pbatard / Fido

A PowerShell script to download Windows or UEFI Shell ISOs
GNU General Public License v3.0
2.41k stars 228 forks source link

Add support for downloading Media Creation Tool ESDs #86

Closed driver1998 closed 9 months ago

driver1998 commented 9 months ago

As the name suggests, these are the files actually downloaded by the Media Creation Tool.

Some valid points:

How to get the file list with MCT:

<MCT>
  <Catalogs>
    <Catalog version="1.4.1">
      <PublishedMedia id="" release="">
        <Files>
          <File id="">
            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_zh-cn.esd</FileName>
            <LanguageCode>zh-cn</LanguageCode>
            <Language>Chinese (Simplified, China)</Language>
            <Edition>Core</Edition>
            <Architecture>ARM64</Architecture>
            <Size>3819160148</Size>
            <Sha1>296d7f8361ba34db797b8ffd29496ecd36dacb27</Sha1>
            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/bd6b5fe4-348a-4fb1-97e9-297c9136dfc2/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_zh-cn.esd</FilePath>
            <Key />
            <Architecture_Loc>%ARCH_64%</Architecture_Loc>
            <Edition_Loc>%CLIENT%</Edition_Loc>
            <IsRetailOnly>True</IsRetailOnly>
          </File>
        </Files>
      </PublishedMedia>
    </Catalog>
  </Catalogs>
</MCT>

MCT ESD layout:

Image 1:  Windows Setup Media (All the files on the ISO, except WIMs)
Image 2:  boot.wim Image 1
Image 3:  boot.wim Image 2
Image 4+: install.wim Images
pbatard commented 9 months ago

and can be used to build ISOs with minimal effort

But why, when you can download the full ISOs, and, as opposed to ESB built ISOs, they can be formally validated. Even if you can validate the SHA-1 of the individual components, it doesn't remove the fact that people still need to trust the script, whereas, in its current form, people who don't trust the script can easily validate that it's not doing anything dodgy.

If I were to add ISO from ESD in Fido, I'm pretty sure I'd get quite a few of "Because your script is creating ISOs that can't be formally validated, how can we be sure that Fido is not injecting malware into the resulting ISO?".

I will also very much dispute the "minimal effort", which looks like something someone, who doesn't have to perform the task themselves, and especially will not have to support it for years thereafter, would say. Anything you don't have to do yourself looks like a 5 minutes job.

This is the only way to download official ARM64 installation media from Microsoft

Then complain to Microsoft that they need to release official ISOs for ARM64, like they should have done a long time ago.

There's really no point of adding another route to get from point A to point B when you already have a perfectly suitable road, and I have zero time to inject in what I don't consider to be a needed endeavour. → Rejected.