What are the rules surrounding third-party builds and forks with the same name?

[gamer191]

Many users use package names instead of package IDs. Doing so means that the user isn't specifying which author they want the package from.

For some packages (eg gyan.ffmpeg) it makes sense to use third-party builds, because there are no first-party builds available. However, for most packages there are first-party builds, so I'm curious whether this repo would accept third-party packages (with a different package ID)? What about forks that add new features but don't change the package name?
Also, if a fork changed the package name to something like ffmpeg+ or ffmpeg-plus, would there by a risk of it being downloaded if --exact isn't used?

Basically, is running winget install --source winget PROGRAMNAME safe, or do I need to also use --exact and --id?

[denelon]

https://learn.microsoft.com/windows/package-manager/package/windows-package-manager-policies

The only way to guarantee you're getting the exact package you want is to use the exact package identifier. WinGet does attempt to be more convenient to use by way of tags, moniker, etc., but those are just conveniences.

It's not a good idea to add forked projects without changing the metadata written to the Windows registry in a meaningful way. Otherwise, users would end up getting the wrong package installed, and they would be sad.