Add Windows binary packaging / installers. #2

slproweb · 2023-05-10T15:57:53Z

I added two files to this commit that differ from the original repository: LICENSE.txt from the openssl/openssl repository and ms-windows/support/SOURCES.txt to select the MIT license for the support libraries (I assume MIT is fine).

levitte · 2023-05-17T09:06:32Z

ms-windows/README.md

+Creating New Templates
+----------------------
+
+When a new base version is released (e.g. 3.2), the simplest approach to creating a new template is to copy the previous version's template and then make some adjustments to 'info.json' and various installer scripts.  For official releases, the various dependencies should be updated to best reflect supported end-user OSes and architectures.  The build tools script can be used to evaluate/validate all potential dependencies via 'init-test':


Note: I'm wondering if the "just copy the last template and adjust" could be templated...

I am not trying to say that it should be done in this PR! Consider this a collective mental note for future enhancements

mattcaswell

This looks great. Mostly minor comments.

ms-windows/README.md

mattcaswell · 2023-06-16T10:20:52Z

ms-windows/support/SOURCES.txt

+The files in this directory come from these open source libraries:
+
+https://github.com/cubiclesoft/php-misc (MIT license)
+https://github.com/cubiclesoft/ultimate-web-scraper (MIT license)


I think this is fine, but I'm not sure we've done this before (i.e. had something with a different licence to all the rest of the files in the tree). We might need to double check with OMC that this is ok.

Since the files in this directory are just imports of tools from somewhere else, I've not reviewed their contents.

I'll get this raised with OMC so we can confirm this is ok.

ms-windows/build-tools.php

ms-windows/templates/1.1.1/x86/openssl.iss

ms-windows/templates/3.0/x64/openssl.iss

ms-windows/templates/3.0/x86/openssl.iss

ms-windows/templates/3.1/x64/openssl.iss

mattcaswell · 2023-06-16T14:11:59Z

ms-windows/templates/3.1/x64/openssl.iss

+Compression=bzip
+ArchitecturesAllowed=x64
+ArchitecturesInstallIn64BitMode=x64
+; Minimum version supported is Windows XP.


I do wonder whether we can bump this up for 3.1 (maybe even 3.0). There are certain optimisations and benefits that we get if we compile OpenSSL targeting a more recent version of Windows. People that want XP support can still build from source.

If this is the route to take, Inno Setup 5 can be dropped altogether. When setting up the Inno Setup 5 dependency, it triggers the UAC prompt even though it ends up doing nothing requiring elevation. Dropping that dependency cleans up the initialization phase. Inno Setup 5 usage exists for XP support. So if we don't need that, the dependency can be dropped and the info.json files and the installers adjusted accordingly for Inno Setup 6.

Let me know what OSes to support for which versions.

levicki · 2023-07-05T10:39:17Z

@mattcaswell

Is there a specific reason why InnoSetup script is not downloading / installing VC++ 2015-2022 redistributable instead of VC++ 2017?

AFAIK, 2015-2022 is fully compatible.

mattcaswell · 2023-07-07T14:57:25Z

ms-windows/build-tools.php

@@ -0,0 +1,1564 @@
+<?php
+/*
+ * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.


2016-2019? Why 2016? At least 2019 should probably be 2023

mattcaswell · 2023-07-07T15:16:05Z

ms-windows/build-tools.php

+			DeleteDirectory($pathmap["[[SOURCE_TEMP_DIR]]"]);
+
+			// Clone the source tree to the temporary architecture directory.
+			// Doing this allows multiple architectures for a base version to be built simultaneously.


I won't claim it's never had a bug or won't ever again - but I don't recall seeing a bug about this recently. Anyway - I'm happy to defer this as a potential future enhancement.

mattcaswell · 2023-07-07T15:20:33Z

ms-windows/build-tools.php

+			if (!file_exists($pathmap["[[SOURCE_TEMP_DIR]]"] . "/makefile"))  CLI::DisplayError($echoprefix . " Failed to generate 'makefile'.");
+
+
+			// Nothing is perfect.  Patch the makefile.


Hmmm. Somehow applying patches to our own build goes against the grain. But, ok, future enhancement.

mattcaswell · 2023-07-07T15:24:04Z

ms-windows/build-tools.php

+			echo $echoprefix . " Finished build at " . date("Y-m-d H:i:s") . ".  Build time:  " . $mins . " min " . $secs . " sec\n";
+		}
+
+		// Run first build.  This build takes much longer due to also building the test suite.


So we install the test suite? That's unusual. I'm in two minds about it. I'd be interested to hear the thoughts of other reviewers about this.

mattcaswell · 2023-07-07T15:26:56Z

ms-windows/build-tools.php

+		if (!is_dir($pathmap["[[BUILD_OUTPUT_DIR]]"] . "/dll_MTd"))  RunBuild($ver, $arch, $baseenv, 4, $pathmap, $archinfo, "--debug shared no-tests", "/MTd", "dll_MTd", array());
+
+		if (!is_dir($pathmap["[[BUILD_OUTPUT_DIR]]"] . "/static_MD"))  RunBuild($ver, $arch, $baseenv, 5, $pathmap, $archinfo, "no-shared no-tests", "/MD", "static_MD", array("apps"));
+		if (!is_dir($pathmap["[[BUILD_OUTPUT_DIR]]"] . "/static_MT"))  RunBuild($ver, $arch, $baseenv, 6, $pathmap, $archinfo, "no-shared no-tests", "/MT", "static_MT", array("apps"));


t might make more sense to go back and evaluate the generated makefile to see if it can produce everything required in just one build cycle by executing the linker step several additional times.

Future enhancement...

mattcaswell · 2023-07-07T15:30:52Z

ms-windows/support/SOURCES.txt

+The files in this directory come from these open source libraries:
+
+https://github.com/cubiclesoft/php-misc (MIT license)
+https://github.com/cubiclesoft/ultimate-web-scraper (MIT license)


I'll get this raised with OMC so we can confirm this is ok.

mattcaswell · 2023-07-07T15:40:11Z

OMC Question: This PR contains a number of files under the "support" directory which are copies of external open source tool dependencies which are separately licensed. There is a note about the different licence conditions that apply to those files. Are we ok to do this?

OMC Question: This PR currently supports Windows XP. Building for a later version might bring with it various optimisations. What minimum version of Windows should we support?

t8m · 2023-07-10T08:40:22Z

ms-windows/build-tools.php

+				$data = str_replace($key, $val, $data);
+			}
+
+			// The 'no-shared' build should only generate statically linked libraries and executables.


no-shared no-module should build only static libs and executables, including the legacy provider being included inside libcrypto.

t8m · 2023-07-10T08:42:06Z

ms-windows/build-tools.php

+			}
+
+			// The 'no-shared' build should only generate statically linked libraries and executables.
+			if (strpos($configuretype, "no-shared") !== false)


This should not be needed if no-shared is combined with no-module.

t8m · 2023-07-10T09:51:41Z

ms-windows/support/cacert.pem

@@ -0,0 +1,3372 @@
+##


I wonder if we should be really shipping the Mozilla CA cert bundle.

@t8m Certainly not unless the bundle is created from scratch during build from certdata.txt, but given how many people build OpenSSL (including potentially automated builds) Mozilla wouldn't be happy with so many fetches of that file.

On the other hand, shipping a stale bundle is IMO worse than shipping none at all. Perhaps add some readme describing where and how to get it for those users need more than just their own certificates?

t8m · 2023-07-10T09:52:25Z

ms-windows/support/cli.php

+			return $result;
+		}
+	}
+?>


Missing EOL at EOF. Would it make sense for these files coming from outside project(s) to make them a submodule instead? Are they used verbatim or are there any subsequent modifications?

t8m · 2023-07-10T10:04:23Z

ms-windows/build-tools.php

+			$indir = $pathmap["[[SOURCE_TEMP_DIR]]"];
+			$outdir2 = $pathmap["[[BUILD_OUTPUT_DIR]]"] . "/" . $outdir;
+			@mkdir($outdir2, 0775, true);
+			if (in_array("all", $copymodes) || in_array("apps", $copymodes))  CopyBuildFiles($indir, $outdir2, "apps", true);
+			if (in_array("all", $copymodes) || in_array("engines", $copymodes))  CopyBuildFiles($indir, $outdir2, "engines", false);
+			if (in_array("all", $copymodes) || in_array("fuzz", $copymodes))  CopyBuildFiles($indir, $outdir2, "fuzz", false);
+			if (in_array("all", $copymodes) || in_array("providers", $copymodes))  CopyBuildFiles($indir, $outdir2, "providers", false);
+			if (in_array("all", $copymodes) || in_array("test", $copymodes))  CopyBuildFiles($indir, $outdir2, "test", true);
+			if (in_array("all", $copymodes) || in_array("tools", $copymodes))  CopyBuildFiles($indir, $outdir2, "tools", true);


So this does not use make install at all... Not sure if this is a problem or not.

t8m · 2023-07-10T10:34:43Z

ms-windows/templates/1.1.1/x64/openssl-light.iss

+AppName=OpenSSL Light (64-bit)
+AppVersion=[[DOTTED_VERSION]]
+AppVerName=OpenSSL [[DOTTED_VERSION]] Light (64-bit)


I am not sure OpenSSL Light is right name for the installation. Perhaps OpenSSL Runtime vs. OpenSSL Full would be better?

@t8m That one bothers me too.

However, Runtime kind of implies that it contains only .dll files without the openssl.exe binary.

How about OpenSSL User Setup (binaries only) and OpenSSL Developer Setup (full version with docs/headers/libs)?

That IMO conveys the intent more clearly.

t8m · 2023-07-10T10:35:41Z

ms-windows/templates/1.1.1/x64/openssl-light.iss

+AppName=OpenSSL Light (64-bit)
+AppVersion=[[DOTTED_VERSION]]
+AppVerName=OpenSSL [[DOTTED_VERSION]] Light (64-bit)
+AppPublisher=OpenSSL Foundation


OpenSSL Software Foundation

t8m · 2023-07-12T08:51:08Z

OMC: We leave the minimum Windows version to XP for the 32 bit binary build. We will require Windows 7 for the 64 bit binary build.

Answer to the other question is deferred to the next meeting.

t8m · 2023-07-12T09:01:22Z

@slproweb Do you have download logs for the existing binaries to find out how many downloads come from Windows XP and Windows Vista? If so what percentage of these old Windows do you see?

ghost · 2023-07-28T22:51:53Z

please make sure just a normal Zip option is available as well. I dont like running random installers, I would prefer just to extract and use the executables, similar to a Linux system. until then I am using this:

https://indy.fulgan.com/SSL

t8m · 2023-07-31T13:35:56Z

please make sure just a normal Zip option is available as well. I dont like running random installers, I would prefer just to extract and use the executables, similar to a Linux system. until then I am using this:

https://indy.fulgan.com/SSL

I assume we could have a build that would create statically linked openssl.exe and have that zipped.

nhorman · 2024-06-07T01:16:10Z

Marking as inactive, will be closed at the end of 3.4 dev cycle barring further input

slproweb · 2024-06-07T02:07:42Z

I apologize for my lack of attention to this project. I got seriously sick twice in the last year (first with some nasty upper respiratory infection that knocked me out for over a month and the second time with COVID) and in between bouts of illness was otherwise extremely busy with a new (unrelated) project. It looks like someone else has picked this up and is running with it, which is a good thing. My original intent was to drop a working set of scripts and then the project could just run with it from there with minimal attention on my behalf. Looks like you guys are going the NSIS route instead of the InnoSetup route. Either installer technology is fine. I was merely importing what I had already built up over many years.

Some notes/commentary though:

The comment by @ghost from earlier about ZIP files is probably still relevant. The scripts I wrote generated a unified ZIP file output as the last step. I don't see anything similar for the new installer.

MSI is really important for SCCM-like tools. You'll get a bunch of not-so-polite requests for MSI support until you implement it. The WiX toolset XML wrapper is convenient for wrapping a generated EXE installer inside of a MSI. There are weird quirks with MSI. MSIX is supposedly "the future" but I've not seen it in the wild (yet). So for the future, you might consider taking the EXE generated by NSIS and using a basic WiX toolset XML wrapper like the one here to generate a MSI wrapped EXE. It's not a perfect solution but it'll generally get you 99% of the way there. The InnoSetup script specifically looks for a special MSI option to avoid adding spurious entries to the Windows registry.

Add Windows binary packaging / installers.

7458071

levitte reviewed May 17, 2023

View reviewed changes

arapov assigned t8m Jun 15, 2023

mattcaswell requested changes Jun 16, 2023

View reviewed changes

arapov unassigned t8m Jun 28, 2023

Applied a number of requested changes as per Matt Caswell.

a1d0524

arapov assigned mattcaswell Jul 3, 2023

paulidale mentioned this pull request Jul 5, 2023

Provide OpenSSL binaries under GitHub Releases openssl/openssl#20154

Closed

mattcaswell requested changes Jul 7, 2023

View reviewed changes

mattcaswell added the hold: need omc decision The OMC needs to make a decision label Jul 7, 2023

t8m requested changes Jul 10, 2023

View reviewed changes

arapov assigned arapov and unassigned mattcaswell Jan 3, 2024

nhorman added the inactive label Jun 7, 2024

slproweb mentioned this pull request Jun 7, 2024

Bringing package scripts into the fold openssl/openssl#20865

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Windows binary packaging / installers. #2

Add Windows binary packaging / installers. #2

slproweb commented May 10, 2023

levitte May 17, 2023

mattcaswell left a comment

mattcaswell Jun 16, 2023

mattcaswell Jul 7, 2023

mattcaswell Jun 16, 2023

slproweb Jul 1, 2023

levicki commented Jul 5, 2023

mattcaswell Jul 7, 2023

mattcaswell Jul 7, 2023

mattcaswell Jul 7, 2023

mattcaswell Jul 7, 2023

mattcaswell Jul 7, 2023

mattcaswell Jul 7, 2023

mattcaswell commented Jul 7, 2023

t8m Jul 10, 2023

t8m Jul 10, 2023

t8m Jul 10, 2023

levicki Jul 10, 2023

t8m Jul 10, 2023

t8m Jul 10, 2023

t8m Jul 10, 2023

levicki Jul 10, 2023

t8m Jul 10, 2023

t8m commented Jul 12, 2023

t8m commented Jul 12, 2023

ghost commented Jul 28, 2023 •

edited by ghost

Loading

t8m commented Jul 31, 2023

nhorman commented Jun 7, 2024

slproweb commented Jun 7, 2024 •

edited

Loading

		if (!file_exists($pathmap["[[SOURCE_TEMP_DIR]]"] . "/makefile")) CLI::DisplayError($echoprefix . " Failed to generate 'makefile'.");


		// Nothing is perfect. Patch the makefile.

Add Windows binary packaging / installers. #2

Are you sure you want to change the base?

Add Windows binary packaging / installers. #2

Conversation

slproweb commented May 10, 2023

Choose a reason for hiding this comment

mattcaswell left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

levicki commented Jul 5, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mattcaswell commented Jul 7, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

t8m commented Jul 12, 2023

t8m commented Jul 12, 2023

ghost commented Jul 28, 2023 • edited by ghost Loading

t8m commented Jul 31, 2023

nhorman commented Jun 7, 2024

slproweb commented Jun 7, 2024 • edited Loading

ghost commented Jul 28, 2023 •

edited by ghost

Loading

slproweb commented Jun 7, 2024 •

edited

Loading