Community Repository. The complexity of CI/CD pipelines further necessitates stringent security measures and backward compatibility.