Signing an Uninstaller - Revision history

ChrFranke: Use case of dummy !uninstfinalize

2024-01-21T18:44:01Z

Use case of dummy !uninstfinalize

â† Older revision		Revision as of 18:44, 21 January 2024
Line 1:		Line 1:
	<div style="background-color:#FFFFDD;border:1px solid #aaaa22;color:#333311;padding:0.4em"><b>Note:</b> NSIS v3.08 added support for <span style="font-family: monospace, monospace;">!uninstfinalize</span> that allows you to sign the uninstaller directly without the workaround from this page.</div>		<div style="background-color:#FFFFDD;border:1px solid #aaaa22;color:#333311;padding:0.4em"><b>Note:</b> NSIS v3.08 added support for <span style="font-family: monospace, monospace;">!uninstfinalize</span> that allows you to sign the uninstaller directly without the workaround from this page.<br>
			<b>Note 2:</b> Running a dummy command with <span style="font-family: monospace, monospace;">!uninstfinalize</span> may also be useful if only the installer will be signed. This could prevent bogus header fields in the uninstaller, see [https://sourceforge.net/p/nsis/feature-requests/577/ feature request ticket #577].
			</div>

Anders: Added !uninstfinalize note

2021-08-18T16:02:55Z

Added !uninstfinalize note

â† Older revision		Revision as of 16:02, 18 August 2021
Line 1:		Line 1:
			<div style="background-color:#FFFFDD;border:1px solid #aaaa22;color:#333311;padding:0.4em"><b>Note:</b> NSIS v3.08 added support for <span style="font-family: monospace, monospace;">!uninstfinalize</span> that allows you to sign the uninstaller directly without the workaround from this page.</div>


	Especially since Windows Vista, installer/uninstaller binaries need to be signed to avoid alarming looking dialog boxes with dire warnings about "unknown publishers" etc.		Especially since Windows Vista, installer/uninstaller binaries need to be signed to avoid alarming looking dialog boxes with dire warnings about "unknown publishers" etc.

9999 at 19:52, 4 July 2021

2021-07-04T19:52:53Z

â† Older revision		Revision as of 19:52, 4 July 2021
Line 21:		Line 21:
	!makensis '/DINNER "${__FILE__}"' = 0		!makensis '/DINNER "${__FILE__}"' = 0

	; So now run that installer we just created as %TEMP%\tempinstaller.exe~~. Since it~~		; So now run that installer we just created as %TEMP%\tempinstaller.exe.
	~~; calls quit the return value isn't zero~~.

	!system 'set __COMPAT_LAYER=RunAsInvoker&"$%TEMP%\tempinstaller.exe"' = 2		!system 'set __COMPAT_LAYER=RunAsInvoker&"$%TEMP%\tempinstaller.exe"' = 0

	; That will have written an uninstaller binary for us. Now we sign it with your		; That will have written an uninstaller binary for us. Now we sign it with your
Line 47:		Line 46:
	SetSilent silent		SetSilent silent
	WriteUninstaller "$%TEMP%\uninstaller.exe"		WriteUninstaller "$%TEMP%\uninstaller.exe"
			SetErrorLevel 0 ; avoid exit code 2
	Quit ; just bail out quickly when running the "inner" installer		Quit ; just bail out quickly when running the "inner" installer
	!endif		!endif

9999 at 19:04, 4 July 2021

2021-07-04T19:04:47Z

â† Older revision		Revision as of 19:04, 4 July 2021
Line 99:		Line 99:

	This prevents yet another warning message.		This prevents yet another warning message.

			[[User:9999\|9999]] 4 July 2021: Setting "SetCompress off" is not a good idea since it will result in a larger uninstaller.


	[[Category: Code Examples]]		[[Category: Code Examples]]

Anders: Removed useless cat.

2020-05-23T01:14:34Z

Removed useless cat.

â† Older revision		Revision as of 01:14, 23 May 2020
Line 102:		Line 102:

	[[Category: Code Examples]]		[[Category: Code Examples]]
	~~[[Category: Vista]]~~

Anders: Added code to be filled in by user

2020-03-03T01:30:05Z

Added code to be filled in by user

â† Older revision		Revision as of 01:30, 3 March 2020
Line 6:		Line 6:

	<highlight-nsis>		<highlight-nsis>
			#TODO: RequestExecutionLevel
			#TODO: InstallDir

	!ifdef INNER		!ifdef INNER
	!echo "Inner invocation" ; just to see what's going on		!echo "Inner invocation" ; just to see what's going on

Anders: Removed invalid RequestExecutionLevel

2020-03-03T01:28:47Z

Removed invalid RequestExecutionLevel

â† Older revision		Revision as of 01:28, 3 March 2020
Line 43:		Line 43:
	; this entire code path is not present in the final (real) installer.		; this entire code path is not present in the final (real) installer.
	SetSilent silent		SetSilent silent
	~~RequestExecutionLevel user ; don't write uninstaller with admin permissions and prevent invoking UAC~~
	WriteUninstaller "$%TEMP%\uninstaller.exe"		WriteUninstaller "$%TEMP%\uninstaller.exe"
	Quit ; just bail out quickly when running the "inner" installer		Quit ; just bail out quickly when running the "inner" installer

Anders: Don't elevate uninstaller

2020-03-03T01:25:26Z

Don't elevate uninstaller

â† Older revision		Revision as of 01:25, 3 March 2020
Line 21:		Line 21:
	; calls quit the return value isn't zero.		; calls quit the return value isn't zero.

	!system "$%TEMP%\tempinstaller.exe" = 2		!system 'set __COMPAT_LAYER=RunAsInvoker&"$%TEMP%\tempinstaller.exe"' = 2

	; That will have written an uninstaller binary for us. Now we sign it with your		; That will have written an uninstaller binary for us. Now we sign it with your

Bugmenot: fix comments, make INNER installer silent and not trigger UAC ; wiki links

2018-09-26T14:33:56Z

fix comments, make INNER installer silent and not trigger UAC ; wiki links

â† Older revision		Revision as of 14:33, 26 September 2018
Line 1:		Line 1:
	Especially ~~under~~ Windows Vista, installer/uninstaller binaries need to be signed to avoid alarming looking dialog boxes with dire warnings about "unknown publishers" etc.		Especially since Windows Vista, installer/uninstaller binaries need to be signed to avoid alarming looking dialog boxes with dire warnings about "unknown publishers" etc.

	This presents a difficulty in that the uninstaller binary would normally never be present on your development/packaging machine, only being written onto the target machine at install time. So how can you sign it?		This presents a difficulty in that the uninstaller binary would normally never be present on your development/packaging machine, only being written onto the target machine at install time. So how can you sign it?

	The answer is to run the installer on the development machine in a special mode which ''only'' writes the uninstaller to some known location, then sign that binary in the usual way, and finally package the signed uninstaller using a normal <code>File</code> command rather than <code>WriteUninstaller</code>.		The answer is to run the installer on the development machine in a special mode which ''only'' writes the uninstaller to some known location, then sign that binary in the usual way, and finally package the signed uninstaller using a normal <code>[[Reference/File\|File]]</code> command rather than <code>[[Reference/WriteUninstaller\|WriteUninstaller]]</code>.

	<highlight-nsis>		<highlight-nsis>
Line 34:		Line 34:
	!endif		!endif

	...		; ...

	Function .onInit		Function .onInit
Line 40:		Line 40:

	; If INNER is defined, then we aren't supposed to do anything except write out		; If INNER is defined, then we aren't supposed to do anything except write out
	; the ~~installer~~. This is better than processing a command line option as it means		; the uninstaller. This is better than processing a command line option as it means
	; this entire code path is not present in the final (real) installer.		; this entire code path is not present in the final (real) installer.
			SetSilent silent
			RequestExecutionLevel user ; don't write uninstaller with admin permissions and prevent invoking UAC
	WriteUninstaller "$%TEMP%\uninstaller.exe"		WriteUninstaller "$%TEMP%\uninstaller.exe"
	Quit ; just bail out quickly when running the "inner" installer		Quit ; just bail out quickly when running the "inner" installer
	!endif		!endif

	...[the rest of your normal .onInit]...		; ...[the rest of your normal .onInit]...
	FunctionEnd		FunctionEnd

	...		; ...

	Section "Files" ; or whatever		Section "Files" ; or whatever

	...		; ...

	; where you would normally put WriteUninstaller ${INSTDIR}\uninstaller.exe put instead:		; where you would normally put WriteUninstaller ${INSTDIR}\uninstaller.exe put instead:
Line 66:		Line 67:
	!endif		!endif

	...		; ...
	SectionEnd		SectionEnd

Line 73:		Line 74:

	; your normal uninstaller section or sections (they're not needed in the "outer"		; your normal uninstaller section or sections (they're not needed in the "outer"
	; installer and will just cause warnings because there is no ~~WriteInstaller~~ command)		; installer and will just cause warnings because there is no WriteUninstaller command)

	SectionEnd		SectionEnd
Line 82:		Line 83:


	This script should just be compiled in the usual way. It will invoke makensis a second time with the additional symbol INNER defined to generate a slightly unusual installer that does nothing except write the uninstaller binary to a specified location (%TEMP%/uninstaller.exe). Next it actually invokes the generated installer and sure enough it writes %TEMP%/uninstaller.exe with no user interaction needed. Now we can sign the binary with our usual tools (I use SIGNCODE because I have a rather arcane development environment, but SIGNTOOL would be more usual I guess). Once that is done, we run through the rest of the normal stuff, except instead of calling <code>WriteUninstaller</code> again we just package the already-created, signed uninstaller instead. Job done.		This script should just be compiled in the usual way. It will invoke makensis a second time with the additional symbol INNER defined to generate a slightly unusual installer that does nothing except write the uninstaller binary to a specified location (%TEMP%/uninstaller.exe). Next it actually invokes the generated installer and sure enough it writes %TEMP%/uninstaller.exe with no user interaction needed. Now we can sign the binary with our usual tools (I use SIGNCODE because I have a rather arcane development environment, but SIGNTOOL would be more usual I guess). Once that is done, we run through the rest of the normal stuff, except instead of calling <code>[[Reference/WriteUninstaller\|WriteUninstaller]]</code> again we just package the already-created, signed uninstaller instead. Job done.

	Hope you find this helpful.		Hope you find this helpful.

Bugmenot: use the reliable !makensis instead of !system ${NSISDIR}\makensis hackery

2017-11-29T10:54:31Z

use the reliable !makensis instead of !system ${NSISDIR}\makensis hackery

â† Older revision		Revision as of 10:54, 29 November 2017
Line 16:		Line 16:
	; it is invoked, will just write the uninstaller to some location, and then exit.		; it is invoked, will just write the uninstaller to some location, and then exit.

	!~~system "$\"${NSISDIR}\~~makensis~~$\"~~ /DINNER ${__FILE__}" = 0		!makensis '/DINNER "${__FILE__}"' = 0

	; So now run that installer we just created as %TEMP%\tempinstaller.exe. Since it		; So now run that installer we just created as %TEMP%\tempinstaller.exe. Since it