Are downloaded packages safe?

[katastrophe92]

Hi. First thanks for this noice app. Where does the apps come from, the original site or all apps are uploaded by somebody else. Sorry I'm a noob and do not want to get a corrupted app. Thanks!

[marticliment]

Hi @katastrophe92,

I understand your preocupation.
Unless you are using custom buckets on scoop (which if you don't know what i'm talking about, you are not using them), each package has been analized and properly checked by moderators. (Each time I want to upload a new version of an app I must wait for automated checks to pass (virus and general tests) and also for some moderator to manually approve my package).
So, in theory, you must be safe.
Regarding who uploads packages, it depends, but it can be either the developer or any third-party.

In general terms, you should be safe here, since it would be very strange for an infected package to be able to elude the virustotal security tests. However, if you are still concerned, you can always check where the download url points at, so you can see from where the package is gettintg downloaded:

Hope this helps!

[katastrophe92]

Hello @martinet101, thanks for your reply. Now i almost get it :-). Are the winget packages the same?

[marticliment]

yes, both winget and scoop packages are reviewed before being pushed to repositories

[katastrophe92]

@martinet101 sweet. Thanks for the helpful information. Yall have nice holidays 😃

[marticliment]

It seems that those inappropiate posts got deleted automatically. If I ever catch one, i'll make sure to ban and report them.
Sorry for the inconveniences.