Fall back to the index.db file inside "source2.msix" if the "source2.msix" MSIX can't be installed.

[DandelionSprout]

Relevant area(s)

WinGet CLI

Description of the new feature / enhancement

Directly based on #4319 (comment).

Sporadically, users may wish to run Winget on Windows installations that can't install MSIX or AppX at all (Windows Server Core seems to be the most common scenario). The problem then is that the winget-pkgs list of repo packages is currently exclusively distributed as MSIX (https://cdn.winget.microsoft.com/cache/source2.msix).

Extracting the MSIX as a ZIP shows a file at "Public" → "index.db", but there's no immediately obvious way to make use of only that one .db file. Thus there needs to be a way for affected users to use the index.db file.

Log file: WinGet-2026-05-28-06-34-38.589.log

Winget --config:

WindowsPackageManagerPreview
MainCopyrightNotice

Windows: Windows.Server v10.0.26100.32230
SystemArchitecture

KeyDirectoriesHeader
----------------------------------------------------------------------------------------
Logs                 %TEMP%\WinGet\defaultState
UserSettings         %LOCALAPPDATA%\Microsoft\WinGet\Settings\defaultState\settings.json
PortableLinksUser    %LOCALAPPDATA%\Microsoft\WinGet\Links
PortableLinksMachine C:\Program Files\WinGet\Links
PortableRootUser     %LOCALAPPDATA%\Microsoft\WinGet\Packages
PortableRoot         C:\Program Files\WinGet\Packages
PortableRoot86       C:\Program Files (x86)\WinGet\Packages
InstallerDownloads   %USERPROFILE%\Downloads
ConfigurationModules %LOCALAPPDATA%\Microsoft\WinGet\Configuration\Modules

Links
--------------------------------------------------------------------------------
PrivacyStatement         https://aka.ms/winget-privacy
LicenseAgreement         https://aka.ms/winget-license
ThirdPartSoftwareNotices https://aka.ms/winget-3rdPartyNotice
MainHomepage             https://aka.ms/winget
WindowsStoreTerms        https://www.microsoft.com/en-us/storedocs/terms-of-sale

AdminSettingHeader                        StateHeader
-------------------------------------------------------
LocalManifestFiles                        StateDisabled
BypassCertificatePinningForMicrosoftStore StateDisabled
InstallerHashOverride                     StateDisabled
LocalArchiveMalwareScanOverride           StateDisabled
ProxyCommandLineOptions                   StateDisabled
ConfigurationProcessorPath                StateDisabled
DefaultProxy                              StateDisabled

Proposed technical implementation details

Option 1

If the log for winget update throws Msg:[winrt::hresult_error: Class not registered], initiate Repository update failed due to lack of MSIX installation support; checks the database .db...

Option 2

Publicly publish a https://cdn.winget.microsoft.com/cache/source2.msi alongside the existing https://cdn.winget.microsoft.com/cache/source2.msix.

Option 3

Add a database .exe or .msi inside the source2.msix.

Option 4

Distribute repo updates from a URL instead of as an MSIX.

[denelon]

The use of the MSIX package for the index is intentional. Catalog signing addresses supply chain concerns.

We're looking at separate work in the OS for Server Core to be able to leverage WinGet in the future.

We've looked at other options for a "local source", and likely enterprises running server core would want a private source as opposed to full access to the community repository. Server Core doesn't default with a desktop experience, so many packages in the community repository wouldn't make sense in that environment.