Cease and desist

[MeikTranel]

The Dumpling bot, operating under SpecterShell's development, is causing an unacceptable level of disruption with its automated maintenance activity. Please address the following urgent problems:

Problem

Dumpling is flooding the public winget-pkgs package databaes with an excessive number of pull requests, reducing repo usability for real contributors and maintainers. Just Dumplings spectopo bot account alone accounts for more than 52.000 out of all 316.000 PRs on the repo

If this was a sophisticated algorithm taking winget-pkgs db into the worlds forgotten software archive based on solid and sensible workflow i would have had no problem with this. But it's not.

Most of what this bot is adding to the packages repo is unmitigated trash.

Countless of manifests induced by the bot segregate different locale installers into completely separate apps even though the winget-pkg manifest is specifically designed to support multiple installer URLs based on locale, architecture and so on. Furthermore version manifests (which contain release notes and so forth) for different languages are seemingly created at random with some locales having no sensibly locale'd manifests whatsoever - even though other releases of the same version have the correct manifest.

And you do all this while https://github.com/microsoft/winget-pkgs/ maintainers are profusely apologizing for a validation infrastructure that is trembling beneath all the traffic

Bonus Meme: Have you ever thought about asking any of the involved parties if they even wanted a release - at any stage - did that come that mind? Imma answer this myself - you definitely didn't ask @JetBrains before effing up their product deployment and generating support effort for them

Acceptance Criteria

I would have had no issues simply telling you to fix your stuff - even helping. But imho this repo looks like it was created with heavy use of AI and the author is simply farming clout by spamming the repo with yamls tagged with their app name.
Furthermore do i see no remorse after months of absolutely spamming the winget-pkgs index with trash. If you had just once looked at the results of your actions with a shred of professionalism you would have seen that all this is an absolute net negative.

That is why i cannot support any other course than requesting you to immediately cease all operations and closing your PRs.

I call on @denelon to revoke all of user @spectopo open PRs and also do a little cleanup on all those messed up Mozilla packages.

I will furthermore forward this document to Mozilla abuse mails since one doesn't have to be very clever to know that completely bungling up their software release while acting as defacto redistributor is in violation of their license agreements.

Do better.

[SpecterShell]

The Mozilla issue has already been explained here. TL;DR: Consolidating all locale installers into one package is technically doable but practically impossible, because:

1. It would trigger the random "Internal-Error-Dynamic-Scan" and "it is being used by another process.." errors in the validation pipeline.
2. A single error from one locale installer would make the whole validation failed, and even make the whole validation pipeline down by rerunning the validation on all the installers (100 locales x 3 architectures) again and again. While splitting into multiple packages does not fix this issue, only the failed locales need re-validation, reducing the validation pipeline resource usage.
3. Manually validating one PR with 300+ installers is a big deal.

You can find the old automation script here, which was used when all the locales were in one package.

The codes in this repo are mostly handwritten by myself (except some next edit suggestions from GitHub Copilot), as AI can not predict how to download or update each app, given their diverse methods of downloading or self-updating. I would hope AI one day could replace my job of maintaining 3000+ packages.

Currently, winget-pkgs, the community repo of WinGet, relies heavily on the community efforts in maintaining the packages and keeping them up-to-date. By "community-driven", there lacks a way to communicate with the publishers on how to deliver/redistribute the packages more efficiently, and fix the installation issues from the publisher side instead of just applying workarounds on the WinGet side. If any publisher has interest in redistributing packages in WinGet, we the community will be willing to help.

[denelon]

We're actively working on an improved queueing system that we're hoping will get us back to the point where a single manifest can contain all the locales, architectures, etc...

From a community standpoint the unit of submission is a "manifest" which is a single version of a single package. Unfortunately, when the publisher provides unique binaries for each locale, our processes don't scale well as noted above. The intent we have is to be "smarter" about which installers (and the cartesian of unique properties) need to be evaluated in a given run. That way when we get a manifest that represents 10s if not more than 100 unique installer validation instances to run, one failing does not require us to completely re-evaluate the entire set.

The PR still would not be able to be merged until all contained installer instances pass, but we could be smarter and when we need to re-run the process, only the failed instances would need full validation. The validations will be able to run in parallel, but they will take up copious compute resources, so we're also looking at some other scheduling optimizations.

The current ETA for the work we have in progress is late February. We would not suggest consolidating the different locales back into a single manifest immediately though. We will work with individual community members and the Microsoft MVPs involved in helping us to maintain the community repository to test this out in a pre-production environment to ensure that it works as expected.

[denelon]

As an aside:

The best-case scenario from our point of view regarding package submission is that the publisher automates releases themselves.

That minimizes the time from a product's release to its availability in the community repository. We certainly understand the additional work required to build and maintain the system for the publisher, and we've built tooling like wingetcreate to help with CI/CD (Continuous Integration / Continuous Delivery) scenarios.

Until that is the normal behavior of software publishers, the community is attempting to keep packages up to date for all to use. There are several different individuals who have built some form of automation to help keep a set of packages up to date. I'm sure they would be happy to reduce the set of packages they are maintaining as publishers automate their own submissions. There are a great set of folks over at https://github.com/microsoft/winget-pkgs who would also be willing to offer assistance in the form of PRs to help automate projects from GitHub as well as offer guidance on other mechanisms for automating submissions. I also try to keep up on any @ mentions so I can offer direct assistance myself.

[DandelionSprout]

I can't speak on behalf of anyone but myself, but I'm pretty sure that the term "Cease and desist" does not mean what you (MeikTranel) think it means.