[Bug]: PowerShell PackageScript puts the installer inside the .intunewin file

[wertzui]

CommandLet

New-WtWingetPackage

Full command

New-WtWingetPackage -PackageId JGraph.Draw -PackageFolder D:\Intune\Packages -PackageScript

Module version

1.0.6

What happened?

Although the -PackageScript switch is present, the downloaded installer files (.msi) will be packaged into the .intunewin file making it ~130MiB big in the case of this example (draw.io).

When the switch is present, only the .ps1 files and maybe the readme file should end up in the .intunewin package.

Command output

INFO: Packaging package JGraph.Draw 27.0.5
INFO: [WingetManager] Getting package info for JGraph.Draw 27.0.5 from github
INFO: [ComputeBestInstallerForPackageCommand] Computing best installer for JGraph.Draw 27.0.5 Unknown
INFO: [IntuneManager] Generating IntuneWin package for JGraph.Draw 27.0.5 X64 System in D:\Intune\Packages
INFO: [Packager] Creating Intune package from C:\Users\xxx\AppData\Local\Temp\wintuner\JGraph.Draw\27.0.5
INFO: [Packager] Creating package for C:\Users\xxx\AppData\Local\Temp\wintuner\JGraph.Draw\27.0.5\install.ps1 in C:\Users\xxx\AppData\Local\Temp\wintuner\JGraph.Draw\27.0.5 to D:\Intune\Packages\JGraph.Draw\27.0.5
INFO: [Packager] Compressing the source folder C:\Users\xxx\AppData\Local\Temp\wintuner\JGraph.Draw\27.0.5 to C:\Users\xxx\AppData\Local\Temp\cf221807-bab6-467f-8635-7b122ed863ae\IntuneWinPackage\Contents\IntunePackage.intunewin
INFO: [Packager] Generating application info
INFO: [Packager] Encrypting file C:\Users\xxx\AppData\Local\Temp\cf221807-bab6-467f-8635-7b122ed863ae\IntuneWinPackage\Contents\IntunePackage.intunewin
INFO: [Packager] Generated detection XML file C:\Users\xxx\AppData\Local\Temp\cf221807-bab6-467f-8635-7b122ed863ae\IntuneWinPackage\Metadata\Detection.xml
INFO: [Packager] Done creating package for C:\Users\xxx\AppData\Local\Temp\wintuner\JGraph.Draw\27.0.5\install.ps1 in C:\Users\xxx\AppData\Local\Temp\wintuner\JGraph.Draw\27.0.5 to D:\Intune\Packages\JGraph.Draw\27.0.5
INFO: [IntuneManager] Downloading logo from https://api.winstall.app/icons/JGraph.Draw.png
INFO: [DefaultFileManager] Skipping download of https://api.winstall.app/icons/JGraph.Draw.png to D:\Intune\Packages\JGraph.Draw\logo.png because the file already exists
INFO: [IntuneManager] Writing detection info with msi details JGraph.Draw {4912FB94-D17F-4426-8ECB-29256887E8AD}
INFO: [IntuneManager] Writing package readme for package JGraph.Draw

PackageId          : JGraph.Draw
Version            : 27.0.5
PackageFolder      : D:\Intune\Packages\JGraph.Draw\27.0.5
PackageFile        : install.intunewin
InstallerFile      : install.ps1
InstallerArguments : tive\windowspowershell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File
                     install.ps1

PowerShell version

7.5.0

Code of Conduct

• I agree to follow this project's Code of Conduct
• I won't demand an immediate answer

[svrooij]

This parameter came to be, because some apps refuse to install through known silent switches. And some apps in winget are just not supported through WinTuner (like zip type installers or PWAs). This issue does not exist with msi files.

The -PackageScript switch is, in my opinion, a last resort option.

Not packaging the actual installer, means all your computers are going to hammer the external CDN to download the installer. Which, again in my opinion, is bad practice. If you package the installer you it will only use the Microsoft CDN (where you are indirectly paying for through licenses), and that also means you can use Intune content optimization.

[wertzui]

My end goal is to always install the latest version no matter which version existed at the time the Intune package was generated. If I where to always use the installer for the version that was available at the time the package was generated, I would spend way to much time every week just making sure the version in Intune is updated to the latest one in case someone installs it from there. I use Winget Auto Updater to then make sure that all version of all applications stay up to date once installed through Intune/Winget. Therefor it would just be a waste of bandwith and time to first install an old version from Intune just for Winget Auto Update to update it on the next user login.

[RonBartsch]

I would also like to have the option to just install the latest version available in WinGet repository.
Especially for supporting apps, they should always just install the latest version from WinGet.

Now I add these apps with these steps:

1. Create and deploy package with WinTuner and the PackageScript parameter in to Intune.
2. Change the install script by removing the version from the install command line.
3. Change the detection script by removing the check for what version is installed.
4. Remove the existing MSI and intunewin files.
5. Create new intunewin file
6. Upload the new intunewin file into the newly created App.

Would be nice if there was an option to do this automatically, because WinTuner is really great how it creates the packages etc.

[svrooij]

I know how it works, I just think it is a terrible practice. No one is actually responding to the fact that this is stressing the vendor's third party CDN.

I don't need convincing on the technical part, need convincing on the part where if I would be the vendor I would really hate what this is proposing.
Installing apps at enterprise scale is not what Winget is built for.

[RonBartsch]

I agree that Winget is not the right tool for Enterprise environments, but for small business it is often a good solution.
Enterprise companies will probably buy a third party tool for packaging and distribution.

Never thought about it what the impact is for the vendors, and I'm not sure what they think about it and what the impact is for them.
But is this not a general Winget problem? Because now it is possible and people will and are using it.

To solve this you would need to limit the possibilities of Winget, like limiting the number of times a Winget package can be downloaded from 1 IP per day or other solutions that are available.

But the current situation as I see it is:

• There are several blogs how to distribute Winget packages with Intune, by downloading it directly from Winget,
  People are already using it and I think the vendors should already see the impact of it.
• A lot of vendors have a self update built in to their application. (Which we can't use because the users do not have admin rights).
  This self update is also relying on their own CDN.
• There are several vendors that show us how often their software was downloaded, to show us how good their software is.
  I think they prefer to have a higher number of downloads.