September 2009 - Posts

New Advanced Installer 7.2 brings desktop ActiveSync installers for Windows Mobile applications

On September 8th, 2009 Caphyon Ltd. announced the latest edition of its Windows Installer authoring tool. This is the fifth feature update in this year. Since each Advanced Installer purchase includes 6 months of maintenance (optionally 30 months) you get an average of three free updates.

New and improved features in Advanced Installer 7.2 include:

  • Install Windows Mobile applications from the desktop through ActiveSync
  • Transforms Wizard to create MST transforms capturing user input during an install or the differences between two Windows Installer MSI databases
  • Fast installs through Windows Installer 5.0
  • Retrieve WiX imported files from Visual Studio project
  • Ability to digitally sign using information from the certificates store
  • Ability to customize the installation folder for each feature
  • Mixed 32-bit/64-bit package predefined project template
  • Visual C++ application predefined project template
  • .NET Framework application predefined project template
  • Copy/Paste support for dialog editor, launch conditions, Prerequisites, upgrades and searches
  • Command line options for: Windows Mobile projects, patch images, adding and removing merge modules in a MSI project, setting merge module signature information, ProductCode
  • Windows Powershell 1.0 predefined prerequisite
  • Adobe Flash Player 10 predefined prerequisite
  • XNA Framework 3.1 predefined prerequisite and launch condition
  • SQL Server Express and SQL Server Compact launch conditions

Advanced Installer is licensed on a per developer basis, allowing named users to install the software on up to five machines. It is available in four editions, starting with the Freeware community edition and offering a 30-day trial period for the other editions.

For more information about Advanced Installer please see:
www.installsite.biz/advancedinstaller.htm

Careful with that Hyperlink (on your MSI dialog)

One of the new features in version 5 of the Windows Installer runtime is support for hyperlink controls on setup dialogs. Remember that MSI 5 is only available on Windows 7 and Windows Server 2008 R2, but there's no redistributable for down-level platforms.

In most cases when introducing new features, the MSI team made sure they don't break your setup on older runtime versions. For instance, older MSI versions simply ignore new tables that they can't use. This enables developers to create a setup that will run with basic functionality on older platforms but on the latest MSI version the new features would "light up".

The hyperlink control is different, maybe because it's not a table but a new control type in an existing table, the Control table. Thus, it causes your setup to fail on Windows Installer versions prior to MSI 5:

Dialog with hyperlink control on Windows 7
HyperlinkW7
Dialog with hyperlink control on Windows Vista
HyperlinkVista

Error code 2885 means "Failed to create the control [3] on the dialog [2]."

Workaround

To work around this issue, create two versions of the dialog, one with the hyperlink control, and the other without. Use these condition to display the appropriate dialog:

  • VersionMsi >= "5.00" (for the dialog with hyperlink control)
  • VersionMsi < "5.00" (for the dialog without hyperlink control)

Note that making the hyperlink control invisible for MSI versions < 5 doesn't help. You really need a separate dialog.

How to create a hyperlink control (if your tool doesn't support it)

I've used Advanced Installer to create the above screen shots, because its dialog editor can create hyperlink controls. If you are using InstallShield or another tool that doesn't support hyperlink controls (yet) but has a way to modify the msi tables directly, you can create a hyperlink control using these easy steps:

  1. Create a static text control
  2. Set its text in HTML format: like this:
    <a href=http://www.installsite.org>www.InstallSite.org</a>
    where the href parameter specifies the URL and the text between the opening and the closing tag is what gets displayed.
  3. Go to Direct Editor and select the table named Control.
  4. Find your text control and change the Type from Text to Hyperlink.

This manual procedure even gives you more flexibility. For instance you could hyperlink only part of the text, while in Advanced Installer the complete text is hyperlinked. The following screen shot was created with InstallShield using this string for the Hyperlink Text:

Please visit <a href="http://www.installsite.org">InstallSite.org</a> for more samples

HyperlinkIS

Microsoft's recent Security Updates for Visual Studio break Windows Installer Updates

This problem was brought up in a question on the InstallSite Forum and is also mentioned in a blog post by Gauravb (who appears to be a Microsoft employee).

The typical symptom is missing or not updated files after you install a Small or Minor Update to your application (Major Upgrades are not affected). In the installer log file you'll notice that some features have been switched to "advertised" state and instead of being installed locally. The actual cause is noted in the SELMGR error message in the log similar to this:

SELMGR: ComponentId '{-GUID-}' is registered to feature '-Feature-Name-', but is not present in the Component table. Removal of components from a feature is not supported!

This happens if your setup includes a merge module like Microsoft_VC80_CRT_x86.msm and you rebuilt your setup package after installingsecurity updates 971090 and 973673 for Visual Studio 2005 SP1 or 971092 and 973675 for Visual Studio 2008 SP1. These security updates install newer versions of merge modules.

Apparently a component that existed in the original version of the merge module has been removed in the updated msm. Removing a component is a violation of Windows Installer's rules for Small and Minor Updates.

Affected Merge Modules and GUIDs

Visual Studio 2005 SP1

I examined to merge modules installed by Visual Studio 2005 SP1 and updated by by security updates 971090 and 973673. I found that all of these merge modules are affected by this problem, i.e. they have components removed:

  • Microsoft_VC80_ATL_x86.msm
    Removed 2 components with GUIDs {9B2CAF3C-B0AB-11EC-B01F-C8B3B9A1E18E} and {9B2CAF3C-B0AB-11EC-C01F-C8B3B9A1E18E}
  • Microsoft_VC80_CRT_x86.msm
    Removed 2 components with GUIDs {9BFFB8F8-F55F-10B2-C01F-C8B3B9A1E18E} and {9BFFB8F8-F55F-10B2-B01F-C8B3B9A1E18E}
  • Microsoft_VC80_DebugCRT_x86.msm
    Removed 2 components with GUIDs {583FF03B-A196-24C8-C01F-C8B3B9A1E18E} and {583FF03B-A196-24C8-B01F-C8B3B9A1E18E}
  • Microsoft_VC80_DebugMFC_x86.msm
    Removed 2 components with GUIDs {55141F6E-A388-29A8-C01F-C8B3B9A1E18E} and {55141F6E-A388-29A8-B01F-C8B3B9A1E18E}
  • Microsoft_VC80_DebugOpenMP_x86.msm
    Removed 2 components with GUIDs {8E601675-4F66-A4DE-B01F-C8B3B9A1E18E} and {8E601675-4F66-A4DE-C01F-C8B3B9A1E18E}
  • Microsoft_VC80_MFC_x86.msm
    Removed 2 components with GUIDs {9EE2A7ED-8A13-0C17-C01F-C8B3B9A1E18E} and {9EE2A7ED-8A13-0C17-B01F-C8B3B9A1E18E}
  • Microsoft_VC80_MFCLOC_x86.msm
    Removed 2 components with GUIDs {7831D131-CCF1-43EF-C01F-C8B3B9A1E18E} and {7831D131-CCF1-43EF-B01F-C8B3B9A1E18E}
  • Microsoft_VC80_OpenMP_x86.msm
    Removed 2 components with GUIDs {218504D2-AA7D-7B33-B01F-C8B3B9A1E18E} and {218504D2-AA7D-7B33-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_ATL_x86.msm
    Removed 1 component with GUID {6967BA9D-3E8C-8E05-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_CRT_x86.msm
    Removed 1 component with GUID {671DDE41-A620-9193-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_DebugCRT_x86.msm
    Removed 1 component with GUID {5A7EB616-E2EE-6D78-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_DebugMFC_x86.msm
    Removed 1 component with GUID {5D61A50B-77A2-68DD-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_DebugOpenMP_x86.msm
    Removed 1 component with GUID {8506B23C-BABD-5C8B-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_MFC_x86.msm
    Removed 1 component with GUID {6BEC5B24-C056-8A14-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_MFCLOC_x86.msm
    Removed 1 component with GUID {D5A7A18A-DEA5-8DD7-C01F-C8B3B9A1E18E}
  • policy_8_0_Microsoft_VC80_OpenMP_x86.msm
    Removed 1 component with GUID {07EE8801-38A9-ABAC-C01F-C8B3B9A1E18E}

Visual Studio 2008 SP1

I also examined to merge modules installed by Visual Studio 2008 SP1 and updated by by security updates 971092 and 973675. I found that all of these merge modules are affected by this problem, i.e. they have components removed:

  • Microsoft_VC90_ATL_x86.msm
    Removed 4 components with GUIDs {2F605F26-3021-38F6-AC31-175C0DFA59B9}, {76C3F0F6-9B9D-35DA-81C6-CA8A88CC93CA}, {DBD31579-020A-349E-8ED6-D06FEA75AF45}, and {86226397-23DB-3430-8C8A-AEA661B1AE77}
  • Microsoft_VC90_CRT_x86.msm
    Removed 4 components with GUIDs {AEC90EFE-39B8-3978-8A5D-068FEF83D275}, {B708EB72-AA82-3EB7-8BB0-D845BA35C93D}, {1A5C156B-3CC3-36E3-BAD7-9FD0D48156D3}, and {68D7E2DF-5BC5-318C-AF19-19D1D29ED692}
  • Microsoft_VC90_DebugCRT_x86.msm
    Removed 4 components with GUIDs {58425F02-9D68-3D93-85D9-39B29E29BC7B}, {BAD864A4-C2C0-3C54-8964-B268B7016DEC}, {FC82857E-2B1F-3E92-A906-97FD9825D3C7}, and {0BDD8003-3267-389F-813F-AD12EC5DC534}
  • Microsoft_VC90_DebugMFC_x86.msm
    Removed 4 components with GUIDs {F0A00871-E0E2-32B2-A659-FE4DA7002A2D}, {342BA686-A9E6-3FB4-AFC0-7034FF188D52}, {7E7F1AD6-F52E-3AE6-BAA5-32B96EE05F4E}, and {B833CE77-211C-355F-9DBB-294FD746EF17}
  • Microsoft_VC90_DebugOpenMP_x86.msm
    Removed 4 components with GUIDs {5586775C-EA44-30E2-A3E2-5C50F4EA39A0}, {B0C784B6-DDCC-3D69-A33A-5DE42951883C}, {E59B8FDA-55AE-3049-96FC-606E8C5BF2BE}, and {8FD717AF-E0E2-365E-8445-AECD9A21E5A0}
  • Microsoft_VC90_MFC_x86.msm
    Removed 4 components with GUIDs {D01CBF08-20B4-30C8-AF5A-96F9847E82A3}, {C6357C55-7461-3D51-9AE5-FD71CA24027A}, {611881C8-BE2F-393E-A04F-81C63DF00851}, and {15F67BFD-D6AA-3C8B-A1BB-C33E17E925C6}
  • Microsoft_VC90_MFCLOC_x86.msm
    Removed 4 components with GUIDs {5A06E1CC-89C9-3DB9-9BC8-5BFA56B58BFB}, {FF2F571A-6C54-31E3-B23E-2A60283B08A8}, {C9F2C40F-28CD-392C-A0C3-3AADEC130C0A}, and {4D8012CE-B2CE-3493-91B8-B8A9B982F6B8}
  • Microsoft_VC90_OpenMP_x86.msm
    Removed 4 components with GUIDs {A85D53AA-906D-31C5-96E3-E21BB9154E2C}, {D511F4F3-A911-32CF-AC11-9C97EF948BFC}, {B16F86FC-BD94-30FA-98AA-17ABE54F0478}, and {28B6B10C-E41F-302B-A673-01F436427522}
  • policy_9_0_Microsoft_VC90_ATL_x86.msm
    Removed 2 components with GUIDs {A62CCE52-C380-3111-BA7D-3D0EDFA31213} and {C2FCD113-35CA-3027-92CD-F2D646277CA1}
  • policy_9_0_Microsoft_VC90_CRT_x86.msm
    Removed 2 components with GUIDs {14F2B62D-DF5F-335F-A517-0991F44CB087} and {0355F5D0-467C-30E9-894C-C2FAEF522A11}
  • policy_9_0_Microsoft_VC90_DebugCRT_x86.msm
    Removed 2 components with GUIDs {C990308F-4696-3069-B753-AB178CE2007B} and {FBB763D7-1B85-36C2-B127-4577B3FC45A1}
  • policy_9_0_Microsoft_VC90_DebugMFC_x86.msm
    Removed 2 components with GUIDs {9B8A0715-C004-3493-8350-A387E1163D46} and {9EC89F44-FA15-308D-8582-22744424F0CF}
  • policy_9_0_Microsoft_VC90_DebugOpenMP_x86.msm
    Removed 2 components with GUIDs {A134D5FD-99B1-3230-89AC-C4F81B697BFC} and {19185A82-2047-34BF-BBE1-5E64579BE356}
  • policy_9_0_Microsoft_VC90_MFC_x86.msm
    Removed 2 components with GUIDs {6BFBB2DC-4F78-3217-ACCF-CD2838A84621} and {12EA53B4-340A-3F5D-B1BC-4A3BEC4A89A7}
  • policy_9_0_Microsoft_VC90_MFCLOC_x86.msm
    Removed 2 components with GUIDs {0FEBA8D0-5D22-3D3A-947D-559E29BF07DF} and {6F026C46-D6BC-3805-A3B0-117AF8473928}
  • policy_9_0_Microsoft_VC90_OpenMP_x86.msm
    Removed 2 components with GUIDs {8D71CE57-BDC3-34B0-ADAD-EA4C5AFC9664} and {649A198A-C19D-325F-BF3A-C7EAE62F5EF6}

Workarounds

This means that if your setup includes any of these merge modules, the security update prevents you from shipping Small or Minor Updates.The workaround I'd recommend is using a Major Upgrade (i.e. change the ProductCode and add an entry in the Upgrade table) to update your application.

Gauravb's blog lists some other workarounds which I don't think are feasible:

  • Use the VC Redistributable Installer EXE package to install the runtime instead of the merge modules. - Good advice for new packages or Major Upgrades, but you can't remove the merge modules from your package in a Small or Minor Update.
  • Use the old verion of the merge modules, - This means you would knowingly be installing a vulnerable file on your customer's computer.

Another potential workaround would be to add dummy components to your msi setup with the same GUIDs as the components that were removed from the merge modules. But that could cause conflicts with other msi files that include the original version of the module.

Posted by stefan | with no comments

Rob Mensching starts Windows Installer Consulting business, offering free project reviews

Rob Mensching is the lead of the Windows Installer XML (WiX) toolset, an open source tool to create Windows Installer (MSI) setups. I his day job he's employed at Microsoft, and as another side project he wrote his own blog software. Apparently he still has some additional spare time ;-) so he started RobMensching.com LLC to offer software installation consulting services for the Windows Installer and WiX toolset.

As part of his consulting business, Rob offers to review .msi packages and .wxs projects free of charge. Wow! I highly recommend you make use of Rob's Windows Installer knowledge and experience.