Skip to main content
Sources in WinGet are repositories that provide access to packages. They act as the bridge between the WinGet client and package metadata, enabling package discovery, search, and installation.

Overview

WinGet is built around the concept of sources - sets of packages that provide the ability to discover and retrieve metadata so the client can act on it. Each source has a unique identifier, type, and configuration that determines how it behaves.
Run winget source list to see all configured sources on your system.

Source Types

WinGet supports three primary source types, each with different characteristics and use cases.

Microsoft.PreIndexed.Package

The default source type for the WinGet community repository. This source uses a pre-computed SQLite index stored in an MSIX package for optimal performance.
This is the type used by the default “winget” source that accesses the Windows Package Manager Community Repository.
Architecture:
  • Index stored in index.msix package containing index.db (SQLite database)
  • Manifest files available individually on the server
  • Supports both web locations (https://) and file shares (\\server\share)
Key characteristics:
// From PreIndexedPackageSourceFactory.h:16-20
// Arg  ::  Expected to be a fully qualified path to the root of the data.
//          This can be a web location such as https://somewhere/ or a local file share \\somewhere\
//          Under this path there must exist an MSIX package called "index.msix".
//          This must have a file called "index.db" contained within, which is a SQLiteIndex.
//          The index's paths refer to relative locations under the Arg value.

Microsoft.Rest

A REST-based source type that enables private or custom package repositories using a REST API. Architecture:
// From RestSourceFactory.h:12-14
// A source where the information is stored on a REST based server.
// In addition, the manifest information is also available on the server.
// Arg  ::  Expected to be a API which supports querying functionality.
Features:
  • Dynamic package queries via REST API
  • Custom HTTP headers support (via --header parameter)
  • Authentication support
  • Ideal for enterprise scenarios
For implementing a REST source, see the winget-cli-restsource reference implementation.

Microsoft Store (msstore)

The Microsoft Store source provides access to free applications rated “E for Everyone” from the Microsoft Store.
// From SourceList.cpp:line 5
constexpr std::string_view s_Source_MSStoreDefault_Name = "msstore"sv;

Default Sources

WinGet comes with two default sources pre-configured:
winget source list
SourceNameTypeDescription
WinGet CommunitywingetMicrosoft.PreIndexed.Packagewinget-pkgs repository
Microsoft StoremsstoreStoreFree apps from Microsoft Store
Group policy may be configured to modify available sources. Run winget --info to see any configured policies.

Source Management

Manage sources using the winget source command.

Add a Source

Add a new package source to WinGet:
winget source add --name Contoso --arg https://api.contoso.com/packages --type Microsoft.Rest
Only add sources you trust as secure locations. Sources have access to install software on your system.

Update a Source

Force an update to refresh source metadata:
winget source update

Remove a Source

Remove a configured source:
winget source remove --name Contoso

Reset Sources

Reset to default configuration (removes all custom sources):
winget source reset
This command removes ALL sources and restores only the defaults. Use with caution.

Source Configuration

Sources are defined by several key properties:
// From RepositorySource.h:117-163
struct SourceDetails
{
    std::string Name;              // The name of the source
    std::string Type;              // The type of the source
    std::string Arg;               // The argument used when adding the source
    std::string Data;              // The source's extra data string
    std::string Identifier;        // The source's unique identifier
    SourceOrigin Origin;           // Origin of the source
    SourceTrustLevel TrustLevel;   // Trust level of the source
    // ... additional fields
};

Source Origins

Sources can come from different origins:
  • Default - Built-in WinGet sources
  • User - User-added sources
  • GroupPolicy - Configured via Windows Group Policy
  • Predefined - System sources (Installed, ARP, MSIX)

Trust Levels

// From RepositorySource.h:40-45
enum class SourceTrustLevel : uint32_t
{
    None        = 0x00000000,
    Trusted     = 0x00000001,
    StoreOrigin = 0x00000002,
};

Advanced Features

Custom HTTP Headers (REST Sources)

REST sources support custom HTTP headers for advanced scenarios:
winget search --source MyRestSource --header "custom-behavior: test-mode"
The header is sent as the value of the Windows-Package-Manager HTTP header. Maximum length: 1024 characters.

Certificate Pinning

For enhanced security, sources support certificate pinning configuration:
// From RepositorySource.h:149-150
// The configuration of how the server certificate will be validated.
Certificates::PinningConfiguration CertificatePinningConfiguration;

Source Priority

Sources have priority values that determine preference when multiple sources contain the same package:
// From RepositorySource.h:159-162
// Value used for sorting the sources and making decisions
// (like preferring one source over the other if both have a package to install).
// Higher values come first in priority order.
int32_t Priority = 0;

Predefined Sources

Beyond user-configured sources, WinGet maintains several predefined sources:
// From RepositorySource.h:77-91
enum class PredefinedSource
{
    Installed,                    // ARP + MSIX packages
    InstalledUser,               // User-scope packages only
    InstalledMachine,            // Machine-scope packages only
    ARP,                         // Add/Remove Programs
    MSIX,                        // MSIX packages
    Installing,                  // Packages currently being installed
    InstalledForceCacheUpdate,   // Triggers cache update
};
These sources provide access to packages already installed on your system.

Source Information

After opening, sources provide additional runtime information:
// From RepositorySource.h:182-200
struct SourceInformation
{
    std::string SourceAgreementsIdentifier;
    std::vector<SourceAgreement> SourceAgreements;
    std::vector<std::string> UnsupportedPackageMatchFields;
    std::vector<std::string> RequiredPackageMatchFields;
    // ...
};
This includes source agreements, supported search fields, and capabilities.

Next Steps

Packages

Learn about package structure and metadata

Manifests

Understand manifest files and schemas

Build docs developers (and LLMs) love