TigerSetup 0.15.0

TigerSetup 0.15.0

TigerSetup is a command-line tool for Windows that builds installers. Describe
your application in a TigerSetup.toml, and tiger-setup build produces one
self-contained Setup.exe with a wizard, a quiet mode for automation, upgrade,
repair and uninstall, and no runtime prerequisites on the target machine. The
installers it builds are transactional: an install or upgrade completes or rolls
back, and each installation records what it owns, so upgrade, uninstall and
verification work from what is really installed.

What is new in 0.15.0

• A successful uninstall leaves nothing behind. Uninstalling — from
  Settings, with WinGet, or with Setup.exe uninstall — now also removes the
  uninstall's own log, the temporary copy of the uninstaller and its folder,
  the TigerSetup folder that held the installation's records once no other
  product's are left in it, and the empty %TEMP%\TigerSetup folder. An
  uninstall that fails keeps its log, and the outcome says where it is. This
  applies to TigerSetup itself and to every installer you build with it;
  rebuild with 0.15.0 to get it.

• More robust installation records. An installer now checks the folder it
  keeps an installation's records in before it writes anything there, and
  refuses one that is a link to somewhere else or that another account created
  and filled, rather than adopting it. For all-users installations the shared
  %ProgramData%\TigerSetup folder is now writable by administrators only.
  Records that belong to another product or scope are refused rather than
  used. Logs never overwrite a file through a link, and the installer engine
  checks that it reads the same Setup.exe file the loader started from.

• Verified prerequisite downloads. When an installer resolves a
  prerequisite from the WinGet catalog, it now checks the catalog's Microsoft
  signature and every hash from the catalog index down to the downloaded
  installer, as WinGet itself does, before running anything.

• Release builds carry no test hooks. The redirections TigerSetup's own
  tests use are compiled out of the released builder, engine and loader.

• Licence and third-party notices. TigerSetup now installs LICENSE.txt
  and THIRD-PARTY-NOTICES.md beside tiger-setup.exe, and the notices cover
  every third-party component in TigerSetup and in the installers it builds.
  tiger-setup notices and Setup.exe notices print them, so an installer you
  distribute carries the notices of the TigerSetup code inside it.

• Privacy statement. PRIVACY.md describes what TigerSetup records on
  your computer, what it removes, and the only network access it makes:
  downloading a prerequisite a package declares and the computer lacks, from
  the WinGet catalog or from the address the package names. TigerSetup sends
  no telemetry.

• Terms frozen with the release. The licence and privacy statement that
  apply to 0.15.0 are part of this release: LICENSE.txt and PRIVACY.md are
  attached below, recorded with their hashes beside the installer, and
  TigerSetup's WinGet manifests link to these exact files rather than to a page
  that may change with a later version.

• Version-specific WinGet links. A [winget] URL in TigerSetup.toml may
  write {version} where the package version goes, so a licence, privacy or
  release notes link names the release the manifests are for:

  [winget]
  license_url = "https://github.com/example/myapp/releases/download/v{version}/LICENSE.txt"

  TigerSetup's own WinGet metadata now names its repository, issues, release
  notes, and this release's licence and privacy statement.

Install

Download TigerSetup-0.15.0-Setup.exe below and run it. It installs per user
by default (no administrator rights needed) or for everyone on request, and
adds tiger-setup to PATH unless you clear that option. For scripts:

TigerSetup-0.15.0-Setup.exe install --quiet
TigerSetup-0.15.0-Setup.exe install --quiet --scope machine

TigerSetup runs on Windows 10 1809 or later, Windows 11 and Windows Server 2019
or later, x64.

Verify the download

SHA256SUMS.txt lists the SHA-256 of the installer, its WinGet manifest set,
LICENSE.txt and PRIVACY.md, and release-artifacts.json records the same
hashes with the commit they were built from; every file comes from one build of
that commit, and the release's tag names that record's own SHA-256. The
installer and the programs it installs are not code-signed yet, so Windows
SmartScreen may ask before running the installer.
tiger-setup inspect TigerSetup-0.15.0-Setup.exe decodes and checks any
TigerSetup installer without running it.