Joy of Setup – Bob Arnson on setup and servicing with WiX and MSI

5 May 20175 May 2017

WiX v3.11 released

On Cinco de Mayo 2017, we released WiX v3.11. WiX v3.11 RTM is v3.11.0.1701.

You can download the WiX Toolset v3.11 build tools and Visual Studio extensions here.

The primary goal of the WiX v3.11 development cycle was to support Visual Studio 2017. We met that goal, with more than the usual number of challenges, due to the scope of changes in Visual Studio 2017.

In previous versions of WiX v3.x, Votive, the Visual Studio extension for WiX, was part of the WiX installer. Due to Visual Studio 2017’s changes to support multiple instances, WiX v3.11 now comes in two parts:

The WiX build tools, MSBuild support, extensions, and SDKs. These are delivered in the WiX v3.11 bundle.
The Visual Studio extension, one for each supported version of Visual Studio (2010, 2012, 2013, 2015, and 2017). These are available from the Visual Studio Marketplace.

Plenty of other stuff happened in the WiX v3.11 cycle, too. For details on bug fixes, new features, and other changes, please see the release notes on GitHub.

Rob also wrote about the WiX v3.11 release, if you’d like other words on the topic.

4 July 20165 July 2016

WiX v3.10.3 released

On 4 July 2016, the 240th anniversary of the approval and publication of the United States Declaration of Independence, the Juno spacecraft is scheduled to enter polar orbit around Jupiter and WiX v3.10.3 was released.

WiX v3.10.3 contains fixes for the regressions introduced in WiX v3.10.2 by the “clean room” technique that mitigates against Windows vulnerabilities that affect bundle executables.

Download WiX v3.10.3.

The following bugs were fixed:

layout: Default directory broken with clean room implementation. #5193 with fix by @jchoover
WiX 3.10.1 failing to update to 3.10.2 #5234 with fix by @rseanhall
New bootstrapper fails to run when performing an UpdateReplace #5238 with fix by @rseanhall
Layout to custom directory doesn’t copy bundle payload #5277 with fix by @res2k
System.ArgumentException: Font ‘?’ cannot be found. In the BootstapperApplication #5282 with fix by @robmen
Regression in attached container issues in clean room #5301 with fix by @rseanhall
Extra argument in burn command line #5302 with fix by @rseanhall
Custom burn application throws exception when accessing .NET dll when uninstalling #5308 with fix by @rseanhall

Universe willing, WiX v3.10.3 is the final release of the WiX v3.10 series. Up next is WiX v3.11.

Rob also had words on this release.

20 January 201620 January 2016

WiX v3.10.2 released

An unpleasant first: We had to release a security update for the WiX Toolset. Here’s the recipe:

1 serving of DLL hijacking–a really bad Windows vulnerability because Windows first searches the directory an .exe comes from for any DLLs it needs.
1 serving of drive-by downloading–the ability for evil Web sites to download DLLs to the same directory non-evil sites download your delicious bundles.

That’s it, really. Bake and serve and suddenly every executable is potentially a carrier for malware.

WiX v3.10.2 contains mitigations for Burn that avoid the vulnerability. If you ship bundles, you really really need to upgrade to v3.10.2 so you can ship safe bundles.

More details about the release are available in the Setup Matters blog post I wrote.

Download WiX v3.10.2 here.

31 October 2015

WiX Toolset v3.10.1 Released

WiX v3.10.1 is a maintenance release of WiX v3.10 with the following important fixes:

@barnson implemented a workaround for a Visual Studio 2015 issue that caused certain WiX standard custom actions to fail when run on Windows XP and Windows Server 2003. Bug 4902|Bug 4908
@jchoover fixed a bug that prevented some attributes of the WixStandardBootstrapperApplication element from functioning correctly. Bug 4899
@PavelAnfimov fixed a bug that prevented hyperlinks in WixStdBA from working on Windows XP and Windows Server 2003. Bug 4772

Download it here.

As you can see, we had a couple of problems with Windows XP support. Though I ran a few manual tests on XP during and at the end of v3.10, that wasn’t sufficient to uncover the bugs. Next time, I’ll put out an explicit call for testing support from folks still supporting Windows XP and Windows Server 2003. We’re going to need your help to keep bitrot at bay!

Here’s what Rob had to say about this release.

7 September 20155 November 2015

WiX Toolset v3.10 released

Update: WiX v3.10.1 has been released.

As planned, WiX v3.10 was released on (American) Labor Day. The RTM build is v3.10.0.2103.

Download it here.

Update: Rob also had words about WiX v3.10.

Contributors

Highlights

@barnson added support for Visual Studio 2015 in the WiX build, native SDK libraries, and Votive. [pull request] [pull request] [pull request] [pull request] [issue] [pull request] [pull request] [pull request] [pull request]
@heaths added Visual Studio 2015 detection properties. [pull request] [pull request]
@barnson added .NET Framework 4.6 support. [issue] [pull request]
[issue] [pull request] [pull request] [pull request]
@firegiantco added support for ISO/IEC 19770-2:2015 software id tags. [issue] [pull request] [issue] [pull request] [issue] [pull request]

Burn and WixStdBA

@barnson restored the SWAPRUN bits to the Burn stub. [issue] [pull request]
@to-pse fixed Burn logging when it’s disabled. [issue] [pull request]
@heaths added logging around registration and hash mismatches. [pull request] [pull request]
@barnson fixed some Burn variables. [issue] [pull request]
@to-pse added support for setting variables from theme pages in WixStdBA. [issue] [pull request]
@jchoover fixed a WixStdBA doc bug. [issue] [pull request]
@rseanhall fixed bugs in pre-req handling in WixStdBA. [issue] [pull request] [issue] [pull request]
@bmurri added support for LaunchWorkingFolder variable for controlling the working directory for LaunchTarget support. [issue] [pull request]
@pavelanfimov added support for distinct success and failure messages for different actions. [issue] [pull request]
@barnson fixed a crash that occurred building bundles with five-field version numbers. [issue] [pull request] [pull request]
@rseanhall added support in WixStdBA to load edit boxes from identically-named Burn variables. [issue] [pull request]
@rseanhall added support in WixStdBA to format the close-confirmation localization string, so it can reference Burn variables. [issue] [pull request]
@rseanhall fixed some bugs in managed-BA hosting. [issue] [pull request] [issue] [pull request]
@rseanhall fixed hidden variables. [issue] [pull request]
@rseanhall fixed BOOTSTRAPPER_REQUEST_STATE_CACHE. [issue] [pull request]
@barnson added WixStdBALanguageId Burn variable. [pull request]
@rseanhall fixed some Burn variables that weren’t available from the elevated Burn process. [issue] [pull request] [pull request]
@rseanhall made the WixBundleManufacturer variable writeable. [issue] [pull request]
@rseanhall obfuscated hidden variable values in logging. [issue] [pull request]
@jchoover fixed a bug that left a temporary file behind. [issue] [pull request]
@barnson fixed some Burn and WixStdBA doc bugs. [issue] [pull request] [issue] [pull request] [issue] [pull request]
@barnson added ExePackage/CommandLine to support conditional command-line arguments. [issue] [pull request]
@barnson made sure that pre-v3.10 .wxl files work with v3.10 WixStdBA themes. [issue] [pull request] [issue] [pull request]
@barnson prevented an elevated bundle from launching elevated hyperlinks. [issue] [pull request]
@rseanhall added literal string variables for built-in variables that might contain brackets. [issue] [pull request]
@heaths prevents Burn from downloading payloads that already exist in a layout. [issue] [pull request]
@creativbox added “files in use” to WixStdBA. [issue] [pull request]
@heaths makes sure WixBundleOriginalSourceFolder is set. [pull request]
@heaths added support for a top-level cache action. [pull request]
@robmen fixed a bug with COM initialization. [issue] [pull request]
@barnson added logging around potentially time-consuming external activities. [pull request]

Core toolset

@heaths added support for building empty patch transforms. [pull request]
@barnson added support for minimal-verbosity logging in MSBuild targets. [pull request]
@barnson added clarifying documentation. [issue] [pull request] [issue] [pull request]
@jmcooper8654 clarified an error message. [issue] [pull request]
@robmen fixed some documentation links. [pull request]
@cnadeau clarified ServiceInstall documentation. [pull request]
@bmurri prevents contradictory InstallPrivileges and InstallScope values. [issue] [pull request]

Extensions

@rseanhall added WixHttpExtension to take advantage of the Windows HTTP Server API. [issue] [pull request] [pull request] [pull request]
@phillhgl added support for adding privileges to properly register a resource using RestartResource. [issue] [pull request]
@vetrivelc fixed a duplicated hotkey in WixUI for nl-NL localization. [pull request]
@barnson fixed the RegisterPerfmonManifest custom action. [issue] [pull request]
@rseanhall fixed a bug that prevented FileShare from sharing out the root of a drive. [issue] [pull request]
@norberthd added support for a port range in a firewall exception. [issue] [pull request]
@barnson added support for “OR LATER” detection of .NET Framework. [issue] [pull request]
@barnson added WixBroadcastSettingChange custom action. [pull request]
@barnson added some WixNetfxExtension documentation. [issue] [pull request] [issue] [pull request]
@barnson fixed the Install button in WixUI for de-DE localization. [issue] [pull request]
@firegiantco added a quiet-execution custom action that is also silent—that is, that doesn’t log input or output. [pull request]
@barnson added bind-time variables to allow tweaking some .NET Framework package conditions and paths. [issue] [pull request]
@amoravec made UriProtocol case-insensitive. [issue] [pull request]

Libraries

@heaths made the DUtil error-checking macros variadic so developers no longer have to think about how many arguments they want in their message beforehand. [pull request]
@rseanhall fixed some ThmUtil bugs. [issue] [pull request]
@barnson fixed function return types in XmlUtil. [issue] [pull request]
@barnson fixed wcsistr calling convention. [issue] [pull request]
@mike-gc fixed a breaking change made earlier.
[issue] [pull request]

Infrastructure

@rseanhall updated the build to use the latest Sandcastle help-build tool and to acquire it via NuGet. [issue]
@robmen added an error message that detects when strong-name verification skipping hasn’t been set up for a developer build. [pull request]
@rseanhall made maintaining history easier by merging individual history messages into the master history.md. [pull request] [pull request]
@robmen fixed an error message. [issue] [pull request]
@heaths added support for the Windows 10 SDK. [pull request]

And the rest

@dwickern fixed Heat to escape special characters Heat generates. [issue] [pull request]
@barnson fixed some bugs in Lux. [issue] [pull request]
@stunney added support for the Binary and Icon tables to the Melt tool for patching. [issue] [pull request]
@barnson fixed a couple of Votive bugs. [issue] [pull request] [issue] [pull request]
@rseanhall made the regular expressions in wix.xsd XSD-legal. [issue] [pull request]
@jozefizso fixed a typo. [pull request]
@rseanhall fixed some bugs in Heat for tools versions 12.0 and 14.0. [issue] [pull request] [issue] [pull request]
@jchoover fixed some bugs in the WiX bundle’s bootstrapper application. [issue] [pull request] [issue] [pull request]
@stunney added validation in Melt to make sure an .msi and .wixpdb match. [issue] [pull request]
@lakmus85 changed Votive to support OutputName with embedded properties. [issue] [pull request]