MIssing DLL - quaternion-0.0.96.1

[acesolucoes]

I have Windows 11 and I have downloaded the zip containing the quaternion executable. Though I couldn't run successfully from onset because it was complaining libcrypto-3-x64.dll was missing. I got to pick the DLL from a openSSL repo I had, so the executable ran flawlessly.
Please update the zip with the missing DLL to avoid this issue for the users.
Thanks

[KitsuneRal]

You didn't read the README, did you?..

[Erquint]

I want to take this issue as an opportunity for a constructive discussion. Hear me out.

The README states:

Since there's no established package management on Windows to resolve dependencies, all needed libraries and a C++ runtime are packaged/installed together with Quaternion - except OpenSSL.

I tried downloading the PE ZIP package and launching it to see how it behaves. It did complain at missing libraries. Then I quickly ran:

PS C:\Windows\System32> winget find openssl
Name                 Id                         Version Match        Source
---------------------------------------------------------------------------
FireDaemon OpenSSL 3 FireDaemon.OpenSSL         3.4.0   Tag: openssl winget
OpenSSL 3.3.1        ShiningLight.OpenSSL.Dev   3.3.2                winget
OpenSSL Light 3.3.1  ShiningLight.OpenSSL.Light 3.3.2                winget

PS C:\Windows\System32> winget install ShiningLight.OpenSSL.Light
Found OpenSSL Light 3.3.1 [ShiningLight.OpenSSL.Light] Version 3.3.2
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
This package requires the following dependencies:
  - Packages
      Microsoft.VCRedist.2015+.x64
Downloading https://slproweb.com/download/Win64OpenSSL_Light-3_3_2.msi
  ██████████████████████████████  5.42 MB / 5.42 MB
Successfully verified installer hash
Starting package install...
Successfully installed

Then ran the Quaternion executable again and it launched fine.

Out of curiosity I then ran:

PS C:\Windows\System32> winget find quaternion
Name                     Id                     Version  Source
-----------------------------------------------------------------
Quaternion Visualization 9P75ZTFZ2QJJ           Unknown  msstore
Quaternion               quotient-im.Quaternion 0.0.95.1 winget

And surprisingly Quaternion is published on WinGet as well.

So then to further test things I ran:

PS C:\Windows\System32> winget uninstall ShiningLight.OpenSSL.Light
Found OpenSSL Light 3.3.2 (64-bit) [ShiningLight.OpenSSL.Light]
Starting package uninstall...
Successfully uninstalled

And yet the executable downloaded from releases still launched fine after now uninstalling the OpenSSL package. Weird for sure.

Then I ran:

PS C:\Windows\System32> winget install quotient-im.Quaternion
Found Quaternion [quotient-im.Quaternion] Version 0.0.95.1
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
This package requires the following dependencies:
  - Packages
      Microsoft.VCRedist.2015+.x64
Downloading https://github.com/quotient-im/Quaternion/releases/download/0.0.95.1/quaternion-0.0.95.1-win64.zip
  ██████████████████████████████  53.2 MB / 53.2 MB
Successfully verified installer hash
Extracting archive...
Successfully extracted archive
Starting package install...
Command line alias added: "quaternion"
Path environment variable modified; restart your shell to use the new value.
Successfully installed

Which seems to have installed Quaternion from WinGet, except when trying to run it — it complains at missing QT libraries.

To summarize:
Is it fair to say that "there's no established package management on Windows to resolve dependencies"? Would you not be able to set QT and OpenSSL packages as requirements in your published Quaternion WinGet package? Is that capability not offered?

[KitsuneRal]

First off, sorry for taking time to respond.

I did not publish the WinGet package. I actually didn't even know what WinGet is until this moment - I haven't had Windows around for more than 5 years by now. Seeing that the Quaternion WinGet package is merely a wrapper around the zip I publish, I venture guessing that your problem with running it is due to the fact that Quaternion needs to be run from the directory it was installed to because that's where Qt libraries reside as well. Perhaps that "command line alias" mentioned in the installation output has to change the directory before running the real thing - I don't know. The packager didn't really test their work, and didn't read my README either, apparently.

If you want constructive discussion - it would be great if someone took on Quaternion distribution on Windows. For one, there used to be a Chocolatey package, it got orphaned, and it still remains as yet. This WinGet package you found is very old and not even quite functional, leading me to believe it's not maintained well (if at all). Feel free to pick either up. I'm happy to help with what I know and can but as I said - I have no idea what happens with Windows ecosystem these days.

As for whether the statement in the README is (still) fair - from what I could gather, there's no real dependency management in WinGet. They have two OpenSSL packages but I don't see any package requiring OpenSSL; those who need it seem to drag it along. I don't see Qt packaged at all; projects like qutebrowser or qBitTorrent or even Quaternion, similarly, carry it along instead. Which means: if/when there's a security vulnerability in Qt, it takes repackaging of all projects that include it, and of course a bigger half of packages will be left unpatched. The only dependencies specified seem to be to those VCRedist packages. Overall, this doesn't look like real dependency management, so I think my statement still holds.

[Erquint]

That seems to answer my question handily. Except leaves me wondering if WinGet's OpenSSL uninstaller left giblets about.
Sadly, I am not going to be volunteering to maintain a WinGet package myself as I am terrible at maintainership.
Unless it can be fully automated, but that's something I'm not ready to look into at the moment.