Latest version 1.8.4.2 not available via Chocolatey

[TraceyC77]

When starting up KeePass2 I received a message that keepasshttp version 1.8.4.2 was available. It is not yet available in Chocolately.

λ choco upgrade keepass-keepasshttp
Chocolatey v0.10.3
Upgrading the following packages:
keepass-keepasshttp
By upgrading you accept licenses for the packages.
keepass-keepasshttp v1.8.4.1 is the latest version available based on your source(s).

Also chocolatey.org/packages/keepass-keepasshttp/ shows 1.8.4.1 as the latest version available

[kendaleiv]

https://chocolatey.org/packages/keepass-keepasshttp/1.8.4.2 is submitted.

[josiasdx]

Using "choco upgrade keepass-keepasshttp" I can't upgrade to 1.8.4.2 neither

[Smirenka]

@kendaleiv I'd think that people would get used to the fact that chocolaty is slow to accept files and stop complaining about this, eventually. But there I go thinking again, right?

[Vonmerkenstein]

Uninstall keepass-keepasshttp and then use "choco install keepass-plugin-keepasshttp" works for 1.8.4.2

[P-i-e-r-o]

I think it is ridiculous to use choco to install/upgrade that plugin.
You just have to download the plugin file (KeePassHttp.plgx) and to replace the old one by the new one (directly in your keepass 2 installation folder).

[Navixer]

The plugin and Keepass nags me to update my Keepasshttp, I use Chocolatey and it still installs 1.8.4.1 and I can't get rid of those annoying messages. It's like that for almost a week. It made me irritated so much.

[Smirenka]

@Navixer Try what @Vonmerkenstein suggested. It did actually force the update for me, at least.

[Navixer]

Okay now it has been updated. Thank you guys.

[TraceyC77]

The package @Vonmerkenstein installed is a different upload of the plugin to chocolately.
This one is keepass-keepasshttp uploaded by the keepass-http plugin author pfn (Perry Nguyen)
The other is keepass-keepasshttp-plugin uploaded by dtgm

While the other upload of the plugin looks benign, I wonder why someone else has also been submitting the plugin to chocolatey? It causes a bit of confusion for users.

[kendaleiv]

I'm the maintainer for the keepass-keepasshttp Chocolatey package (https://chocolatey.org/packages/keepass-keepasshttp). There is an open issue for potentially deprecating the keepass-keepasshttp package in favor of the keepass-keepasshttp-plugin package kendaleiv/chocolatey-keepass-keepasshttp#5. If anyone wants to comment on that issue for how you'd like to see it handled, feel free.

[AdmiringWorm]

The KeePass HTTP plugin was just approved, there was a flux of submitted packages so we had (still have perhaps) quite a large backlog.

FYI: if a version haven't yet been approved it can still be installed by calling choco install {packageName} --version {version}

[TraceyC77]

While I was able to update keepass-keepasshttp to 1.8.4.2, the package tells the user they have to (re)install Keepass, and uses an old version.
The current version of KeePass is 2.35
The chocolately package installed KeePass 2.18

It seems the logic of the plugin installer is not ideal. It should (from a user's point of view) check to see if KeePass is installed on the system before trying to install that itself. If the version of KeePass is equal to or greater than what the plugin requires, it should not try to reinstall KeePass.

Regarding who maintains the plugin, I personally don't have a preference. That's up to the two of you. From a user perspective, I'm mainly concerned with there being one plugin repo, and that repo being kept up to date. (This is not a criticism of this particular case, just stating general preferences).

If one repo is deprecated in favor of the other, and if chocolately allows, it would be a good experience for users of the deprecated repo to get a notice the next update attempt. Ideally it would offer to update the repo information so it's as painless for them as possible. At the least it should offer information on how to switch over to the currently maintained source.

Thanks for all your work on this plugin.

[abdupattoh]

I just upgraded keeppass plugin to 1.8.4.2 with chocolately:

PS C:\WINDOWS\system32> choco install keepass-keepasshttp
Chocolatey v0.10.5
Installing the following packages:
keepass-keepasshttp
By installing you accept licenses for the packages.
keepass-keepasshttp v1.8.4.1 already installed.
Use --force to reinstall, specify a version to install, or try upgrade.

Chocolatey installed 0/1 packages. 0 packages failed.
See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).

Warnings:

• keepass-keepasshttp - keepass-keepasshttp v1.8.4.1 already installed.
  Use --force to reinstall, specify a version to install, or try upgrade.

So I thought, cool, I will upgrade...

PS C:\WINDOWS\system32> choco upgrade keepass-keepasshttp
Chocolatey v0.10.5
Upgrading the following packages:
keepass-keepasshttp
By upgrading you accept licenses for the packages.

and I ended up with keepass 1.18 on my system, when I had 1.35 installed before.

If I had to choose between having my chrome browser plugin upgraded by one minor version, or having keepass itself downgraded by 14 versions or so, I would choose keeping the old plugin.

Downgrading security software should be only done with a good warning and explanation for the reason needed, in my opinion.

Thanks,
Patrick

[carlin-q-scott]

@abdupattoh The automatic downgrade to keepass also annoyed me but choco upgrage keepass fixed the issue. Did you file a separate issue to remove the keepass version requirement from this plugin's chocolatey package?

[kendaleiv]

The keepass-keepasshttp Chocolatey package currently specifies
<dependency id="keepass" version="[2.0,3.0)" />, which shouldn't initiate a downgrade as far as I know.

[carlin-q-scott]

@kendaleiv I did a little research and found that both NuGet and chocolatey at one point chose the lowest version of a package that satisfied dependencies. Later on chocolatey supposedly fixed it somehow but are light on the details. I have a later version than the one they claim fixed the issue so the next part of my story might be relevant to this chocolatey package.

NuGet fixed the issue separately from chocolatey by adding a NuSpec property. Maybe if you add the NuSpec property supported by NuGet the package will install as intended?