DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:cc:subject:date:message-id:references
	:in-reply-to:content-type:content-transfer-encoding
	:mime-version; q=dns; s=default; b=iTjHS+1YxiVykBOu4WP08h0FmCDmK
	JMW9SE3FG5ss5sbve/VjQFDozfHXRZLcl51ahCr2oHC066ql2gVk6XMa1+Lz9qfv
	Yb1HDiJtbxSkphfT0gwqX6wKhKx5Kt1WcIsJmOJagWY4nOBkhRqalYbOmTKM4T4Q
	OPpcsEJShsGY/4=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
From: David Allsopp <David DOT Allsopp AT cl DOT cam DOT ac DOT uk>
To: Ben <bxstover AT yahoo DOT co DOT uk>
CC: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject: RE: Searching full, portable Cygwin package for windows and NOT just the installer
Date: Sat, 3 Feb 2018 08:15:50 +0000
Message-ID: <E51C5B015DBD1348A1D85763337FB6D90189A66BD3@Remus.metastack.local>
References: <38d7c1fc-4093-fad0-d7bd-03e6f869e09e AT yahoo DOT co DOT uk>
In-Reply-To: <38d7c1fc-4093-fad0-d7bd-03e6f869e09e@yahoo.co.uk>
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Ben via cygwin wrote:
> When I go to web page
> 
> http://cygwin.com/
> 
> then I can download CygWin from there (currently the file "setup-
> x86_64.exe").
> 
> Unfortunately this file is just an installer which retrieves in turn
> several other files from Internet and remote servers.
> 
> Since I have no overview what is downloaded from which server I distrust
> such installers in general.

I assume that each month you review the Microsoft Security Advisories, visit and digest the page for each individual update and then download and apply the .msu patches by hand, rather than trusting the highly fishy "Check for updates" feature of Windows Update?

You do have an overview: you get to pick the mirror, and the URL it will download files from is declared there. For example, my closest mirror is http://mirrorservice.org/sites/sourceware.org/pub/cygwin/ which you can browse online.

> I prefer full packages which contains everything needed and can be
> inspected in advance (e.g. by virus scanners) before actual installation.

The Cygwin installer downloads and saves the files - even a dumb filesystem-only virus scanner gets a chance to inspect the files. 

> 99,9% of all software is offered in such a way.

That number is plucked out of your mind, and simply isn't true, even on Windows (there's the Microsoft Store and even third party packagers such as https://chocolatey.org/). Microsoft's own products on Windows are now distributed this way too (e.g. the Visual Studio Installer and the Office 365 installer).

> Why use Cygwin such a fishy distribution way?

Well, it's not fishy.

Cygwin is not an application, as another answer to your previous question pointed out, Cygwin is a library providing a Posix layer for applications on Windows. The setup program is an application for installing that library and then adding packages of programs which use it from a curated collection, but you can point the installer to your own collection if you wish.

> Is there really no full package to download?

The setup program includes a "Download" option which allows you to save the entire package repository locally, which you can use in future. Some of the mirrors (including the one I referenced above) also support rsync, which allows you to download the package repository and the installer from the website without running any Cygwin software initially.

Packages are updated quite frequently, and the entire repository is 10s of gigabytes - it would be impractical to offer a single file for download being updated so frequently.


David 


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple