enricobuehler
94b7a834cb
apple / swift (push) Successful in 3m19s
decky / build-publish (push) Successful in 35s
windows-host / package (push) Successful in 18m44s
windows-host / winget-source (push) Skipped
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Successful in 22m27s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Successful in 17m15s
apple / screenshots (push) Successful in 23m24s
ci / web (push) Successful in 58s
ci / docs-site (push) Successful in 1m27s
ci / bench (push) Successful in 7m15s
ci / rust-arm64 (push) Successful in 11m47s
deb / build-publish-client-arm64 (push) Successful in 10m21s
android / android (push) Failing after 11m52s
deb / build-publish-host (push) Successful in 11m34s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 1m42s
deb / build-publish (push) Successful in 17m34s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 3m6s
docker / build-push (ci, ci/rust-ci-noble.Dockerfile, punktfunk-rust-ci-noble) (push) Successful in 8m30s
arch / build-publish (push) Successful in 18m29s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 13m59s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 14m36s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 13m1s
docker / deploy-docs (push) Successful in 35s
ci / rust (push) Successful in 30m15s
docker / build-push-arm64cross (push) Successful in 9m8s
A user found this in their log and had never been offered a choice:
WARN GameStream/Moonlight compat ENABLED (--gamestream): its pairing runs over
plain HTTP and its legacy control encryption can reuse GCM nonces
(security-review #5/#9) — an on-path LAN attacker could MITM pairing or
recover input. Enable only on a TRUSTED network.
They were right. The `gamestream` task carried no `Flags: unchecked`, so it was
pre-ticked; and since a silent install takes the wizard's own task defaults
(1839d756), a winget install turned it on with no checkbox ever shown. The host
warns that this plane is a security downgrade on every single start, so having
the installer enable it by default cannot be squared with our own advice — least
of all on the path where nobody sees a wizard.
Now unchecked, matching `allowpublicfw`, the other task with a security
consequence. A default install therefore lands `PUNKTFUNK_HOST_CMD=serve`, the
native-only host; Punktfunk's own clients are unaffected, since the native
punktfunk/1 plane is always on. Unattended opt-in is `/MERGETASKS=gamestream`.
Scope, deliberately: this changes FRESH installs only. `GamestreamParam` already
omits the flag entirely unless `FreshHostInstall`, so no existing host has its
choice touched by an upgrade, and anyone relying on Moonlight today keeps it.
`DEFAULT_HOST_CMD` (the service's fallback when host.env carries no
PUNKTFUNK_HOST_CMD line at all) is deliberately NOT flipped here: the installer
always writes the line explicitly, so it does not affect a normal install, and
inverting it would silently disable Moonlight for anyone whose host.env lost that
line — a runtime regression that belongs in its own change, if at all.
Docs corrected everywhere they stated the old default, since three of them now
told users the opposite of what ships: the winget Agreement shown BEFORE install
(it said "enabled by default" and gave the opt-OUT override), the Windows
packaging README, and host.env.example. The `--override` example in the installer
manifest is inverted with it (`/MERGETASKS=gamestream` to add, `!` to remove).
Verified: [Tasks] + [Code] compile with ISCC 6.7.1 on the windows-amd64 runner
(all optional features defined), and the winget catalogue rebuilds and passes
29/29 with the edited manifests.
64 lines
3.5 KiB
YAML
64 lines
3.5 KiB
YAML
# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.6.0.schema.json
|
|
#
|
|
# Installer manifest for the Windows host (packaging/windows/punktfunk-host.iss -> Inno Setup 6).
|
|
#
|
|
# The host is a machine-wide, elevated install: it registers a SYSTEM service, installs the
|
|
# pf-vdisplay + gamepad drivers, and opens firewall ports. There is no per-user scope.
|
|
PackageIdentifier: unom.PunktfunkHost
|
|
PackageVersion: 0.19.2
|
|
|
|
InstallerType: inno
|
|
Scope: machine
|
|
# PrivilegesRequired=admin in the .iss -> Setup raises its own UAC prompt.
|
|
ElevationRequirement: elevatesSelf
|
|
# Windows 11 22H2 floor: pf-vdisplay is built against IddCx 1.10 with no runtime downgrade, so on
|
|
# anything older the device fails to start with Code 10 (see the MinVersion gate in the .iss).
|
|
MinimumOSVersion: 10.0.22621.0
|
|
|
|
InstallModes:
|
|
# interactive keeps the FULL wizard — every task checkbox, the web-console password page, and the
|
|
# VB-CABLE notice text. `winget install unom.PunktfunkHost --interactive`.
|
|
- interactive
|
|
- silent
|
|
- silentWithProgress
|
|
|
|
InstallerSwitches:
|
|
# Spelled out rather than relying on winget's built-in `inno` defaults, so the unattended
|
|
# behaviour is reviewable here. No /MERGETASKS: a silent install deliberately takes the SAME
|
|
# task defaults the wizard shows, so the product does not differ by install channel. The
|
|
# disclosures the wizard puts on screen are carried by Agreements/InstallationNotes in the
|
|
# locale manifest instead.
|
|
#
|
|
# To CHANGE individual tasks, callers pass Inno's /MERGETASKS via --override: a bare name adds a
|
|
# task, a `!` prefix removes one. GameStream is opt-in (its plane pairs over plain HTTP), so
|
|
# enabling it unattended is the additive form:
|
|
# winget install unom.PunktfunkHost --override "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=gamestream"
|
|
# and dropping a default-on task is the negated form, e.g. /MERGETASKS=!trayicon
|
|
# Task names: installdriver, installgamepad, installaudiocable, installhdrlayer,
|
|
# gamestream, allowpublicfw, startservice, trayicon
|
|
Silent: /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
|
|
SilentWithProgress: /SILENT /SUPPRESSMSGBOXES /NORESTART /SP-
|
|
# <LOGPATH> is winget's OWN token and the only spelling it substitutes (see the schema this file
|
|
# declares: "…<LOGPATH> token can be included in the switch value so that winget will replace the
|
|
# token with user provided path"). It was written |LOGPATH| — not a token, so winget passed the
|
|
# literal string through and Inno rejected it: `|` is not legal in a Windows filename, giving
|
|
# "Error creating log file: The filename, directory name, or volume label syntax is incorrect."
|
|
# That aborted the install in EVERY mode, interactive included, for any caller that asks for a
|
|
# log — UniGetUI does so by default, which is how it was reported.
|
|
Log: /LOG="<LOGPATH>"
|
|
|
|
# Inno writes its ARP entry under <AppId>_is1; this is what correlates an installed host with the
|
|
# package for `winget list` / `winget upgrade`. Must track AppId in the .iss.
|
|
ProductCode: '{7C9E6A52-1F4B-4E8D-A3C7-2B5D8F1E0A93}_is1'
|
|
# Inno upgrades in place (UsePreviousAppDir=yes) — do not uninstall first, that would run the
|
|
# [UninstallRun] service/driver teardown between versions.
|
|
UpgradeBehavior: install
|
|
|
|
Installers:
|
|
- Architecture: x64
|
|
InstallerUrl: https://git.unom.io/unom/punktfunk/releases/download/v0.19.2/punktfunk-host-setup-0.19.2.exe
|
|
InstallerSha256: 96964117125BFD5AC4556987DAFAA3966A4A57BBC29C838803857852D595BF4D
|
|
|
|
ManifestType: installer
|
|
ManifestVersion: 1.6.0
|