[Geoserver-devel] Interesting discovery about windows installer

Andrea_Aime4 · August 15, 2014, 9:13am

Hi,
this morning I was playing with the windows installer stuff and I’ve noticed something
probably important: the 2.6-beta installer does not work due to permission issues
on my win7 vm, but if I build the installer using a recent NSIS, with the AccessControl
plugin, and following the instructions for the win-ng installer
(http://docs.geoserver.org/2.0.0/developer/release-guide/index.html#build-windows-installer-new)
then that works fine and I have full write access, using the scripts and materials
found here:

https://github.com/geoserver/geoserver/tree/master/src/release/installer/win

As noted in a separate thread, I indeed found some lines in the nsis installer
script that are apparently giving full write rights to the install folder.

I am wondering… may it be the case that maybe the windows build server generating the
windows installer is using a old version of nsis or a old version of the nsis script?

For reference, and for those that want to try it out, here is the windows installer
I’ve build following the old release instructions linked above:
https://dl.dropboxusercontent.com/u/2361103/geoserver-2.5-SNAPSHOT.exe

Cheers
Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

Andrea_Aime4 · August 15, 2014, 9:40am

Here is an updated installer based on conversations with Jukka:
https://dl.dropboxusercontent.com/u/2361103/geoserver-2.6-SNAPSHOT.exe

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

Justin_Deoliveira · August 15, 2014, 1:33pm

I just checked the server and it is using version 2.4.6 of NSIS. It also looks to be using the right script… i checked the git checkout and it was recent as of July 22 when the beta release was built.

···

On Fri, Aug 15, 2014 at 3:13 AM, Andrea Aime <andrea.aime@anonymised.com> wrote:

Hi,
this morning I was playing with the windows installer stuff and I’ve noticed something
probably important: the 2.6-beta installer does not work due to permission issues
on my win7 vm, but if I build the installer using a recent NSIS, with the AccessControl
plugin, and following the instructions for the win-ng installer
(http://docs.geoserver.org/2.0.0/developer/release-guide/index.html#build-windows-installer-new)
then that works fine and I have full write access, using the scripts and materials
found here:

https://github.com/geoserver/geoserver/tree/master/src/release/installer/win

As noted in a separate thread, I indeed found some lines in the nsis installer
script that are apparently giving full write rights to the install folder.

I am wondering… may it be the case that maybe the windows build server generating the
windows installer is using a old version of nsis or a old version of the nsis script?

For reference, and for those that want to try it out, here is the windows installer
I’ve build following the old release instructions linked above:
https://dl.dropboxusercontent.com/u/2361103/geoserver-2.5-SNAPSHOT.exe

Cheers
Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

Geoserver-devel mailing list
Geoserver-devel@anonymised.comt
https://lists.sourceforge.net/lists/listinfo/geoserver-devel

–

Justin Deoliveira
VP Engineering | Boundless
jdeolive@anonymised.com
@boundlessgeo

Andrea_Aime4 · August 15, 2014, 3:03pm

On Fri, Aug 15, 2014 at 3:33 PM, Justin Deoliveira <
jdeolive@anonymised.com> wrote:

I just checked the server and it is using version 2.4.6 of NSIS. It also
looks to be using the right script... i checked the git checkout and it was
recent as of July 22 when the beta release was built.

I have been using 2.4.6 as well, but I believe there might be a significant
difference,
the access control plugin I'm using is version 1.0.8.1, released July 2014.

For reference, here is the (recent) changelog entries:

MODIFICATIONS
-------------

v1.0.8.1 - 7th July 2014 - AndersK
* Don't require SE_RESTORE_NAME and SE_TAKE_OWNERSHIP_NAME when changing
owner.
* Fixed broken return value when trustee parsing failed

v1.0.8.0 - 24th March 2014 - AndersK
* Added basic String SID parsing in the emulated ConvertStringSidToSid
(Broken in v1.0.6)
* Fixed WinNT4 and Win95 support? (Unicode DLL will not load on Win95 but
will probably load on Win98)
* Fixed leaks from ParseSid and ConvertSidToStringSid
* NameToSid and SidToName now pushes "error" and error details
* Better GetCurrentUserName error handling (Still returns the problematic
"error" string)

v1.0.7.0 - 25th February 2012 - Afrow UK
* Fixed DisableFileInheritance (broken in v1.0.5.0).

v1.0.6.0 - 26th January 2012 - Afrow UK
* Wrote replacements for ConvertSidToStringSid/ConvertStringSidToSid for
backwards compatibility with Windows NT4/ME (ANSI build only).
* Loads RegSetKeySecurity/RegGetKeySecurity functions at run-time for
backwards compatibility with Windows NT4/ME (ANSI build only).
* Removed commented out legacy code.

v1.0.5.0 - 25th January 2012 - Afrow UK
* Removed IsUserTheAdministrator.
* Added NameToSid.
* Major code cleanup/rewrite.
* Proper Unicode build (with Unicode plugin API).
* Support for 64-bit registry (SetRegView 64).
* Functions now return "ok" on success or "error" otherwise. On "error",
the next item on the stack will be the error description.
* Added version information resource.

23rd January 2008 - Afrow UK
* Added function IsUserTheAdministrator.
* Cleaned up code. Rebuilt as pure cpp, decreasing DLL size.
* No longer using gobal temp variable for strings.

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

Jukka_Rahkonen · August 15, 2014, 3:39pm

Hi,

This one makes a successful installation with default settings into Program Files (x86) on my home computer. It does not create shortcuts into start menu if installer is started as normal user. If I log in as admin and run installer then the shortcuts are created.

-Jukka-

···

Here is an updated installer based on conversations with Jukka:
https://dl.dropboxusercontent.com/u/2361103/geoserver-2.6-SNAPSHOT.exe

Cheers
Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

Andrea_Aime4 · August 15, 2014, 4:33pm

On Fri, Aug 15, 2014 at 5:39 PM, Rahkonen Jukka (Tike) <
jukka.rahkonen@anonymised.com> wrote:

Hi,

This one makes a successful installation with default settings into
Program Files (x86) on my home computer. It does not create shortcuts into
start menu if installer is started as normal user. If I log in as admin and
run installer then the shortcuts are created.

I cannot do tests right now, but did you have to become the admin to run
the installer?
Maybe it has created the shortcuts for the admin, and not for your current
user

Wondering if asking it to create menu entries for all users would be
appropriate...

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

Chris_Snider · August 15, 2014, 4:49pm

Typically on Windows, Vista, 7, 8 and the Server editions, you have to be running the installers with an Admin account. These are to protect the system from unauthorized changes. Part of the security hardening added several years ago. If the current user is in the administrative group, then a pop-up asks if they would like to authorize the changes. If the user is NOT in the administrative group, then a pop-up asks for the username/password for an administrative user. If either of these fail, then the changes are not authorized and should roll back.

It is up to the installers to allow the installing user to decide if they want to install “for all users” or “for current user”.

Chris Snider

Senior Software Engineer

Intelligent Software Solutions, Inc.

(attachments)

···

On Fri, Aug 15, 2014 at 5:39 PM, Rahkonen Jukka (Tike) <jukka.rahkonen@…1245…> wrote:

Hi,

This one makes a successful installation with default settings into Program Files (x86) on my home computer. It does not create shortcuts into start menu if installer is started as normal user. If I log in as admin and run installer then the shortcuts are created.

I cannot do tests right now, but did you have to become the admin to run the installer?

Maybe it has created the shortcuts for the admin, and not for your current user

Wondering if asking it to create menu entries for all users would be appropriate…

Cheers

Andrea

–

==

GeoServer Professional Services from the experts! Visit

http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf

Technical Lead

GeoSolutions S.A.S.

Via Poggio alle Viti 1187

55054 Massarosa (LU)

Italy

phone: +39 0584 962313

fax: +39 0584 1660272

mob: +39 339 8844549

http://www.geo-solutions.it

http://twitter.com/geosolutions_it

Andrea_Aime4 · August 15, 2014, 5:03pm

On Fri, Aug 15, 2014 at 6:49 PM, Chris Snider <chris.snider@anonymised.com>
wrote:

Typically on Windows, Vista, 7, 8 and the Server editions, you have to
be running the installers with an Admin account. These are to protect the
system from unauthorized changes. Part of the security hardening added
several years ago. If the current user is in the administrative group,
then a pop-up asks if they would like to authorize the changes. If the
user is NOT in the administrative group, then a pop-up asks for the
username/password for an administrative user. If either of these fail,
then the changes are not authorized and should roll back.

It is up to the installers to allow the installing user to decide if they
want to install “for all users” or “for current user”.

Hum... then do you have any clue about the report from Jukka that the
program is installed, but the menu entries won't show up?
We need someone with windows experience to help with this one.

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

Chris_Snider · August 15, 2014, 5:05pm

Jukka,

When running this installer as “normal user”, does the installer ask you for permission execute the installer? Do you get any prompts from the installer about allowing the change?

(attachments)

···

Chris Snider

Senior Software Engineer

Intelligent Software Solutions, Inc.

From: Rahkonen Jukka (Tike) [mailto:jukka.rahkonen@anonymised.com]
Sent: Friday, August 15, 2014 9:40 AM
To: Geoserver-devel
Subject: Re: [Geoserver-devel] Interesting discovery about windows installer

Hi,

This one makes a successful installation with default settings into Program Files (x86) on my home computer. It does not create shortcuts into start menu if installer is started as normal user. If I log in as admin and run installer then the shortcuts are created.

-Jukka-

Andrea Aime wrote:

Here is an updated installer based on conversations with Jukka:

https://dl.dropboxusercontent.com/u/2361103/geoserver-2.6-SNAPSHOT.exe

Cheers

Andrea

–

==

GeoServer Professional Services from the experts! Visit

http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf

Technical Lead

GeoSolutions S.A.S.

Via Poggio alle Viti 1187

55054 Massarosa (LU)

Italy

phone: +39 0584 962313

fax: +39 0584 1660272

mob: +39 339 8844549

http://www.geo-solutions.it

http://twitter.com/geosolutions_it

jive · August 15, 2014, 6:43pm

My understanding was Jukka had limited permissions, and when installing the short cuts were not added to the ‘all users’ folder. Does the NSIS installer offer an option to install for all users, or is that something we have to enable…

···

Jody Garnett

On Fri, Aug 15, 2014 at 10:03 AM, Andrea Aime <andrea.aime@anonymised.com> wrote:

Geoserver-devel mailing list
Geoserver-devel@anonymised.comsts.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel

On Fri, Aug 15, 2014 at 6:49 PM, Chris Snider <chris.snider@anonymised.com> wrote:

Typically on Windows, Vista, 7, 8 and the Server editions, you have to be running the installers with an Admin account. These are to protect the system from unauthorized changes. Part of the security hardening added several years ago. If the current user is in the administrative group, then a pop-up asks if they would like to authorize the changes. If the user is NOT in the administrative group, then a pop-up asks for the username/password for an administrative user. If either of these fail, then the changes are not authorized and should roll back.

It is up to the installers to allow the installing user to decide if they want to install “for all users” or “for current user”.

Hum… then do you have any clue about the report from Jukka that the program is installed, but the menu entries won’t show up?
We need someone with windows experience to help with this one.

Cheers

Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

jive · August 15, 2014, 6:47pm

To answer my own question, NSIS can support[1] the all users (or common folder).

From stack overflow:

SetShellVarContext all
CreateShortcut “$desktop\myapp.lnk” “$instdir\myapp.exe”

Details from the manual:

···

Jody Garnett

On Fri, Aug 15, 2014 at 11:43 AM, Jody Garnett <jody.garnett@anonymised.com> wrote:

My understanding was Jukka had limited permissions, and when installing the short cuts were not added to the ‘all users’ folder. Does the NSIS installer offer an option to install for all users, or is that something we have to enable…

Jody Garnett

On Fri, Aug 15, 2014 at 10:03 AM, Andrea Aime <andrea.aime@anonymised.com> wrote:

Geoserver-devel mailing list
Geoserver-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel

On Fri, Aug 15, 2014 at 6:49 PM, Chris Snider <chris.snider@anonymised.com…> wrote:

Typically on Windows, Vista, 7, 8 and the Server editions, you have to be running the installers with an Admin account. These are to protect the system from unauthorized changes. Part of the security hardening added several years ago. If the current user is in the administrative group, then a pop-up asks if they would like to authorize the changes. If the user is NOT in the administrative group, then a pop-up asks for the username/password for an administrative user. If either of these fail, then the changes are not authorized and should roll back.

It is up to the installers to allow the installing user to decide if they want to install “for all users” or “for current user”.

Hum… then do you have any clue about the report from Jukka that the program is installed, but the menu entries won’t show up?
We need someone with windows experience to help with this one.

Cheers

Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it