Skip to content

rubrapack 0.38.0

Choose a tag to compare

View all tags
@rubidus-api rubidus-api released this 06 Oct 17:00
v0.38.0
4f0e52f

Security fixes from a review of the whole source. Packages built with an earlier version carry the old helper parts: build them again with this one.

Security

In the parts a package carries (helper DLL, cleanup program, setup program):

  • Cleanup task, per machine. The folder for the program that runs as SYSTEM was read from the environment of the user who started the installation (%ProgramData%), and a level of it that a user had created first was accepted. The SYSTEM step now asks Windows for the folder itself, and every level (rubrapack, cleanup, {ProductCode}) must be made by it or already be a real folder owned by SYSTEM, Administrators or TrustedInstaller; otherwise no task is registered.
  • [remove] upgrade = false, per machine. The backup folder under <volume>\Config.Msi is now checked the same way on every move, move back and deletion; if it is not safe the file is left for the restart.
  • Cleanup task, per user. It ran with the highest available rights from a folder the user's own programs can write. It now runs without elevation (and can still delete itself: the task's access list names the user).
  • setup.exe (chain). Running elevated, it unpacked the packages into %TEMP%, where a program of the same user could replace one between its check and its installation. Its folder is now for SYSTEM and Administrators only.

In the command-line tool:

  • new --from. An icon's key in the package was used as a file name, so a package could have an .ico file written outside dist/_icons. The name is now one plain component.

Changed

  • guard = true, per machine: a folder that does not exist yet passes only when the deepest existing folder above it is owned by SYSTEM, Administrators or TrustedInstaller. Installing under Program Files is unaffected; a first installation into a new folder inside a folder someone else owns now stops with the guard's message (1603).
  • The per-user cleanup task no longer runs elevated (above).

Fixed

  • A per-user [remove] upgrade = false made its backup folder so that a standard user could not use it.
  • Helper DLL and cleanup program: a path longer than the buffer is skipped instead of cut short; product and upgrade codes are checked to be GUIDs.
  • MSIX launcher for console programs: a redirection or a pipe (app > out.txt) now reaches the program.
  • build of a merge module without components, and a [files] pattern when memory runs out, no longer read through a null pointer.

Checked on Windows 11: the cleanup task per machine and per user (also installed by a standard user), a folder planted by another owner refused, a folder left by an earlier version accepted and locked, [remove] upgrade = false with rollback, the preflight, the guard with a new folder inside a user's folder. The readers of packages and sources were fuzzed further (a second harness: the source reader, the codecs, ZIP, and inspect, lint, extract, new --from on damaged files).

Manual

Downloads

File For
rubrapack-0.38.0-windows-x64.exe Windows x64, tested on Windows 11 (single file, cross-built with MinGW-w64)
rubrapack-0.38.0-linux-x86_64 Linux x86-64, glibc 2.38 or later (Debian 13, Ubuntu 24.04 and later)
SHA256SUMS checksums of the files above
Assets 7
Loading