Trevor: [00:00:00] Four years ago was a different time. Six months ago was a different time. It’s time for Arrested DevOps, the podcast that helps you achieve understanding, develop good practices, and operate your team and organization for maximum DevOps awesomeness. I’m your co-host Trevor Hess, @TrevorGHess on Twitter. Arrested DevOps is brought to you by Tenth Magnitude, a cloud services company that figures if you’re listening to this podcast, you must be pretty. Pretty cool. You can find out about joining their cloud services team at arresteddevops.com/10thmagnitude. This episode is also brought to you by Datadog, a monitoring tool that helps bridge the gap between operations and dev teams. Datadog brings together system metrics, changes, alerts, and events from over 70 common infrastructure tools such as Chef, Docker, and AWS so that dev and ops teams share their key data and alerts in a single place and collaborate on issues in real time. Datadog is for a 14-day trial at arresteddevops.com/datadog. So I said a few things about Chocolaty on our episode about switching teams that caught the attention of Rob Reynolds, one of the creators, or the creator, of Chocolaty. So Rob, tell us a little bit about yourself, and please accept my sincerest apologies for spreading misinformation.
Rob: [00:01:27] Oh, no worries, no worries. Like you said, I’m Rob. I live in Topeka, Kansas. I’m a senior software engineer on the Windows team at Puppet Labs, where we make Windows more awesome. Like you said, I also have created Chocolatey. And I created Chocolatey, I want to say about a little over 4 and a half years ago. It was at a time when I didn’t find anything that really was out there that could meet my needs, which were not the same as they are today, but definitely needed something that could bring tools and applications to my system very quickly. And when I sat down with other people to pair. I wanted something that, oh, you don’t have Notepad++, can I do something really quickly instead of the nice long yak shave that we were typically used to.
Trevor: Oh, you gotta love the nice long yak shave. Happens all too often, as I think everyone is well aware who listens to this show, as was I. As we start talking about what Chocolaty is, I think that’s a great place to start where, you know, you start talking about what were your needs 4 years ago? Did you need Chocolatey, and what problem did Chocolatey solve?
Rob: [00:02:40] 4 years ago, man, that was a different time. Uh, 4 years ago—
Trevor: 4 years ago was a different time. 6 months ago was a different time.
Rob: 2 weeks ago. 4 years ago, I was looking for something that would go out and silently install everything on my machine, and I had experience with silent installers, and I was taking this knowledge and going from one company, and then I went to another company and I was doing the same thing over. And I’m like, you know, I’d like to take this concept and probably try to make it like a little bit more global. And so that I don’t have to keep going back and like restarting the wheel. Plus when I’m not inside of the, you know, the company firewall where all of this software is at, I could still install things. And so making that concept available over the internet. That was really the start. And of course, at that time I was on the NuGet team and we had made a decision not to approach machine package management. And I thought that was an interesting decision. We had a joke going that if we ever made a machine package manager, we’d call it Chocolatey NuGet because it wasn’t vanilla NuGet packages.
Trevor: [00:03:55] And so a name was born.
Rob: And so the name was born and it stuck.
Trevor: The best, the best things come out of like an offhand joke. I mean, the tagline of the podcast was an offhand remark I made when Nathan Harvey said on a call that Matt and I had way early on, the tagline of the podcast is going to be something that somebody just says offhand. Then I said, there’s always DevOps in the banana stand, and it was that ever since. So I know how that goes. Now that we’ve talked about why make Chocolatey a little bit, talk a little bit more about what Chocolatey is. Sure. Clearly, as we can see, if you look at the comment that Rob posted on the Switching Windows episode, I had some misconceptions about how I should be using Chocolatey.
Rob: Well, I don’t think that there was anything that was said that was incorrect. The only distinction that I wanted to point out was because it’s a decentralized package management tool, that when you’re using it in production, you definitely don’t want to be depending on the community feed, at chocolatey.org/packages because there’s no control there and there’s no trust, or very, very low trust. Now, trust is something that we’re starting to build, but as you guys were talking about in the last podcast, signing packages is really the next big thing in the trust so that you have a nice traceability from the person that you think created it to, you know, the person that actually created it.
Trevor: [00:05:30] Yeah.
Rob: And that’s That’s really the big thing that’s necessary to really bring it, at least the community feed, into the mainstream. I think until that happens, it’s really a matter of if you’re a corporation, if you’re a company and you’re wanting to do package management with Windows stuff, you can. You just need to be very wary of using the community feed that’s out there. We’ve made the packages so, so simple to build and create that a lot of companies, they just, they create their own packages, they put them on some internal repository somewhere, and then nothing ever touches the internet. So where you see, when you go out to the community feed, you see, oh, here’s a package, and in it, it has this instruction, and the instruction says, you know, I want you to go get this binary from somewhere like an official distribution point. Download it to the machine. Here’s the checksum. A lot of packages do have checksums. There are a lot that still don’t. Check it, make sure it’s good. Make sure it’s what the maintainer thought it was going to be. And then here’s the silent arguments for installing it or upgrading it. A little bit more about what Chocolatey actually is. It’s really the idea that you have configuration you need to put on your machine, you have things you need to install on your machine. Chocolatey works through a packaging framework called NuGet, and then on top of that, we’ve enhanced it a bit, but it looks for some automation scripts. Right now, those automation scripts are written in PowerShell. We did a spike and we’re going to be adding Script.cs at some point. Are you familiar with Script.cs?
Trevor: [00:07:14] I’m not, but it sounds like it involves C#.
Rob: It does.
Trevor: Ooh, 4 years ago Trevor is excited.
Rob: Yes, Script.cs is— I don’t know how to explain it. It works on not Windows, it works on Mono where PowerShell doesn’t. So there’s definitely that. It allows you to very quickly like write C# and then be able to run it, and it has a REPL that comes with it. And yeah, it’s It’s kind of fun.
Trevor: Um, so does that mean that in the future Chocolatey will also be cross-platform? Is that an intention?
Rob: Chocolatey is sort of cross-platform already. Um, so when we first— when I first created Chocolatey, I just created it and it was completely written in PowerShell. So there’s a command line app and you interact with it like you would a command line app, except all of the language under it was completely PowerShell. And we were using PowerShell in a way we probably shouldn’t have been because we would have to start up PowerShell every single time you ran a command. So we’re paying that, you know, 1 to 2 second penalty of startup time. And yeah, we had about 20-some thousand lines of code and it, it got very interesting to maintain. So we had to start thinking of doing maintenance in ways that, uh, you know, I don’t think a lot of other people in the PowerShell community were leaning towards. I think one of the other, um, tools that were out there was Psaki, and Psaki is a build tool written in PowerShell, and it was probably at a similar size, um, but it was doing things more towards, you know, the PowerShell-y way with, you know, like Invoke-Command where, um, we were definitely not doing that. And so to bring about more maintainability, to bring about much better speed, and, um, to really be able to go cross-platform, uh, I decided to go back and take the pain of doing the rewrite back in 2014. I know, man, that was like just last year. And that finally came out, um, the first of this year, I think around March. It was in beta for quite a while. Yeah, it’s, it’s come out. There’s been some, some security enhancements. We’ve got plenty more coming. But yeah, we’re really trying to grow it up into what you see as a package manager when you look at Linux so that you can see something exactly, exactly like that when you come to Windows. And we definitely got some work to do.
Trevor: [00:09:57] That’s still, that’s That’s awesome. So I mean, going back a little bit to, you know, you were talking about managing packages yourself. So how do I go about doing that? So, you know, do I need to go in and actually— you know, a lot of other situations, like for example, one of the folks, one of the companies I’ve been working with recently is using Artifactory to mirror like the PowerShell gallery.
Rob: Right.
Trevor: So, you know, their ultimate goal there is to make it so that they have, you know, a copy of everything that they’re trying to run against their system and they’re not relying on something external to be hosting it. But a lot of the Chocolatey packages that are in the community are— they reference, like you said, a package, like an actual source for, uh, that the company releases their software at. Uh, so do you actually need to—
Rob: if you’re gonna, if you’re gonna host your own Chocolatey package, you actually need to go in and modify them all so that if you’re going to take existing packages from the community repository and bring them internal, you do have to actually edit it right now. So we call that process repackaging, and there’s going to be a business version of Chocolatey coming out next year, and in that, that repackaging process will be will be a single command that you will run that you’ll say, hey, go get that package over there, download anything that goes with it, put those here, and rewrite the package to point to those internal resources. And so that’s like one of the things that we’re doing with the, the Pro and the Business versions. Another thing that we’re adding is a little bit more like virus checking. And then for our professional users that are still using the community feed, an alternate CDN where these downloads— like you guys mentioned, sometimes you’ll go out and you’ll hit a package and, you know, Notepad++ took that day to go down. And it really doesn’t matter if you’re a pro user because there’ll be an alternate private CDN that’s gonna have that binary. So it’s gonna go, oh, that didn’t work, I’m gonna go get it from over here, or it’s gonna start over here. I haven’t quite figured that one out yet, uh, which one it should do first. Um, we don’t like it when we see 404s.
Trevor: [00:12:19] No, nobody likes 404s.
Rob: Nobody likes the 404.
Trevor: Although I guess I do sometimes like the GitHub 404 when you get the fun, like, Landspeeder one.
Rob: I always, I always see the unicorn.
Trevor: Ah, I bet there’s, like, some profiling tool that GitHub’s using to determine, you know, which which fun 404 you get.
Rob: I get the pretty unicorn. I think Stack Overflow has a really interesting one as well. Every time I see that, I try to take a screenshot because it doesn’t happen very often.
Trevor: I don’t think I’ve actually seen it.
Rob: I’ve seen it twice. I don’t remember the last time, but the most recent time was like a couple days ago. I hit it and they had just gone under maintenance And they were only down for like 5 minutes.
Trevor: That’s awesome.
Rob: I was like, I went to some page and I’m like, and I tried to go to another page and I was like, oh gosh, it’s down.
Trevor: [00:13:20] Yeah, I mean, that’s when you’re on a site that’s like you’re used to being up and you see it go down, you’re like, wait a second, is there like something going by? You know, is a pig outside flying by the window? Like, wait a second. What do I do without internet? So I actually had forgotten about seeing the stuff, the talks around the professional version of Chocolaty. So can you talk a little bit more about that and how that came about and what the goals are with that?
Rob: Sure. So one of the things that most people probably don’t think about, although they, they probably know that, you know, this kind of thing is there, is that, you know, just because it’s a free service that we have out there doesn’t mean it doesn’t cost us anything. Uh, and so, um, you know, at some point when you’ve been running a site for 3 years, 3 to 4 years, you have to decide, you know, do, do I keep pouring money into this, or do I need to find a nice business model that’s going to help keep it around for a long time? And, you know, really wanted to, to see it stick around, at least as the community feed. I don’t think the tool would ever go away. Um, so, uh, did a Kickstarter last year, um, and it was successful, successful. So we’re very excited about that. We’ve been working to, you know, of course, the rewrite with Chocolaty. We introduced moderation. Moderation has been kind of this nice double-edged sword where it’s been extremely popular. We probably turned it on just a bit too early because all of our infrastructure automation wasn’t quite ready for it yet. And so it was a very manual process for, for our moderators that are out there checking these packages, making sure they’re safe, making sure that they’re not going to do bad things before they approve them. So that was October 2014. Prior to that, You could put a package up there and it was completely live. There was no— there was like a review process that would come about and there’s a way to do a report abuse. But there was really no— it has been checked by a human and a human has verified that it doesn’t do anything bad to your system. And of course, trying to bring up like quality and consistency see if some of the packages as well has been kind of interesting. And so we started moderation. Now, we had a lot of automation in place for being able to push up packages very quickly and keep packages in sync with, you know, these software that maybe you don’t own. And so we have some maintainers out there that have really taken advantage of that. And they’re able to push upwards 200 packages at a time, and they do.
Trevor: [00:16:17] Wow.
Rob: And so you can imagine when you have something automated on one side and a human review process on the other, how that works out, and it doesn’t very well. And so a couple of weeks ago, we finally released the validator, and the validator is a service that will check the existing packages that are out there, and every 2 weeks it rolls through those And it goes, does this still install successfully? If it doesn’t, it sends an email back to the maintainer and says, hey, this is failing. And some of our maintainers have been seeing that happen now that it went through that first round. But it also goes through the moderation queue and it checks all these submitted packages and it, in a headless way, it runs Vagrant and installs Chocolatey, it sets a sandbox up. And then it installs the package, grabs all of the files, grabs the log. It checks the uninstall as well. And it’s checking the uninstall from the perspective of the auto uninstaller as well. Chocolatey has this concept of when it installs, it takes a registry snapshot. And if it made any changes to the registry, it installed anything, it knows how to uninstall it automatically, which means you don’t need an uninstall script for the most part. And we find about 80% of the packages don’t need it. So that’s, that’s a pretty nice benefit.
Trevor: [00:17:38] That’s awesome.
Rob: So the— did I call it the verifier or the validator? So that’s the verifier. It’s, it’s verifying that, you know, the installs actually work, the uninstalls actually work. And then we have the validator. The validator goes in and looks at the quality, the consistency, it’s looking at making sure that the the package meets the guidelines and it meets the requirements that are necessary to get onto chocolatey.org. So it’s going, you know, are you meeting the naming guidelines? If you do use an icon, are you using it from the right place? So it’s like it’s going through and it’s checking all these things. And I think we have probably about 35 checks that we do. And some of those checks check multiple things. And so like, it’s looking inside of the package, and it’s looking to see if you’re using Start Process. And if you are doing Start Process, it’s going to set a note. And so all of that automated review goes back onto the actual package page. So and then that also goes back to the package maintainer so they can make any changes if they need to. And it’ll keep going back through that until it’s good enough for a human to step in and do the review process. And so at the end of it, when you get a good install, and you’re meeting the package validation, then a human reviewer gets involved in it. It’s a very, very short process. At that point, all they’re really looking at is look at the install script and make sure there’s nothing bad going on in there. And then look at the download where it’s located. Is it coming from the official distribution point? And if not, then you get back with the maintainer to fix.
Trevor: [00:19:28] That’s really, really cool.
Rob: Yeah, so the validator is working, it’s just not actually reporting anything back to the users yet because we’re trying to clean up the messaging because we want it to be, uh, we want the messages to be like rock solid, short and simple, and they actually tell them what to do. Um, but then they, they send them to a wiki link that has more information. So like, oh, um, you’re telling me that the copyright, uh, field or the description field is only like less than 30 characters and I should write more information in here? And well, what does that look like? Or I used tags incorrectly, I used commas instead of space separated. Okay, so I know that I need to fix that. Um, do you have more information? Those are the— those are a little bit more trivial We check some more advanced things, but yeah, some of that stuff is going back into when you do chocolatey pack. And when you package up a package, you’re going to be having some of that validation run. Some of that validation is really specific to chocolatey.org, so we definitely want to check that there.
Trevor: [00:20:32] That’s so cool. So you talked about malicious packages. Have you had any malicious packages? Get uploaded?
Rob: We haven’t found a one, but I mean, it really only takes— it only takes one.
Trevor: It does, absolutely.
Rob: Now we have had packages go up that are using SourceForge, and SourceForge pulls down the malware, right? And you know, that spam stuff may or may not get installed, um, on the machine. We, uh, when we actually do the registry snapshot, we’re trying to see if anything else gets installed through there. And we’re not actually seeing everything that it brings onto the system yet. One of the things that we’ll be enhancing the validator with is a tool called Turbo. And Turbo, if you’re ever— maybe that’s something in our checkouts in Retro.
Trevor: There you go.
Rob: Turbo is this really nice tool.
Trevor: We can put that in the show notes for sure.
Rob: Yeah, that does Um, it’s kind of like— I, I don’t want to call it Docker for Windows, but, um, it’s really had some concepts, uh, you know, doing a little bit of virtualization and allowing you to, to do that on Windows. And it’s been around for a long time. It was previously called Spoon. So if you’ve ever heard of Spoon—
Trevor: [00:21:52] I have actually. Yes, I forgot about it.
Rob: But one of the really nice things that it does is when you use Chocolatey to do a Turbo container, you have a Chocolatey version that you can do that. You can actually diff the container and you can see, like, here’s all of the registry keys that got touched. Here’s all of the files that got touched. And so having that as part of the information that we can provide back to maintainers and also for us to be able to check, like, oh, it installed. What did it actually do?
Trevor: Like, absolutely.
Rob: It’s like, it’s not like when we do the Chocolatey stuff, we’re only checking like a very small portion of the registry because holy crap, that could take a long time.
Trevor: No, no, there’s only a few.
Rob: And then as far as the file system, we’re really only looking in the actual package itself right now to see what got installed when it’s actually reaching out and it’s doing the native install that goes into Program Files. We don’t check that yet. I think we’re going to be moving towards that, especially if you’re running it as a moderator or an admin. You should be able to have that information.
Trevor: [00:23:02] It’d be helpful.
Rob: Yeah, we’re adding that to the verifier at some point.
Trevor: So you talked about how you want to get Chocolatey kind of closer to the traditional Linux package manager concept. So how is Chocolatey different today?
Rob: Chocolatey doesn’t have virtual packages and it doesn’t really have any of the concepts of replaces or conflicts or ways of doing packages, some sort of package resolution. I mean, there’s a little bit in there that comes with NuGet, but NuGet really doesn’t get into that, like, oh, this thing is the same as this other thing. Just, you know, it’s like, here’s Ruby 2 and here’s Ruby 1. How do they interact, right? Ruby 1.9 anyway. It could definitely benefit from virtual packages, especially when you’re trying to say, you know what, I need to take a dependency on— I just want a PDF reader installed. I don’t really care what it is. And so being able to say that Adobe PDF and, um, I think it’s called, uh, Sumatra PDF— being able to say that both of those provide PDF, um, would be a really nice way for packages to say, okay, I can take the dependency on the virtual and then it’ll look for what provides that and then give that. We don’t have package indexes in the way that other package managers do. And so when you’re trying to query for what packages are available, you’re actually going out and hitting remote systems right now. And that’s something that we want to change. So we’re working towards having package indexes as well. We’ve already talked about the package shining, so we know that’s not there yet. But in a lot of other ways, it’s It’s very similar to the others. Um, others starts at a really good CLI, and then there’s a GUI that goes along with it. There’s a tool out there called Chocolatey GUI that’s, uh, done by the Chocolatey team.
Trevor: [00:25:18] Why wasn’t it— why wouldn’t you call it GUI Chocolate?
Rob: I don’t even know why we call it Chocolatey GUI. Um, I’m sure it could be renamed at some point.
Trevor: Oh yeah, sometimes those are the hardest ones to change, the ones that have been established. You know, just, just use the, use the play on words a little bit more.
Rob: Gooey chocolatey goodness. Yeah.
Trevor: So I mean, that’s the thing. That was like, you know, this is, this is, you know, this conversation as a whole has been awesome for me, uh, because it makes it make so much more sense. And like, uh, you know, the things you pointed out during, you know, just even during in the, in the comment on the previous episode, um, were kind of clarifying because it, for me, it was totally like, oh dude, why didn’t your Trevor, why didn’t you read, you know, read the fucking manual?
Rob: [00:26:24] Oh, no worries. Uh, I think a lot of people miss it, and I think it’s probably because we don’t do a very good job of, um, putting that out there properly. And, uh, we have customers come to us, like, not a lot— none of our customers trust the internet in the first place. And I don’t— I want to say that’s probably because we work a lot more with sysadmins, uh, and Of course, sysadmins have no trust at all for hardly anything, which is good. It’s a healthy distrust. And so, yeah, they’re definitely wholly against like going out and using, you know, using the internet and trusting the internet. We have a lot of customers that just don’t trust the internet, and I think that’s a good healthy fear. To stay away from that. And so a lot of them have used Chocolatey and have brought everything that they need internal. And so that is the way— but I mean, you’re not going to have a lot of companies in the first place that are like that are probably going to be advertising what, what it is that they use. And so, um, that’s why it’s probably on us to do a bit better job of advertising what you could use Chocolatey for if you think of it more as a framework and can separate the package, the community package repository at chocolatey.org/packages from the actual Chocolatey itself.
Trevor: [00:27:54] And I think, like you were talking about, the professional Chocolatey too, having the ability to have a mechanism to leverage the community cooked the cookbooks. Can you tell I’ve been working with Chef a lot? The community Chocolatey packages, in a way that you can replace those package sources, is just fantastic. And I think that’ll help a lot too, especially the companies I’ve worked with who have been like, oh, how do we get Chocolatey into here? That’s been like the— that’s the answer to the question that I didn’t have an answer for. Just like, well, I don’t know how you’re gonna replace those packages. Just rewrite them.
Rob: If you’re using Puppet, there’s a provider for Chocolatey. If you’re using Chef, of course, you know there’s a cookbook for Chocolatey. Both of those will actually allow you to install Chocolatey. And I think Matt Rock, who’s been working on the Chef side. Um, I think he’s bringing about more of, uh, the ability to install Chocolatey completely offline and use it completely offline, where the Puppet side has had it for a little while, uh, longer. So, um, I think you’re going to see probably a little bit more support on both sides of that start to really ramp up in the new year.
Trevor: [00:29:17] So, so you both have— you’ve got the, uh, the dueling banjos, if config management in Chocolatey now?
Rob: Oh yeah.
Trevor: So speaking of, speaking of kind of big clients that do talk about using Chocolatey, Microsoft is leveraging Chocolatey as a framework for OneGet, right?
Rob: Yes, sort of.
Trevor: Is that less true than it was before?
Rob: I think I think there’s a— so way back in the beginning, Microsoft said, you know what, we like Chocolatey. A lot of people like using Chocolatey, and we want to build— we’re building this tool called OneGet. And OneGet is a package manager aggregator, which means it really isn’t a package manager at all. It just knows how to talk to other package managers. We’re building the provider for Chocolatey, and then we started helping and working with some of the folks who are building that. And, you know, with— it’s like we have— I had a Kickstarter that I needed to do delivery on. I have the moderation work that I needed to to make sure I do. And yeah, there’s like all of this stuff. And so there’s only a few of us. And we’re, of course, all volunteers that work on this stuff in our spare time. So it doesn’t leave a lot of time to really help finish up the OneGet provider. And so if anybody out there like wants to like knows PowerShell, wants to use ChocolateE3.1 get, great. If you feel— oh, you also have to know C#. If you want to jump in and help out with that, just reach out on the Chocolate emailing list or out on Gitter. We could definitely use the help with that. We want to get that done sometime in the first half of next year, maybe even better if it could be in the first quarter. Um, but like I said, the biggest things for us, or for at least in priority for me, is finish the Kickstarter stuff and then make sure that the moderation automation that goes around that is working really well. And even here more recently, um, in the last— somewhere around October, we started having issues. Uh, chocolatey.org, the usage went way up. So like I said earlier, the moderation has been great on the consumer side. In 2014, before we introduced moderation, we had about 5 million downloads total over 4 years— sorry, the 3 years before, right? From that date of introducing moderation until my PuppetConf talk, it went up another $20 million to $25 million. One year. Wow. Yeah. So like I said, having those checks on one side has really increased people’s usage. Like, oh, okay. So on the other end, the getting packages approved process has been a bit slower, and it’s been quite a bit slower for some people. In some ways, I think that we’ve sort of failed, that we didn’t get the automation in place as quickly as we needed to. So we’re trying to correct that now. With that also, Chocolatey already, because of all of the increased usage, has really brought some of the pieces that weren’t quite complete needed a little bit more love, or, or some parts that just weren’t working, or working until you had a certain number of users hitting it. Um, and we get it— to put it in perspective, our bandwidth is about 1 terabyte a day. Um, and so we get about 6, somewhere between 4 and 6 or 7 million requests a day. And so that’s awesome. When you— when it starts to have problems, everybody starts— it’s like when it starts to crash, everybody knows, and you start having all these people like, hey, it’s not working. And so, uh, we’ve been having a bit of some stability issues, and I righted some of it, and then I didn’t, I, I didn’t quite get it all done. And I was actually today, I was— I’ve been working on, um, the rest of the fixes for making it as solid as it was before all of that happened. So that again, it’s, it’s when you, you hit it, you don’t get, um, a nice, like, you know, I’m trying to search for something and things are slow and I’m just waiting. And, or I, I’ve hit the cache, has been primed and everything’s like snappy. So sometimes you’re just not, you’re not sure what you’re getting. And so that’s That’s what I’ve been fixing today, and I’ll probably be fixing that even later.
Trevor: [00:34:35] Oh, that brings me to another question, which you started to touch on also, was so how does, how does the Chocolatey team find time with, you know, you’re working, I assume, full-time at Puppet. So how does, how does, how does everybody find time to maintain this awesome tool?
Rob: A lot of people say it’s a labor of love and you’ll just, you find time for things, right? And so, you know, if there’s a production problem with chocolatey.org, I will typically maybe take PTO and just work on that. I might be the only one that actually goes probably that far, but I’m also, you know, the guy behind Chocolatey, I guess. And when it goes down, I get to hear about it. So But yeah, like, um, my maintainers, you know, it’s, it’s when they have free time they will jump in, and the community jumps in when they want a certain feature really bad in Chocolatey, and they’ll put out a pull request, and it’s fantastic. And we always love that, and, you know, hopefully, um, that continues to be, uh, pretty rock solid there.
Trevor: [00:35:44] So how does one get involved with Chocolatey in case anybody listening to the show is like listening to this and they’re like, oh, I totally want more of this and how do I help make more of this and how do you get involved?
Rob: So we have a mailing list. A lot of questions come up on the mailing list. Now that we have Gitter, which is a chat client sort of like Slack, a lot of questions will show up there. So people will jump on there and they’ll start asking questions. And— or they’re looking for a package and a maintainer has disappeared. And so they want to jump in and start maintaining that package. That’s one way you can get in. You can look at packages that you like, that you use, that need new maintainers and jump in there. You could also take a look— like we have like a— it’s called Up for Grabs. Like we have certain certain things like features that we want, they’re, they’re up for, for community to jump in and, and start contributing. And typically some of those are like, yeah, I need a little documentation here, or, um, we like this, this, this feature. And so a lot of those are a little bit smaller, and so they’re easier for people to just jump in and get involved. Um, and that kind of gets you— you get the taste of chocolatey and then you want more. I had, I had one of my, uh, longtime chocolatey users once say, once you go chocolatey, you don’t go back.
Trevor: [00:37:16] The, the, the, you know, the possibility for puns is just endless.
Rob: It’s so yummy.
Trevor: Ah, another one.
Rob: You’re like, why did you call that? Well, that’s called DNF now, so the puns are going away on that one.
Trevor: Oh well, yeah.
Rob: Um, they have Yellow Dog Updater Modify and they call it YOM. Um, Chocolatey is really hard to come up with a backronym for, but, uh, maybe if one thinks long enough about it.
Trevor: Yeah, I’m sure you could figure something out, something, something clever, or, or, you know, it may still be— maybe an acronym, but it’s probably still a pun.
Rob: We always call it Choco, uh, internally, you know, whenever we’re talking about it because it’s just— it’s a lot of effort to say that over and over.
Trevor: Yeah, it is a— it is a long— a long one.
Rob: People are like, why did you spell it like that? Um, because it’s— for those that don’t know, it’s T-E-Y instead of T-Y. And I always say, well, you know, I kind of liked it better that way, plus the domain was available.
Trevor: [00:38:26] Yeah, you have to wonder how many, how many things got their clever name just for domain name availability. I’m sure that’s like 60% or more of why so many tech companies have funny spelled names, because, right, they wanted the domain name. How about— so we’ve kind of talked about a lot of it already, but as we kind of come up to the end here, what about What is the roadmap and what sort of things should we be looking to in the coming months from Chocolaty?
Rob: Oh, right on. Um, so I did mention the business and pro versions. Uh, the Kickstarter folks will get those 2 months before everybody else, um, if you’re in the particular reward groups that had that. So they’ll get theirs and then 2 months later we’ll have the general availability. At that point, people can jump in and start using that if they’re interested in those. With that, like I said, the one GET provider, we’re gonna be trying to fix— finish that sometime in the first quarter of the first half of the year so that that’s working. There’s a provider that’s out there right now that I was talking about earlier. It was a very early, like, CTP preview from way back in 2014 written on 2-year-old Chocolatey. Without all the security enhancements and all the other stuff that we have added since. Plus, that was the PowerShell version versus the C# version, which are like night and day. For anybody that’s used both of those knows that one can take forever and the other is like done. Checking like for all of the packages that have upgrades, if you I showed this at one point, like if you ran it in the old Chocolatey, it was like, could be like 4 minutes depending on how many packages you have. And then if you ran it with just the Choco C# version, it was like 40 seconds or actually it was even less than that. But, and I still remarked at that point that that’s still too long. That’s why we needed Pack— that’s why we needed package indexes because then it was like less than a second. Once you’ve updated your indexes, you already know what all is available for upgrades. And it never has to touch the internet or anything at that point because it’s already by now grabbed all that stuff and brought it down. As far as some of the features going into Chocolatey, so we are gearing up for version 0.9.10, not to be confused with 0.9.9.11 that’s out right now. That version that’s going out is going to have all of those alternative sources that we had to say we want to get out the C# version. And we’re almost— we got most of the feature parity, but we don’t have the ability for you to go out and say, I want to use Choco install this Windows feature minus source Windows features, right? Where the older Posh version PowerShell had that. And so the version that goes out is going to have that. We’re going to be adding a couple more security fixes, a couple more security features. Like, I’m not sure if it’s going to come out in 0.9.10.0 or one of the the patches that comes after that. But some people can’t use the checksumming because they have the FIPS algorithm security policy turned on. And so it won’t let them use MD5 checksumming. And so they need to be able to have a much better checksumming. It’s checksumming for— here’s the files that got installed. So when you uninstall, at least in the package, Chocolatey won’t remove files that you’ve changed. So if there’s like a config file in there, it’s not going to rip that out. It’ll leave it there. When a new one gets installed, it’s going to go, oh, that one’s already there. Actually, I think it’s still going to go over the top of it, but we have XML data transformations that you can actually add to, to have it be able to make changes to the web.config without destroying the one that you had there. And we look for that if you have a web.config, but then And then you also have the XDT file. We won’t copy over the top of the old web config. We’ll use the XDT file instead. Nice. That’s already there. One of the things that we’ve added for companies is— so how does one create a Chocolatey package? That was a question that was asked that I think we glossed over.
Trevor: [00:43:04] Oh, we still have time. We can answer that. Choco— or rather, I guess you can answer that.
Rob: There’s a command in Choco called new. And what that’s going to do is it’s going to generate out some files that are already like heavily templated, the ability to give you just things to subtract, a couple things to add, and you got a package. So it’s like this really quick way of getting packages out. And it has like all of like the best recommendations like are already built into these templates. But a lot of businesses may or may not want to be able to use these templates that are already geared probably more towards chocolatey.org. They may be able to use like their internal— like this is sitting on a file server somewhere where I’m going to embed the MSI into the package or some other executable into the package itself. And so you can create your own custom templates, and we added the functionality in the last version a couple versions ago, but We haven’t had the ability for you to install template packages. It would actually like, I’m gonna put a template out there and then you can just install it. And because of the way the package is named, there’s a convention that says, oh, this is a .template package, so I’m gonna put the template in the right place. So we’ll be adding somewhere in the 9.10 series, we’ll be adding that. We’ll be adding quite a bit more things, mostly because because we have to, to finish out the pro stuff, we have to have quite a bit, quite a bit of stuff going into the, the free side. Uh, it’s really nice, you know, you have this, uh, this nice business model and nobody understands the open source business model. You know, it’s like you have this open source thing and then somewhere in there you add something on top of it and you add maybe some support as well and then you charge for those things. And it’s kind of nice because it also continues to drive features in the open source model and keeps that nice and healthy. I think a lot of people sometimes miss that, that nice, fantastic side effect of having a business behind open source.
Trevor: [00:45:11] Yeah, I think, and that’s, that’s, it’s hard for a lot of people to get their head around too.
Rob: Yeah, it’s really hard. It’s been really hard for me. It’s It’s been almost impossible for my wife.
Trevor: That could be a whole other episode, dealing with work life and significant others.
Rob: Oh, I think she understands what I do. Um, sometimes she’s like, like if I go up and I like, because I work from home, um, I’ll go up sometimes and I want to explain a problem, you know, out loud because it helps me figure it out. And so I’ll go up and I’ll talk to her about a problem, and then she’s like, mm-hmm. And hopefully by that time I’ve figured it out, or I’ve moved on to trying to find, um, somebody online that can help me, or a friend that’s local that I could sit down with that’s also a techie. Techie is a very interesting occupation. Yep, especially in the big town of Topeka, Kansas.
Trevor: [00:46:19] Didn’t you guys get fiber soon or something? Or aren’t you getting fiber soon or something? I thought I saw something about that.
Rob: I think we’re still waiting. We did change our name to Google, and Google changed their name to Topeka a few years back, but then they gave it to Kansas City instead.
Trevor: That’s why I’m thinking of— well, awesome. Do you have any kind of any closing thoughts, uh, before we move on to the checkouts besides maybe read the manual?
Rob: So yeah, I mean, one of the things that every open source project can benefit from is better documentation. And I’m not going to say that ours is fantastic. It’s okay. Some of it’s probably hard to read because we don’t have pretty pictures that go along with it, so there’s this nice wall of text. We would, you know, if somebody’s out there and they’re like, ah, documentation, I like that. We love documentation. So one of the big things I think we’ll be doing is moving some of the documentation over to chocolatey.org off of the wiki. Um, and I didn’t mention it, but I mentioned it in other places. We’re doing a rewrite of chocolatey.org itself. Um, we took a fork of the NuGet Gallery, um, from 2011, ’12 when we, we, we took it, and we kept it up to date for a while. And then we wanted to take features a completely different way. Um, and so we started, um, adding our own stuff into it. But it’s, it’s clearly, it’s getting towards the end of its useful life. And so we’re going to be rewriting it and giving it a nice facelift and a few other things. And we’re gonna be moving in some of that documentation. And so what I see is when you go into the documentation, it’s like, are you on the open source side? Or are you a business using Chocolatey, and then it’s going to have, you know, like, here’s how you would do, like, creating packages, and here’s how you would use it from the business side. Here’s your options. It’s like, and then, like, this area where the two overlap would be, like, some— a good area for documentation, you know, shared documentation. But, you know, usually when people are using chocolatey.org, they’re saying, I’m gonna go download something from an official distribution point because I don’t have the permission to install, you know, I don’t have the permission to put it in the package and I don’t have the permission to host it somewhere else. So I have to, I’m bound by legality, where when you’re a company, you’re pulling that stuff internal, so you’re not putting it out there on the internet for the world, so you can do whatever you want. And so those types of uses of Chocolatey, you’re taking the binary and you’re embedding it in the package or you’re putting it on a CIFS share somewhere And then we’re using SCCM to help push it out to, like, different distribution points, and so that you’re getting your software out everywhere. And then you’re able to use Chocolatey to install all that. So, closing thoughts.
Trevor: [00:49:28] That’s awesome.
Rob: Chocolatey, it’s awesome. Use it.
Trevor: It is awesome. Thank you so much for, for doing this.
Rob: Yeah, thanks for having me on.
Trevor: Of course. So let’s, let’s jump into checkouts then. You’re up first. Did you come up with anything?
Rob: There’s a nice tool out there called Turbo, and I mentioned already there was something else I saw. I just can’t think of it right now because it’s so late.
Trevor: So we’ll put, we’ll put checkout Sleep.
Rob: Sleep is always a good thing.
Trevor: It’s okay, we could— you come up with it, we’ll put it in the show notes and we’ll tweet it out. We’ll call it Rob’s Latte Chocolatey Thoughts.
Rob: Latte after I’ve had my chocolate. Now I can think.
Trevor: All right, so for me this, uh, this time around, so I’ve been playing a lot with, uh, DSE and Windows Management Framework 5 and having a lot of fun.
Rob: [00:50:30] Sweet.
Trevor: So if you haven’t had a chance to play with it yet, you should. I’ve also, you know, I think I’ve mentioned this show. I think Matt’s mentioned this show. Rob specifically asked me not to spoil the show. Agents of S.H.I.E.L.D. is awesome, and if you’re not watching it, you should be. And finally, David Bowie put out a really awesome new video slash song called Blackstar. It’s like 10 minutes long. It’s really trippy. And it’s also awesome. And you should check it out.
Rob: Neat. So DSC, if you’re using it, we have a Puppet provider for DSC. You can do that. Chef also has a provider for DSC. So one of the things that Microsoft did differently, I think, this time, like we’ve been seeing them do a lot of things differently and a bit more open, is they said, hey, we’re building this thing and we really want to integrate with you guys. Like, we want, you know, we’re gonna have people building up all these DSC resources. We want to be able to offer them through Puppet and through Chef, and that’s been really cool.
Trevor: [00:51:40] So yeah, and they’re, you know, You can talk to your Microsoft team too, and they’ll work really closely with you to make sure that you’re getting your needs from DSC in combination with Puppet and Chef and Azure Automation, however you’re tying that all together. It’s really cool. As always, we have a newsletter, arresteddevops.com/bananastand. It is the best way to know about upcoming podcast episodes and cool news with DevOps. We also have an iPhone app if you dig that kind of thing. You can download it for free. At arresteddevops.com/iphone. Thanks again to our sponsors. Please be sure to visit them at arresteddevops.com/10thmagnitude and arresteddevops.com/datadog. Rob, thanks again so much for joining us tonight— or me tonight.
Rob: Thanks for having me.
Trevor: Oh, you bet. Wouldn’t have missed this episode for the world. To our loyal listeners, if you enjoy Arrested DevOps, we would really appreciate it if you’d visit arresteddevops.com/itunes and leave us a review in the iTunes Store. We’d also love to know what you thought of tonight’s— of this episode. Please leave us comments at arresteddevops.com/chocolaty. And that is chocolaty with an E-Y, as Rob said earlier. Be sure to check us out at arresteddevops.com or @ArrestedDevOps on Twitter. We’re always happy to get your input, ideas, or feedback at shows@arresteddevops.com. Please let us know if you have any ideas for future episodes. Rob did, and Rob just did an episode. I’m Trevor, @TrevorGHess. This is Arrested DevOps, and remember, there’s always DevOps in the banana stand.
