[cpp-sp] branch main updated: CPPSP-53 Replace Windows Installer with Bat and C program (for registry operations)
Codeberg
noreply at shibboleth.net
Mon Mar 30 19:05:07 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/c9d22eb53fa8ff48886635d264549d6f6e6c02f2
The following commit(s) were added to refs/heads/main by this push:
new c9d22eb5 CPPSP-53 Replace Windows Installer with Bat and C program (for registry operations)
c9d22eb5 is described below
commit c9d22eb53fa8ff48886635d264549d6f6e6c02f2
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Mar 30 20:04:26 2026 +0100
CPPSP-53 Replace Windows Installer with Bat and C program (for registry operations)
https://shibboleth.atlassian.net/browse/CPPSP-53
Checkpoint work in progress into git before my brain melts
---
Projects/vc22/build.bat | 11 ++-
WindowsInstall/doupdate.bat | 74 ++++++++++++++++++-
WindowsInstall/install.bat | 51 ++++++++++++-
WindowsInstall/{setreg.bat => regkeys.txt} | 32 +-------
WindowsInstall/setacl.bat | 113 +++++++++++++++++++++++++++++
WindowsInstall/uninstall.bat | 24 ++++++
WindowsInstall/update.bat | 15 +++-
7 files changed, 280 insertions(+), 40 deletions(-)
diff --git a/Projects/vc22/build.bat b/Projects/vc22/build.bat
index bed207c9..428343cb 100644
--- a/Projects/vc22/build.bat
+++ b/Projects/vc22/build.bat
@@ -38,11 +38,14 @@ mkdir kit
copy ..\..\WindowsInstall\install.bat kit\
mkdir kit\dist
-x64\Release\MsiVersion.exe > kit\dist\Version.txt
+x64\Release\Version.exe > kit\dist\Version.txt
echo 1 > kit\dist\InstallerVersion.txt
mkdir kit\dist\bin
copy ..\..\WindowsInstall\update.bat kit\dist\bin\
+copy ..\..\WindowsInstall\uninstall.bat kit\dist\bin\
+copy ..\..\WindowsInstall\setacl.bat kit\dist\bin\
+
mkdir kit\dist\lib
copy x64\Release\iis_shib4.dll kit\dist\lib
@@ -60,10 +63,6 @@ copy ..\..\WindowsInstall\shib.ico kit\dist
mkdir kit\dist\dist-bin\
copy ..\..\WindowsInstall\doupdate.bat kit\dist-bin\bin\
-copy ..\..\WindowsInstall\setreg.bat kit\dist-bin\bin\
-
-
-
+copy ..\..\WindowsInstall\regkeys.txt kit\dist-bin\bin\
tar -a -c -f kit.zip kit
-
diff --git a/WindowsInstall/doupdate.bat b/WindowsInstall/doupdate.bat
index 0ff88ca2..ba18aa86 100644
--- a/WindowsInstall/doupdate.bat
+++ b/WindowsInstall/doupdate.bat
@@ -1 +1,73 @@
-REM
+ at echo off
+REM Update SP agent
+
+setlocal
+
+rem Find FQP forK target and root of installation
+set SAVE_WORKING_DIR=%cd%
+cd %1%
+set TargetDir=%cd%
+
+cd /d %~dp0..
+Echo "Installing from %cd%"
+
+Rem Grab version as string
+for /f "delims=" %%a IN (version.txt) do (set /a Version=%%a)
+Set /a MajorVersion="%VERSION% >> 24" > nul:
+Set /a MinorVersion="(%VERSION% >> 16) & 0xFF" > nul:
+Set /a PatchVersion = "%VERSION% & 0xFFFF" > nul:
+set VersionString=%MajorVersion%.%MinorVersion%.%PatchVersion%
+
+if (exist %TargetDir%\lib\shibboleth-sp) (
+ Echo Updating SP Agent Version %VersionString%
+) else (
+ Echo Installing SP Agent Version %VersionString%
+)
+
+rem
+rem use robocopy to copy stuff over
+rem /is copy eveything
+rem /njh No job header
+rem /njs No job summary
+
+echo Copying Distribution to %targetDir%\dist-%VersionString%
+robocopy /is /njs /njh . %targetDir%\dist-%VersionString%\
+
+echo Copying Batch Files to %targetdir%\bin\shibboleth-sp\
+robocopy /is /njs /njh bin "%targetdir%\bin\shibboleth-sp\"
+
+echo Copying Dll Files to %targetdir%\lib\shibboleth-sp\
+robocopy /is /njs /njh lib "%targetdir%\lib\shibboleth-sp\"
+
+echo Coping new config Files
+rem /xc /xn /xo only new files
+rem /xc exclude existing files same timestamp different sizes
+rem /xn exclude newer
+rem /xo exclude older
+rem Hence /xo /xc /xn means "copy every file where a file of that name isn't there"
+robocopy /xc /xn /xo /njs /njh etc "%targetdir%\etc\shibboleth-sp\"
+
+rem Set registry
+echo "just add code to update registry"
+exit /b
+
+reg by hand
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D9DA52E3-F96E-4C84-B153-C3B17C34F730}]
+
+"DisplayIcon"="C:\\opt\\shibboleth-sp\\etc\\shibboleth-sp\\shib.ico,0"
+"InstallSource"="C:\\Users\\Administrator\\Desktop\\"
+"DisplayVersion"="4.0.0.0"
+"Version"=dword:04000000
+"VersionMinor"=dword:00000000
+"VersionMajor"=dword:00000004
+"UninstallString"="cmd /c pause"
+"InstallLocation"=""
+
+reg file called regkeys.txt
+
+
+
+:exit
+cd /d %SAVE_WORKING_DIR%
+exit /b
diff --git a/WindowsInstall/install.bat b/WindowsInstall/install.bat
index 0ff88ca2..49dcdfd2 100644
--- a/WindowsInstall/install.bat
+++ b/WindowsInstall/install.bat
@@ -1 +1,50 @@
-REM
+ at echo off
+REM Install SP agent
+
+setlocal
+
+rem Find FQP for root of installation
+set SAVE_WORKING_DIR=%cd%
+cd /d %~dp0
+set SOURCE_DIR=%cd%
+
+rem - Collect targetDir [opt\shibboleth-sp]
+set loc=%SystemDrive%\opt\shibboleth-sp
+set /p TargetDir="Location To Install [%loc%] :"
+if "%TargetDir%" == "" ( set TargetDir=%loc%
+
+rem - Fail if lib or bin exist
+if exist %TargetDir%\bin\shibboleth-sp (
+ echo %TargetDir%\bin\shibboleth-sp exists. Agent may already be installed
+ echo Did you bean %TargetDir%\bin\shibboleth-sp\update ?
+ exit /b
+)
+if exist %TargetDir%\lib\shibboleth-sp (
+ echo %TargetDir%\lib\shibboleth-sp exists. Agent may already be installed
+ echo Did you bean %TargetDir%\bin\shibboleth-sp\update ?
+ exit /b
+)
+
+Rem Call generic "install/update" bar file shipped with this release
+
+dist-bin\doupdate.bat "%targetDir%"
+
+Rem Detect IIS and configure if there
+
+if exist %SYSTEMROOT%\INETSRV\appcmd.exe (
+ echo Installing ShibAgent module into IIS
+ %SYSTEMROOT%\INETSRV\appcmd.exe install module /name:ShibAgent /image:"%TargetDir%\lib\shibboleth-sp\iis_shib4.dll"
+)
+
+Rem Aak to update ACLs and if so CALL SETACL
+
+:loop
+set /p YesNo="Run SetAcl.bat [Yn] "
+if /i "%YesNo%"=="n" goto exit
+if /i not "%YesNo%"=="y" goto loop
+
+%TargetDir%\bin\shibboleth-sp\setacl.bat
+
+:exit
+cd /d %SAVE_WORKING_DIR%
+exit /b
diff --git a/WindowsInstall/setreg.bat b/WindowsInstall/regkeys.txt
similarity index 53%
rename from WindowsInstall/setreg.bat
rename to WindowsInstall/regkeys.txt
index 0fca861b..e148ad13 100644
--- a/WindowsInstall/setreg.bat
+++ b/WindowsInstall/regkeys.txt
@@ -1,34 +1,6 @@
-REM
-REM Thanjs to tutorialreference,com
-
-FOR /F "tokens=2 delims==" %%I IN ('WMIC OS GET LocalDateTime /VALUE') DO SET "dt=%%I"
-
-SET YYYYMMDD="%dt:~0,8%"
-
-echo ">>> %YYYYMMDD% <<<"
-
-Set /a Version=0x11018864
-Set /a MajorVersion="%VERSION% >> 24" > nul:
-Set /a MinorVersion="(%VERSION% >> 16) & 0xFF" > nul:
-echo "v = %VERSION%"
-echo "mav = %MajorVERSION%"
-echo "miv = %MinorVERSION%"
-
-reg by hand
-"DisplayIcon"="C:\\opt\\shibboleth-sp\\etc\\shibboleth-sp\\shib.ico,0"
-"InstallSource"="C:\\Users\\Administrator\\Desktop\\"
-"DisplayVersion"="4.0.0.0"
-"Version"=dword:04000000
-"VersionMinor"=dword:00000000
-"VersionMajor"=dword:00000004
-"UninstallString"="cmd /c pause"
-
-
-reg file
-====
Windows Registry Editor Version 5.00
-[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B034EFE0-0996-47A3-8296-6A7EAE948915}]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D9DA52E3-F96E-4C84-B153-C3B17C34F730}]
"DisplayName"="Shibboleth SP Windows Agent"
"Language"=dword:00000409
"NoModify"=dword:00000001
@@ -39,7 +11,6 @@ Windows Registry Editor Version 5.00
"Readme"=""
"Publisher"="Shibboleth Consortium"
"NoModify"=dword:00000001
-"InstallLocation"=""
"HelpTelephone"=""
"HelpLink"=hex(2):68,00,74,00,74,00,70,00,73,00,3a,00,2f,00,2f,00,73,00,68,00,\
69,00,62,00,62,00,6f,00,6c,00,65,00,74,00,68,00,2e,00,61,00,74,00,6c,00,61,\
@@ -50,4 +21,3 @@ Windows Registry Editor Version 5.00
"Comments"=""
"AuthorizedCDFPrefix"=""
-
diff --git a/WindowsInstall/setacl.bat b/WindowsInstall/setacl.bat
new file mode 100644
index 00000000..5fd04289
--- /dev/null
+++ b/WindowsInstall/setacl.bat
@@ -0,0 +1,113 @@
+ at echo off
+
+setlocal
+echo Just add code
+exit /b
+
+REM
+REM EXAMPLE batch file to set restrictive ACLs on a Shibboleth IdP installation.
+
+REM NEEDS TO BE SP AGENTIFIED
+
+sERVER ACCOUNT:
+REM Default [IIS] IIS APPPOOL\DefaultAppPool
+Rem Defailt (non-iis) "*S-1-5-19" (local_service)
+Administrators: "*S-1-5-32-544"
+Users: "*S-1-5-32-545"
+local_system "*S-1-5-18"
+
+
+REM
+REM You should consider this a sample rather than set in stone and adapt it for
+REM your own use
+REM
+REM Two optional Parameters:
+REM The first is the ID to be given explicit read access to the configuration
+REM and write access to the logs. This could be the OD or a low priv user you
+REM run the container as
+REM
+REM The second is the ID to be given ownership of the files. This finesses an
+REM issue wherebywhich happen if the owner of the files is not given access.
+REM The directory tree then becaomes an unmaintainable mess.
+REM
+REM Defaults to 'Administrators'
+REM
+
+if "%2%" EQU "" (
+ set OWNER_ID=Administrators
+) else (
+ set OWNER_ID=%2%
+)
+
+REM
+REM First up, take ownership
+REM /t means recursive
+
+echo Setting owner to %OWNER_ID%
+icacls "%~dp0\.." /t /setowner %OWNER_ID% /q
+
+if ERRORLEVEL 1 (
+ echo Error: Could not set ownership
+ goto done
+)
+
+REM
+
+if "%1%"=="" (
+ REM Set the ACLS Default ACLS
+ REM /t recursive
+ REM /inheritance:r Remove inherited ACLS
+ REM /grant:r ID:(CI)(OI)(F) Full access for ID (replacing any existing)
+ REM /grant:r ID:(CI)(OI)(F) Full access for ID (replacing any existing, but causing kids to be inherited) DIRECTORIES ONLY
+
+ echo Setting FULL ACL on dirs for SYSTEM and Administrators
+ icacls "%~dp0\.." /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)" /q
+ if ERRORLEVEL 1 (
+ echo Error: Could not set ACL
+ goto done
+ )
+
+ echo Setting FULL ACL on files for SYSTEM and Administrators
+ icacls "%~dp0\.." /t /inheritance:r /grant:r SYSTEM:F Administrators:F /q
+ if ERRORLEVEL 1 (
+ echo Error: Could not set ACL
+ goto done
+ )
+
+) else (
+ REM As above, but add read for the supplied user
+ REM GR=GENERIC_READ RD=READ_DATA/ENUMERATE_DIR X=EXECUTE/TRAVERSE_DIR
+
+ echo Setting FULL ACL with inheritance on dirs for SYSTEM and Administrators, Readonly ACL for %1%
+ icacls "%~dp0\.." /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)" "%1%:(OI)(CI)(GR,RD,X)" /q
+ if ERRORLEVEL 1 (
+ echo Error: Could not set ACL
+ goto done
+ )
+
+ echo Setting FULL ACL with inheritance on files for SYSTEM and Administrators, Readonly ACL for %1%
+ icacls "%~dp0\.." /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%1%:(GR,RD,X)" /q
+ if ERRORLEVEL 1 (
+ echo Error: Could not set ACL
+ goto done
+ )
+
+ REM And the logs
+ echo Setting FULL ACL on logs directory for SYSTEM, Administrators and %1%
+ icacls "%~dp0\..\logs" /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)" "%1%:(OI)(CI)(F)" /q
+ if ERRORLEVEL 1 (
+ echo Error: Could not set ACL
+ goto done
+ )
+
+ echo Setting FULL ACL on logs directory content for SYSTEM, Administrators and %1%
+ icacls "%~dp0\..\logs" /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%1%:F" /q
+ if ERRORLEVEL 1 (
+ echo Error: Could not set ACL
+ goto done
+ )
+)
+
+:done
+
+exit /b
diff --git a/WindowsInstall/uninstall.bat b/WindowsInstall/uninstall.bat
new file mode 100644
index 00000000..b0d0c583
--- /dev/null
+++ b/WindowsInstall/uninstall.bat
@@ -0,0 +1,24 @@
+setlocal
+REM
+REM File to uninstall the SP agent
+REM
+
+Rem Goto root of install - we are running from %targetDir%\dist-4.x.7\dist-bin\
+
+cd %dp0..\.
+if exist %SYSTEMROOT%\INETSRV\appcmd.exe (
+ echo Uninstalling ShibAgent module from IIS
+ %SYSTEMROOT%\INETSRV\appcmd.exe delete module ShibAgent
+ %SYSTEMROOT%\INETSRV\appcmd.exe uninstall module ShibAgent
+)
+set base=%cd%
+
+echo Removing %base%\bin\shibboleth-sp\
+rd /s /q "%base%\bin\shibboleth-sp\"
+
+echo Removing %base%\lib\shibboleth-sp\
+rd /s /q "%base%\lib\shibboleth-sp\"
+
+Echo not touching %base%\etc\shibboleth-sp\
+
+echo "just add code to remove [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D9DA52E3-F96E-4C84-B153-C3B17C34F730}]"
diff --git a/WindowsInstall/update.bat b/WindowsInstall/update.bat
index 0ff88ca2..cd49465b 100644
--- a/WindowsInstall/update.bat
+++ b/WindowsInstall/update.bat
@@ -1 +1,14 @@
-REM
+setlocal
+
+rem fail if parameters is not a distribution
+
+if (not exist %1%\dist-bin\doupdate.bat) (
+ echo "%1% is not a Shibboleth agent distribution
+ exit /b
+)
+
+rem find root of install
+cd %dp0..
+set path=%cd%
+
+"%1%\dist-bin\doupdate.bat" "%path%"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list