search

boxcutter / windows

Virtual machine templates for Windows written in legacy JSON and Batch Scripting/JScript
Apache License 2.0
753 stars 266 forks source link

This improves the 01-install-wget.cmd bootstrap script by including a local curl.exe on the floppy disk #240

Closed arizvisa closed 4 years ago

arizvisa commented 4 years ago

The version of wget.exe hosted on https://eternallybored.org does not work on a couple of the templates that we're building, and is also forcing a minimum Tls version of 1.2 which is not supported on our older templates.

This PR fixes this issue by bundling a smaller and more compatible version of wget.exe on the floppy during the build. We still try and every other download method in order to do the bootstrap, but if none of those things work..we fall back to using the one in the repository. The script is also re-factored and includes a ton of comments so that users can understand more about the magic that's going on.

This PR also adjusts all of the templates to include the 3rdparty/wget.exe binary in their floppy_files.

This aims to closes issue #237 and is based on PR #239.

arizvisa commented 4 years ago

This seems to still work with: eval-win81x86-enterprise.json

arizvisa commented 4 years ago

So when testing the win7 templates, it turned out that wget.exe just would not work on either the 32-bit or 64-bit versions due to missing Tls12 support on those platforms. As none of the other download methods are available, this made it impossible to bootstrap wget.exe.

At this point I came to the conclusion that it might be a good time to start keeping all of the template dependencies local to the repository as since we don't control the servers that are hosting the software we depend on, it makes it easy for some third party to break the way templates are built.

So the first thing I did was experiment with bundling wget.exe which seemed to work. However, when I got to testing the win7 vms, I encountered issues with wget.exe working on those. More importantly, most versions of wget.exe are huge and larger than the floppy disk size that Packer supports. I tried compiling a local version on Friday, but could not get it any smaller really due to the massive code that is OpenSSL.

Last night I stayed up and was able to successfully build a Windows version of Curl that supports ssl/ftp, and links directly with msvcrt.dll. Since microsoft's active system protection keeps this dll untamperable, the version of curl should work on all their platforms. After building, it was about ~560k, but compressing it with upx brings it down to a more reasonable ~250k. The rules for building it are at github.com/arizvisa/curl-windows-nodeps/ so at least this way it'll be a lot easier to maintain and people can see the source instead of trusting someone to not backdoor it.

Curl.exe is only being used as a fall-back due to the whole project originally revolving around wget.exe. At some point if people care we can switch that, but I'm okay with whatever as long as the templates can build without me having to stare at them.

arizvisa commented 4 years ago

I also wrote some documentation which explains all of the third party things that we download. This way people can indepdenantly decide whether or not they want to trust us downloading it on their behalf for their templates. At some point I'd like to again host this locally similar to curl.exe, but that's not really up to me. (I think?)

arizvisa commented 4 years ago

Okay. Now I'm re-testing Windows 7 with these new additions. Hopefully it goes well...

arizvisa commented 4 years ago

Successfully tested the eval-win7x64-enterprise.json template after fixing a few things. If the eval-win7x86-enterprise.json template works, then this and PR #239 can be merged.

arizvisa commented 4 years ago

Okay. Was able to build the following VMs using a combination of this PR along with #239

Just need to do a code review to double-check things.

arizvisa commented 4 years ago

Re-based onto master and force-pushed prior to review.