(Easier) Ways to Verify the Trustworthiness of Package Sources in UniGetUI?

[Th-o-mas]

When I install a program for the first time using the UniGetUI interface, I ask myself the following questions:

• Is the package source trustworthy?
• Does the provider of the package source match the provider of the software I want to install?

I almost always have the option to install the software from the provider’s website or via UniGetUI. I use the “Package Details” option for this. Here’s a german example for LibreOffice via winget. I’m using UniGetUI 2026.2.7 and Windows 10 with extended support.

To verify that the source and provider are trustworthy, I usually check the following:

• Package ID (TheDocumentFoundation.LibreOffice)
• Installation URL
• Installation SHA256:
• Publisher

To perform this check, I have to visit the provider’s website. I have three questions

1) How do you verify the source and provider before the first installation?

2) What do you think of the idea of introducing something like a “verified provider” (in UniGetUI)?
Verification would confirm that the package ID and publisher/author are official. Example: With verification, I would know that all packages from “The Document Foundation” are official and wouldn’t need to perform a check when installing additional packages from that publisher.

3) What would be the appropriate level at which to perform the verification? UniGetUI, or better yet, the underlying package managers such as winget, pip, Scoop, etc.?

Translated with DeepL.com

[Gabriel Dufresne (GabrielDuf)]

hi Th-o-mas,
Thanks for the detailed write-up. There are a few different things to consider here.

1) How do you verify the source/provider?

UniGetUI does not perform its own trust verification; it relies on the underlying package manager.

For winget, the package ID and publisher fields don't cryptographically prove ownership. Useful checks are the installer URL/host, the Manifest link in Package Details, and, when available, the installer's digital signature.

Also, winget already verifies the installer's SHA256 against the manifest during installation. Comparing it with a hash published by the vendor can additionally confirm that the manifest points to the same file.

UniGetUI 2026.2.7 can also help with some of this:

• Settings → Interface can show the installer host in package lists.
• Settings → Updates can warn when an update moves to a completely different installer domain.

2) A "verified provider" in UniGetUI?

I don't think UniGetUI should maintain its own database of verified providers. It would effectively become a trust database that we'd need to keep accurate indefinitely, and an incorrect or outdated badge could create a false sense of security.

3) Where should verification happen?

I think the actual verification should happen as close to the package source as possible — ideally by winget, PyPI, Scoop, etc. UniGetUI can then display that information in a consistent way.

The problem is that not every package manager currently provides this kind of verification. For example, winget doesn't have a per-publisher "verified" status that UniGetUI could use for the LibreOffice package.

So I see UniGetUI's role more as showing the available trust information and warning about suspicious changes, rather than being the authority that decides whether a publisher is trustworthy.

And even with a verified publisher, that would confirm the publisher's identity, not guarantee that the software itself is safe.

[Gabriel Dufresne (GabrielDuf)]

That said, this isn't a definitive answer on how UniGetUI should handle this. I'm open to other approaches, so if you have ideas on how you'd expect such a feature to work in practice, I'd be interested to hear them.