Share via

Content Installer News

  • Article

Recently I uploaded new builds of the Content Installer Power Toys. This upload fixes a few small bugs, including one bug with the shipping version of Visual Studio. To sign a file with Authenticode, the file being signed needs to be a PE file (such as an exe or dll), but a VSI file is just a zip file but with a different extension. To work around this, a tool named MakeZipExe was included with VS. This tool takes a stub exe and binds a zip file into the unmanaged resources of the stub file. The stub is managed code, and also has the ability to extract the contents of the zip file to disk (a self-extracting exe). But there was a problem with this stub. When we were making the final build of VS, a switch inside of our build process was flipped, and the file (which was marked delay sign) was strong name signed. When the zip file is attached to the stub that changes the file, and so strong name verification would fail when trying to extract the zip file. To work around this, when you install the power toys a new stub file is put on disk. This one is written using VC and it is a DLL, so you will not be able to use the result as a self-extracting exe but you will be able to sign the file.

I have also uploaded the source code to all but two of the custom content installers. You can use this source to see how these custom installers work. The only custom installers that you do not have the source to are two new installers; the Wizard Extension and Custom Content Type installers. The Visual Studio Template Wizard allows you to build components that are loaded by the wizard and lets you customize how to create new projects and project items. The Wizard Extension installer allows you to install these wizard extensions. The Custom Content Type installer allows you to install your own custom content type installers for the Content Installer. The reason I am not distributing the source to these two new content installer types is because installing these types can be considered a security risk. Suppose you accidentally install a malicious Wizard Extension, then you install a new project template that uses this wizard extension. Just by running the template, you will be invoke the wizard extension, and therefore cause harm to your computer. These content installers will put up error messages when installing a custom content type or a wizard extension, and while it would not be hard for you to build your own content installers for these types, it reduces the risk.

Over the past few months I have been talking about the Community Content Hosting web site starter kit. I have registered a domain at https://www.craigscontenthost.com that hosts this web site, and pre-populated it with a few content files. Feel free to create accounts and upload your own content to this web site. Let me know of any bugs that you find and I will update the web site as well as the starter kit. I have a few small updates to make to the web site and starter kit (such as allowing you to write a short bio so that people can see who wrote their content), and these will be rolling out in the next week or so, but this will be enough to get you started.

Comments