fix(installer/windows): GameStream is opt-in, not on by default

A user found this in their log and had never been offered a choice: WARN GameStream/Moonlight compat ENABLED (--gamestream): its pairing runs over plain HTTP and its legacy control encryption can reuse GCM nonces (security-review #5/#9) — an on-path LAN attacker could MITM pairing or recover input. Enable only on a TRUSTED network. They were right. The `gamestream` task carried no `Flags: unchecked`, so it was pre-ticked; and since a silent install takes the wizard's own task defaults (1839d756), a winget install turned it on with no checkbox ever shown. The host warns that this plane is a security downgrade on every single start, so having the installer enable it by default cannot be squared with our own advice — least of all on the path where nobody sees a wizard. Now unchecked, matching `allowpublicfw`, the other task with a security consequence. A default install therefore lands `PUNKTFUNK_HOST_CMD=serve`, the native-only host; Punktfunk's own clients are unaffected, since the native punktfunk/1 plane is always on. Unattended opt-in is `/MERGETASKS=gamestream`. Scope, deliberately: this changes FRESH installs only. `GamestreamParam` already omits the flag entirely unless `FreshHostInstall`, so no existing host has its choice touched by an upgrade, and anyone relying on Moonlight today keeps it. `DEFAULT_HOST_CMD` (the service's fallback when host.env carries no PUNKTFUNK_HOST_CMD line at all) is deliberately NOT flipped here: the installer always writes the line explicitly, so it does not affect a normal install, and inverting it would silently disable Moonlight for anyone whose host.env lost that line — a runtime regression that belongs in its own change, if at all. Docs corrected everywhere they stated the old default, since three of them now told users the opposite of what ships: the winget Agreement shown BEFORE install (it said "enabled by default" and gave the opt-OUT override), the Windows packaging README, and host.env.example. The `--override` example in the installer manifest is inverted with it (`/MERGETASKS=gamestream` to add, `!` to remove). Verified: [Tasks] + [Code] compile with ISCC 6.7.1 on the windows-amd64 runner (all optional features defined), and the winget catalogue rebuilds and passes 29/29 with the edited manifests.
2026-07-27 12:26:47 +02:00
parent 4114dfeff7
commit 94b7a834cb
5 changed files with 43 additions and 19 deletions
@@ -29,8 +29,11 @@ InstallerSwitches:
  # disclosures the wizard puts on screen are carried by Agreements/InstallationNotes in the
  # locale manifest instead.
  #
-  # To opt out of individual tasks, callers use Inno's ! negation via --override, e.g.
-  #   winget install unom.PunktfunkHost --override "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=!gamestream"
+  # To CHANGE individual tasks, callers pass Inno's /MERGETASKS via --override: a bare name adds a
+  # task, a `!` prefix removes one. GameStream is opt-in (its plane pairs over plain HTTP), so
+  # enabling it unattended is the additive form:
+  #   winget install unom.PunktfunkHost --override "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=gamestream"
+  # and dropping a default-on task is the negated form, e.g. /MERGETASKS=!trayicon
  # Task names: installdriver, installgamepad, installaudiocable, installhdrlayer,
  #             gamestream, allowpublicfw, startservice, trayicon
  Silent: /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
@@ -46,13 +46,14 @@ Agreements:
      redistributed under VB-Audio's bundling grant; the full notice is installed to
      %ProgramFiles%\punktfunk\licenses\VB-CABLE-NOTICE.txt.
    AgreementUrl: https://vb-audio.com/Cable/
-  - AgreementLabel: GameStream (Moonlight) compatibility is enabled by default
+  - AgreementLabel: GameStream (Moonlight) compatibility is OFF by default
    Agreement: >-
-      The default install enables GameStream so stock Moonlight clients can connect. GameStream uses
-      legacy plain-HTTP pairing and is intended for trusted LANs only. To install without it, use
-      --override "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=!gamestream", or run
-      --interactive and clear the GameStream checkbox. It can also be changed later via
-      PUNKTFUNK_HOST_CMD in %ProgramData%\punktfunk\host.env.
+      Punktfunk's own clients work out of the box. Support for stock Moonlight clients is a separate,
+      opt-in plane, because it pairs over legacy plain HTTP and is intended for trusted LANs only. To
+      install WITH it, use --override "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
+      /MERGETASKS=gamestream", or run --interactive and tick the GameStream checkbox. It can also be
+      turned on later with `punktfunk-host service install --gamestream=on` (or via
+      PUNKTFUNK_HOST_CMD in %ProgramData%\punktfunk\host.env), followed by a service restart.
    AgreementUrl: https://docs.punktfunk.unom.io/docs/windows-host

 # Displayed after the install completes. The console password is generated per install, so it can