build windows msi for arm and amd #1796

James-Pickett · 2024-07-24T23:06:13Z

This PR updates package builder to add an arm64 binaries and service config to the MSI. This is done putting both of 2 services / binaries in to the MSI with mutually exclusive conditions based on processor architecture.

To accomplish we are using heat to harvest files set up like ...

└───pkg_root
    └───Launcher-kolide-k2
        ├───bin
        │   ├───amd64
        │   │       launcher.exe
        │   │       osqueryd.exe
        │   │
        │   └───arm64
        │           launcher.exe
        │           osqueryd.exe
        │
        └───conf
                ...

then post processing the generated xml to remove the amd64 and arm64 directory tags so that all the exe files are in the same directory in the xml, then add the mutually exclusive tags to the binary elements

Additionally, the PR adds the windows service recovery settings to go code because the wix extension we were using for that is not compatible with this approach since it's primary key cannot be changed form the service name and would cause unique constraint error (now there are 2 in the MSI). The wix extension for recovery actions is still applied to the amd install.

relates to #1149

pkg/packagekit/wix/service.go

pkg/packaging/packaging.go

pkg/packagekit/wix/wix.go

pkg/packaging/detectLauncherVersion.go

pkg/packaging/packaging.go

RebeccaMahany · 2024-07-26T14:22:46Z

cmd/package-builder/package-builder.go

+			"launcher_arm_version",
+			env.String("LAUNCHER_ARM_VERSION", "stable"),
+			"What TUF channel to download launcher from for ARM. Supports filesystem paths",
+		)


Is this future-proofing in case we want to do more granular releases for launcher in the future (e.g. "bug in launcher version x.y.z on ARM only, so leave stable at x.y.z for all other arches and x.y.y for launcher ARM")? Or are we adding this flag for another reason?

I added this just so that I could specify a local arm build to package. I can't imagine a situation where we would want the arm and amd binaries to have different code.

This has me thinking though that maybe we should add in some safe guards to ensure the arm and amd versions are the same. If we some how managed to get into a situation where TUF updated one and not the other, we could end up with a package where different arches are on different versions.

I can't find a coherent way to verify the versions are the same. However, I set up the flag so that it's default is an empty string and it will just set that flag to what ever launcher_version is if no launcher_arm_version is provided.

I'm not sure there's a good way to validate a launcher version, without invoking it. Maaaybe we can string parse it, but I'm not sure it's worth it. (And given what Zack recently learned about file versions and MSIs, let's not go there...)

Maybe this is an argument for being less clever. Command line either takes launcher_version= and downloads from TUF (we should have enough metadata there to validate that stable is the same) Or use_local_binary=... and it ignores TUF

I guess that's kinda what would happen. So maybe I'm over thinking it. Maybe we validate the versions from tuf, and skip that validation on local paths.

invoking it could be troublesome since we'll have 2 binaries with to different arches, An arm64 machine will probably emulate the amd64 binary and run it, but the reverse doesn't work.

I think just having separate flags for paths is probably good with only a single option for launcher_version which is downloaded form tuf for both arches.

pkg/packagekit/wix/service.go

pkg/packagekit/wix/wix.go

pkg/packaging/packaging.go

… set

directionless

The cross platform stuff is really neat.

But I'm nervous about moving those restart things out.

cmd/launcher/svc_config_windows.go

directionless · 2024-07-27T00:41:36Z

cmd/package-builder/package-builder.go

+			"launcher_arm_version",
+			env.String("LAUNCHER_ARM_VERSION", "stable"),
+			"What TUF channel to download launcher from for ARM. Supports filesystem paths",
+		)


I'm not sure there's a good way to validate a launcher version, without invoking it. Maaaybe we can string parse it, but I'm not sure it's worth it. (And given what Zack recently learned about file versions and MSIs, let's not go there...)

Maybe this is an argument for being less clever. Command line either takes launcher_version= and downloads from TUF (we should have enough metadata there to validate that stable is the same) Or use_local_binary=... and it ignores TUF

directionless · 2024-07-27T00:42:06Z

cmd/package-builder/package-builder.go

+			"launcher_arm_version",
+			env.String("LAUNCHER_ARM_VERSION", "stable"),
+			"What TUF channel to download launcher from for ARM. Supports filesystem paths",
+		)


I guess that's kinda what would happen. So maybe I'm over thinking it. Maybe we validate the versions from tuf, and skip that validation on local paths.

directionless · 2024-07-27T00:56:05Z

Hrm. I kinda want to look at the XML. I know I never baked in something to save it. How do you think that would be to add?

James-Pickett · 2024-07-29T22:25:36Z

Hrm. I kinda want to look at the XML. I know I never baked in something to save it. How do you think that would be to add?

@directionless , there is a flag wix_skip_cleanup already there, I updated it so that it prints the paths to the temp files when clean up gets skipped

directionless · 2024-07-30T01:49:55Z

Hrm. I kinda want to look at the XML. I know I never baked in something to save it. How do you think that would be to add?

@directionless , there is a flag wix_skip_cleanup already there, I updated it so that it prints the paths to the temp files when clean up gets skipped

Can you attach one here?

James-Pickett · 2024-07-30T15:16:56Z

Hrm. I kinda want to look at the XML. I know I never baked in something to save it. How do you think that would be to add?

@directionless , there is a flag wix_skip_cleanup already there, I updated it so that it prints the paths to the temp files when clean up gets skipped

Can you attach one here?
@directionless

<?xml version="1.0" encoding="utf-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
    <Fragment>
        <DirectoryRef Id="PROGDIR">
            <Directory Id="dir9E2FF676320D7BE586E7569535A94904" Name="Launcher-kolide-k2">
                <Directory Id="dir8782311652F143EF6DD238714EB2C5A3" Name="bin">
                        <Component Id="cmpFDADA56D9962ABBCAA5F3803F3A0E022" Guid="84DB7147-05C9-49ED-ACBA-E6CA9AA3C070">
                            <File Id="fil604CDF77A839EF3F45370B06E0D217F0" KeyPath="yes" Source="$(var.SourceDir)\Launcher-kolide-k2\bin\amd64\launcher.exe" />
<Condition> %PROCESSOR_ARCHITECTURE="AMD64" </Condition>
                    <ServiceInstall Account="[SERVICEACCOUNT]" Arguments="svc -config &#34;C:\Program Files\Kolide\Launcher-kolide-k2\conf\launcher.flags&#34;" Description="The Kolide Launcher (kolide-k2)" ErrorControl="normal" Id="LauncherKolideK2Svc01J423A2NVBYJE6VWSZHZAYKK8" Name="LauncherKolideK2Svc" Start="auto" Type="ownProcess" Vital="yes">
                        <ServiceConfig xmlns="http://schemas.microsoft.com/wix/2006/wi" Id="LauncherKolideK2Svc01J423A2NVBYJE6VWSZHZAYKK8" DelayedAutoStart="no" OnInstall="yes" OnReinstall="yes"></ServiceConfig>
                        <ServiceDependency Id="Dnscache" Group="no"></ServiceDependency>
                    </ServiceInstall>
                    <ServiceControl Name="LauncherKolideK2Svc" Id="LauncherKolideK2Svc01J423A2NVBYJE6VWSZHZAYKK8" Remove="uninstall" Start="install" Stop="both" Wait="no"></ServiceControl>
                        </Component>
                        <Component Id="cmp2495C4D31241909F181B39921D2280C9" Guid="03B7DB5F-97AF-46B6-BBC1-C96B7ACEA8BB">
                            <File Id="fil526CC2960E9DEE23BDA92EE29CE5A6A4" KeyPath="yes" Source="$(var.SourceDir)\Launcher-kolide-k2\bin\amd64\osqueryd.exe" />
<Condition> %PROCESSOR_ARCHITECTURE="AMD64" </Condition>
                        </Component>
                        <Component Id="cmpABE14524530AA1F1CB8D6939D826DC32" Guid="F7854DA5-4627-44A8-841B-56BB03F37AB8">
                            <File Id="fil4EFEFF758D7317539AD8F04A59622E4B" KeyPath="yes" Source="$(var.SourceDir)\Launcher-kolide-k2\bin\arm64\launcher.exe" />
<Condition> %PROCESSOR_ARCHITECTURE="ARM64" </Condition>
                    <ServiceInstall Account="[SERVICEACCOUNT]" Arguments="svc -config &#34;C:\Program Files\Kolide\Launcher-kolide-k2\conf\launcher.flags&#34;" Description="The Kolide Launcher (kolide-k2)" ErrorControl="normal" Id="LauncherKolideK2Svc01J423A2NVESRWGYKH5D97DDP4" Name="LauncherKolideK2Svc" Start="auto" Type="ownProcess" Vital="yes">
                        <ServiceConfig xmlns="http://schemas.microsoft.com/wix/2006/wi" Id="LauncherKolideK2Svc01J423A2NVESRWGYKH5D97DDP4" DelayedAutoStart="no" OnInstall="yes" OnReinstall="yes"></ServiceConfig>
                        <ServiceDependency Id="Dnscache" Group="no"></ServiceDependency>
                    </ServiceInstall>
                    <ServiceControl Name="LauncherKolideK2Svc" Id="LauncherKolideK2Svc01J423A2NVESRWGYKH5D97DDP4" Remove="uninstall" Start="install" Stop="both" Wait="no"></ServiceControl>
                        </Component>
                        <Component Id="cmp61B74053A68DD7A35C953D86480F9D4C" Guid="BE7AF4FE-B34C-463A-AE16-A343162B7531">
                            <File Id="fil2A8BBBB8EBD5B626DC98686307B2A9C9" KeyPath="yes" Source="$(var.SourceDir)\Launcher-kolide-k2\bin\arm64\osqueryd.exe" />
<Condition> %PROCESSOR_ARCHITECTURE="ARM64" </Condition>
                        </Component>
                </Directory>
                <Directory Id="dirC586BDDEA1A8C8B62AFD7017E646DD85" Name="conf">
                    <Component Id="cmp3B4F901A7E2AE41959321E267F5FA937" Guid="C2F68C91-D693-4F13-B943-6D108A2CE5D6">
                        <File Id="fil18DE5428F20D530D3039426F03C41AC7" KeyPath="yes" Source="$(var.SourceDir)\Launcher-kolide-k2\conf\launcher.flags" />
                    </Component>
                    <Component Id="cmp9DD41EA0BAC4BB356CB0436EC8BAE15D" Guid="687C5B5A-4071-4EAA-88CA-F475CC9A58DE">
                        <File Id="filB41D4879C4A879139C72198A2D8D7862" KeyPath="yes" Source="$(var.SourceDir)\Launcher-kolide-k2\conf\secret" />
                    </Component>
                </Directory>
            </Directory>
        </DirectoryRef>
    </Fragment>
    <Fragment>
        <ComponentGroup Id="AppFiles">
            <ComponentRef Id="cmpFDADA56D9962ABBCAA5F3803F3A0E022" />
            <ComponentRef Id="cmp2495C4D31241909F181B39921D2280C9" />
            <ComponentRef Id="cmpABE14524530AA1F1CB8D6939D826DC32" />
            <ComponentRef Id="cmp61B74053A68DD7A35C953D86480F9D4C" />
            <ComponentRef Id="cmp3B4F901A7E2AE41959321E267F5FA937" />
            <ComponentRef Id="cmp9DD41EA0BAC4BB356CB0436EC8BAE15D" />
        </ComponentGroup>
    </Fragment>
</Wix>

RebeccaMahany

LGTM, just a couple small comments!

cmd/launcher/svc_config_windows.go

pkg/packagekit/wix/wix.go

pkg/packagekit/wix/service.go

RebeccaMahany

🔥 amazing

directionless

This is a big step forward.

And I love the conclusion of only removing the util stuff from the less common platform.

directionless · 2024-08-07T02:07:07Z

cmd/launcher/svc_config_windows.go

+// setRecoveryActions sets the recovery actions for the launcher service.
+// previously defined via wix ServicConfig Element (Util Extension) https://wixtoolset.org/docs/v3/xsd/util/serviceconfig/
+func setRecoveryActions(ctx context.Context, logger *slog.Logger) {
+	sman, err := mgr.Connect()


I see this is what we're doing everywhere here, I wonder if we should consolidate and only open it once, instead of the rapid opening and closing. (If we think so, it's fine as a followup)

directionless · 2024-08-07T02:10:28Z

docs/package-builder.md

+
+###### Windows Multi-Archecture MSI
+
+Package builder creates an MSI containing both amd64 & arm64 binaries. This is done putting both of binaries and their service installation in to the MSI with mutually exclusive conditions based on processor architecture.


Very clear.

directionless · 2024-08-07T02:12:31Z

pkg/packaging/packaging.go

-	// Normally we'd download the same version we bake into the
-	// autoupdate. But occasionally, it's handy to make a package
-	// with a different version.
-	LauncherDownloadVersionOverride string
-	OsqueryDownloadVersionOverride  string


It's okay to remove these, but I want to note that I have used them in the past. They might make less sense with the newer TUF updater

zackattack01

🔥

James-Pickett and others added 4 commits July 24, 2024 16:05

build msi for arm and amd

3b59fd8

Merge branch 'main' into main

0aff250

look for app bundle on darwin

eca6558

Merge branch 'main' into main

9a49d63

James-Pickett commented Jul 25, 2024

View reviewed changes

James-Pickett and others added 3 commits July 25, 2024 14:27

Merge branch 'main' into main

0b736a3

tweaks and comments

2fbeac3

fix tests

926987b

James-Pickett marked this pull request as ready for review July 25, 2024 22:20

RebeccaMahany reviewed Jul 26, 2024

View reviewed changes

remove unused variables, comments, feedback

5f89750

James-Pickett changed the title ~~build msi launcher for arm and amd~~ build windows msi for arm and amd Jul 26, 2024

James-Pickett and others added 3 commits July 26, 2024 11:21

Merge branch 'main' into main

5dfec02

default launcher_arm_version flag to value of launcher_version if not…

80c3def

… set

Merge branch 'main' into main

e840e20

directionless reviewed Jul 27, 2024

View reviewed changes

James-Pickett and others added 3 commits July 29, 2024 07:57

Merge branch 'main' into main

5c90381

Merge branch 'main' into main

910cabb

separate flags for local bin and version, print skipped clean up dirs

de4544b

Merge branch 'main' into main

832ddf1

Merge branch 'main' into main

2f739af

uppercase osq processor condition

10314cc

RebeccaMahany added the component:build&packaging Build and Package label Aug 1, 2024

James-Pickett and others added 2 commits August 5, 2024 09:37

Merge branch 'main' into main

ed806ee

re-add UtilServiceConfig for amd

163ca6a

RebeccaMahany reviewed Aug 6, 2024

View reviewed changes

directionless reviewed Aug 6, 2024

View reviewed changes

pkg/packagekit/wix/service.go Show resolved Hide resolved

tweaks, feedback, docs

8293631

RebeccaMahany approved these changes Aug 6, 2024

View reviewed changes

Merge branch 'main' into main

53ad5c3

directionless approved these changes Aug 7, 2024

View reviewed changes

zackattack01 approved these changes Aug 7, 2024

View reviewed changes

James-Pickett added this pull request to the merge queue Aug 7, 2024

Merged via the queue into kolide:main with commit 1055416 Aug 7, 2024
29 checks passed

RebeccaMahany mentioned this pull request Nov 4, 2024

Make launcher available per-architecture #1149

Open

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build windows msi for arm and amd #1796

build windows msi for arm and amd #1796

James-Pickett commented Jul 24, 2024 •

edited

Loading

RebeccaMahany Jul 26, 2024

James-Pickett Jul 26, 2024 •

edited

Loading

James-Pickett Jul 26, 2024

directionless Jul 27, 2024

directionless Jul 27, 2024

James-Pickett Jul 29, 2024

directionless left a comment

directionless Jul 27, 2024

directionless Jul 27, 2024

directionless commented Jul 27, 2024

James-Pickett commented Jul 29, 2024 •

edited

Loading

directionless commented Jul 30, 2024

James-Pickett commented Jul 30, 2024

RebeccaMahany left a comment

RebeccaMahany left a comment

directionless left a comment

directionless Aug 7, 2024

directionless Aug 7, 2024

directionless Aug 7, 2024

zackattack01 left a comment


		###### Windows Multi-Archecture MSI

		Package builder creates an MSI containing both amd64 & arm64 binaries. This is done putting both of binaries and their service installation in to the MSI with mutually exclusive conditions based on processor architecture.

build windows msi for arm and amd #1796

build windows msi for arm and amd #1796

Conversation

James-Pickett commented Jul 24, 2024 • edited Loading

Choose a reason for hiding this comment

James-Pickett Jul 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

directionless left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

directionless commented Jul 27, 2024

James-Pickett commented Jul 29, 2024 • edited Loading

directionless commented Jul 30, 2024

James-Pickett commented Jul 30, 2024

RebeccaMahany left a comment

Choose a reason for hiding this comment

RebeccaMahany left a comment

Choose a reason for hiding this comment

directionless left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zackattack01 left a comment

Choose a reason for hiding this comment

James-Pickett commented Jul 24, 2024 •

edited

Loading

James-Pickett Jul 26, 2024 •

edited

Loading

James-Pickett commented Jul 29, 2024 •

edited

Loading