build(win): idempotent setup script + verified vendor manifest; real installer build
The Windows CI/CD story is now one idempotent script that both local dev and
GitHub Actions run, so they cannot drift.
scripts/setup-build-env.ps1:
- idempotent: skips anything already present/valid; safe to re-run (verified
no-op on second run)
- Go toolchain: pinned 1.22.2, user-space zip extract, no admin; accepts >= 1.22
- Inno Setup: pinned 7.0.2 from jrsoftware GitHub release, per-user install
(/CURRENTUSER, no admin), sha256-verified installer
- vendor assets: fetches WireGuard MSI, VC++ redist, OpenCredential CP into
installer/windows/vendor/ and verifies each against the pinned manifest;
writes .sha256 sidecars
- -Build: builds agent/tray/helper for windows amd64+arm64, runs go test, and
compiles the installer; -CI: fail loudly for workflows
installer/windows/vendor-manifest.json: pinned urls + sha256 for all three
third-party assets and the toolchain; nothing large is committed to git
(installer/windows/vendor/ is gitignored).
installer/windows/installer.iss: bundle + silently install the real
OpenCredential installer (Inno-built -> /VERYSILENT) and read /SERVER_URL and
/JOIN_KEY via {param:...}; validated by compiling with Inno Setup 7.0.2.
.github/workflows/build-windows.yml now delegates the entire build to the script
(setup-go + setup-build-env.ps1 -SkipGo -Build -CI), then hashes, optionally
signs with Azure Trusted Signing, attaches to the release, and publishes to the
SSO resource tree.
Built locally: dist/theta-agent-2.1.0-windows-amd64-setup.exe (63MB fully
offline bundle) plus windows amd64/arm64 agent, tray, and helper, all verified.
This commit is contained in:
@@ -58,15 +58,14 @@ Source: "{#AgentDir}\theta-agent-windows-amd64.exe"; DestDir: "{app}"; Flags: ig
|
||||
Source: "{#AgentDir}\theta-agent-tray-windows-amd64.exe"; DestDir: "{app}\tray"; Flags: ignoreversion
|
||||
Source: "{#AgentDir}\theta-agent-helper-windows-amd64.exe"; DestDir: "{app}"; Flags: ignoreversion
|
||||
|
||||
; WireGuard for Windows — official, vendor-signed MSI. Install happens offline
|
||||
; (the driver is signed; no signature phone-home).
|
||||
; WireGuard for Windows — official, vendor-signed MSI. Installs offline (the
|
||||
; driver is signed; no signature phone-home).
|
||||
Source: "{#VendorDir}\wireguard-amd64-0.5.3.msi"; DestDir: "{app}\vendor"; Flags: ignoreversion
|
||||
Source: "{#VendorDir}\wireguard-amd64-0.5.3.msi.sha256"; DestDir: "{app}\vendor"; Flags: ignoreversion
|
||||
|
||||
; OpenCredential credential provider (BSD-3 pGina fork) + VC++ runtime it needs.
|
||||
Source: "{#VendorDir}\OpenCredential\*"; DestDir: "{app}\OpenCredential"; Flags: ignoreversion recursesubdirs
|
||||
; OpenCredential credential provider installer (BSD-3 pGina fork) + the VC++
|
||||
; runtime it needs. Both install silently at [Run].
|
||||
Source: "{#VendorDir}\OpenCredentialInstaller-1.0.0.0.exe"; DestDir: "{app}\vendor"; Flags: ignoreversion
|
||||
Source: "{#VendorDir}\vc_redist.x64.exe"; DestDir: "{app}\vendor"; Flags: ignoreversion
|
||||
Source: "{#VendorDir}\vc_redist.x64.exe.sha256"; DestDir: "{app}\vendor"; Flags: ignoreversion
|
||||
|
||||
[Registry]
|
||||
; Start the tray for every interactive logon.
|
||||
@@ -75,23 +74,33 @@ Root: HKLM; Subkey: "Software\Microsoft\Windows\CurrentVersion\Run"; ValueType:
|
||||
[Run]
|
||||
; VC++ v14 runtime (OpenCredential native deps).
|
||||
Filename: "{app}\vendor\vc_redist.x64.exe"; Parameters: "/install /quiet /norestart"; StatusMsg: "Installing VC++ runtime..."; Flags: runhidden waituntilterminated
|
||||
; OpenCredential credential provider — must be registered before logon.
|
||||
Filename: "{app}\vendor\OpenCredentialInstaller-1.0.0.0.exe"; Parameters: "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART"; StatusMsg: "Installing OpenCredential credential provider..."; Flags: runhidden waituntilterminated
|
||||
; WireGuard for Windows client.
|
||||
Filename: "msiexec.exe"; Parameters: "/i ""{app}\vendor\wireguard-amd64-0.5.3.msi"" /qn /norestart"; StatusMsg: "Installing WireGuard client..."; Flags: runhidden waituntilterminated
|
||||
; Register the agent as a SYSTEM auto-start service.
|
||||
Filename: "{app}\{#MyAppExeName}"; Parameters: "install-service"; StatusMsg: "Registering theta-agent service..."; Flags: runhidden waituntilterminated
|
||||
; Credential provider registration + agent.yml are handled in [Code] so we can
|
||||
; feed SERVER_URL/JOIN_KEY in and sequence the CP install before logon.
|
||||
Filename: "{app}\OpenCredential\OpenCredentialInstaller.exe"; Parameters: "/S"; StatusMsg: "Installing OpenCredential credential provider..."; Flags: runhidden waituntilterminated skipifsilent
|
||||
|
||||
[Code]
|
||||
var
|
||||
ServerURL: String;
|
||||
JoinKey: String;
|
||||
|
||||
// Reads a custom setup command-line parameter (e.g. /SERVER_URL=https://...).
|
||||
// {param:...} raises when the parameter is absent, so the exception becomes "".
|
||||
function GetCmdParam(const Name: String): String;
|
||||
begin
|
||||
try
|
||||
Result := ExpandConstant('{param:' + Name + '}');
|
||||
except
|
||||
Result := '';
|
||||
end;
|
||||
end;
|
||||
|
||||
function InitializeSetup(): Boolean;
|
||||
begin
|
||||
ServerURL := GetCmdLineParam('/SERVER_URL', '');
|
||||
JoinKey := GetCmdLineParam('/JOIN_KEY', '');
|
||||
ServerURL := GetCmdParam('SERVER_URL');
|
||||
JoinKey := GetCmdParam('JOIN_KEY');
|
||||
Result := True;
|
||||
end;
|
||||
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
{
|
||||
"comment": "Pinned third-party assets bundled into the Windows installer (DESIGN-WINDOWS.md §8). The setup script (scripts/setup-build-env.ps1) fetches these into installer/windows/vendor/ and verifies sha256; nothing is committed to git.",
|
||||
"assets": [
|
||||
{
|
||||
"name": "wireguard-amd64-0.5.3.msi",
|
||||
"url": "https://download.wireguard.com/windows-client/wireguard-amd64-0.5.3.msi",
|
||||
"sha256": "76FCEC042C5989C5B816CD32EAED1E5B1C3B998A4B1C9ECA55F299E3314EF7E4",
|
||||
"purpose": "Official WireGuard for Windows client (vendor-signed drivers install offline)"
|
||||
},
|
||||
{
|
||||
"name": "vc_redist.x64.exe",
|
||||
"url": "https://aka.ms/vs/17/release/vc_redist.x64.exe",
|
||||
"sha256": "CC0FF0EB1DC3F5188AE6300FAEF32BF5BEEBA4BDD6E8E445A9184072096B713B",
|
||||
"purpose": "VC++ v14 runtime required by the OpenCredential credential provider"
|
||||
},
|
||||
{
|
||||
"name": "OpenCredentialInstaller-1.0.0.0.exe",
|
||||
"url": "https://github.com/pedropablobm/OpenCredential/releases/download/v1.0.0.0/OpenCredentialInstaller-1.0.0.0.exe",
|
||||
"sha256": "7687A99F0B3D6E910BBFB883C31231EB8C8F6E4439134CC3522A86CC63DA1A52",
|
||||
"purpose": "OpenCredential (BSD-3 pGina fork) credential provider installer — LDAP-backed Windows logon"
|
||||
}
|
||||
],
|
||||
"toolchain": {
|
||||
"go": {
|
||||
"version": "1.22.2",
|
||||
"url": "https://go.dev/dl/go1.22.2.windows-amd64.zip"
|
||||
},
|
||||
"inno": {
|
||||
"version": "7.0.2",
|
||||
"url": "https://github.com/jrsoftware/issrc/releases/download/is-7_0_2/innosetup-7.0.2-x64.exe",
|
||||
"sha256": "5AD54CA3DEF786F8F4212552E54CC6D8D61329E2D24A1CFEE0571D42C2684FF1"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user