On 11/2/2017 8:10 PM, Michael Meeks wrote: > * Completed Action Items: > + ship the horror win / VC runtime DLLs with the installer (Cloph) > [ patch appears to work, but we already have them in the installer > if you do an admin-install they are already installed. > we ship them twice – once as LibreOffice, but once as a run-time > module > not entirely elegant. > for 5.4 – merge it as-is, for 6.0 do something clever. > http://dev-builds.libreoffice.org/daily/libreoffice-5-4/Win-x86@62-TDF/tdf_108580/ > ]
1. For 6.0, we would not need to ship the merge module - because that module is only working for WinXP. So that leaves us with just one copy. 2. Still, having app-local DLLs is worse than system-updateable (at least security-wise: if we bundle app-local DLLs, then we would have to put their advisories to our site? so that users using not-up-to-date LO versions could know that they might be vulnerable, despite having updated their systems). So, we could try to include MSUs from KB2999226 [1]. There are 3 different packages for each bitness that cover all supported platforms requiring the update (Win7, Win8, Win8.1): - for x86: Windows6.1-KB2999226-x86.msu Windows8-RT-KB2999226-x86.msu Windows8.1-KB2999226-x86.msu - for x64: Windows6.1-KB2999226-x64.msu Windows8-RT-KB2999226-x86.msu Windows8.1-KB2999226-x64.msu The size of all three x86 packages is 1.77 MB total; three x64 packages are 3.24 MB total. The MSUs are installable using Windows Update Standalone Installer [2] (system component in all those Windows versions). Custom actions would need to be created, with relevant conditions (VersionNT; [3]). The drawbacks (besides extra size): 1. We need to also check for pre-conditions: if the KB2999226 is already installed; if required pre-requisite KBs are present (see [1]; prerequisites exist for Win7 and Win8.1 - curiously no preconditions for Win8). For Win7, the prerequisite is SP1, so may just state this version as system requirement? For Win8.1, the prerequisite is [4], which is several hundred MB... 2. We somehow need to get the packages to dev environment when building the installer - should we put the blobs to our server to fetch as external package on build? (I don't know if there's a static URL for those files on MS site.) [1] https://support.microsoft.com/en-us/help/2999226 [2] https://support.microsoft.com/en-us/help/934307 [3] https://msdn.microsoft.com/en-us/library/aa370556 [4] https://support.microsoft.com/en-us/help/2919355 -- Best regards, Mike Kaganski _______________________________________________ LibreOffice mailing list LibreOffice@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice