Roland/Assetmanager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

software package profiles implemeted, job deletion optimized

Browse Source
This commit is contained in:
Roland
2026-09-26 13:07:23 +02:00
parent 87a5041162
commit 7d314057e4
54 changed files with 3492 additions and 342 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SETUP_ANALYZER.md
+39 -2
View File
@@ -13,7 +13,8 @@ The Setup Analyzer prepares Windows installation files for silent deployment wit
- InstallShield
- Advanced Installer
- Squirrel
- common 7-Zip and WinRAR SFX wrappers
- ZIP-compatible, 7-Zip and WinRAR/RAR SFX wrappers
- vendor profiles for Total Commander SFX and the PDF24 Creator online bootstrapper
- unknown EXE fallback
## Analysis output
@@ -50,6 +51,18 @@ Generated installation scripts no longer use `Start-Process -Wait` for the insta
The optional **Suppress post-install browser launch** setting terminates only browser processes that were newly created inside the installer process tree. Existing browser sessions are not touched. The option is preselected for Greenshot detections because Greenshot installers can open a completion web page after setup.
## SFX and embedded installers
Version 0.5.5.89 adds recursive static analysis of supported self-extracting installer containers. AssetManager never executes the uploaded SFX on the server. It first identifies the outer wrapper and then attempts to list and extract the payload with safe path, file-count, expanded-size and recursion limits.
Supported extraction paths include ZIP-compatible self-extracting files, 7-Zip SFX containers through the 7-Zip command-line tool, and WinRAR/RAR SFX containers through `unar` / `lsar` with 7-Zip as an additional fallback where supported by the installed build.
After extraction, embedded MSI/MSP/MSIX/AppX/MSU and EXE installer candidates are analyzed with the same static technology detector. Nested SFX candidates can be opened recursively up to the configured depth. Candidate selection is heuristic: known installer technologies, setup-like filenames and usable product metadata increase the score, while uninstallers and common prerequisite redistributables are strongly penalized. The selected candidate and alternatives are shown in the UI.
When an embedded installer is selected, package creation preserves the complete extracted payload rather than copying only the selected installer. AssetManager stores that payload in an internal ZIP, transfers it as one package file, expands it on the Windows target, and runs the selected embedded installer from its original relative directory. This preserves adjacent CAB files and subdirectories needed by many vendor packages.
The SFX feature still cannot guarantee that the heuristically selected inner installer is the vendor-supported deployment entry point. Always test the generated package on a designated test asset.
## Security
The uploaded installer is stored in a temporary directory and is not executed. Access is restricted to administrators. Old temporary analyses are removed after the configured retention period.
@@ -60,7 +73,10 @@ Environment variables:
SETUP_ANALYZER_TMP_DIR=/tmp/assetmanager-setup-analyzer
SETUP_ANALYZER_MAX_UPLOAD_MB=4096
SETUP_ANALYZER_RETENTION_HOURS=24
SOFTWARE_PACKAGE_DIR=/app/data/software-packages
SETUP_ANALYZER_MAX_EXTRACTED_MB=8192
SETUP_ANALYZER_MAX_EXTRACTED_FILES=20000
SETUP_ANALYZER_MAX_SFX_DEPTH=2
SOFTWARE_PACKAGE_DIR=/assetmanager-data/software-packages
```
## MSI metadata
@@ -70,3 +86,24 @@ Standard MSI silent-command generation works without additional system packages.
## Important
Installer technology detection and a suggested command do not guarantee vendor-specific compatibility. Test generated commands on a designated test asset before broad deployment.
## Vendor bootstrapper notes
Total Commander SFX installers are detected through their embedded `INSTALL.INF`. AssetManager uses `/AH1` for unattended hidden installation and shows `/A1` as the visible automatic alternative.
The small `pdf24-creator-installer.exe` is treated as an online bootstrapper rather than as the full PDF24 Creator Inno Setup package. It selects an architecture-specific current installer at runtime, so its package version is intentionally left unpinned. The analyzer surfaces `/SILENT` with medium confidence and recommends using the offline EXE or MSI when deterministic deployment is required.
## Analyzer profiles (0.5.5.90)
Vendor- and installer-specific detection knowledge is no longer added to the Python analyzer as product-specific branches. The generic analyzer engine loads declarative profiles from:
- `app/analyzer_profiles/system/` for profiles shipped with AssetManager,
- `/assetmanager-data/analyzer-profiles/community/` for imported/community profiles,
- `/assetmanager-data/analyzer-profiles/local/` for locally maintained overrides.
Profiles can contribute static markers, match rules, installer metadata extraction, architecture rules, silent parameters, process-control defaults and post-install defaults. Community and local profiles can override a system profile by using the same stable profile ID. The profile manager is available under **Software -> Setup Analyzer -> Analyzer profiles**.
Profiles are exchanged as `.amprofile` bundles and contain declarative JSON only. They cannot execute Python code. A separately hosted HTTPS repository can provide a catalog of `.amprofile` bundles through `ANALYZER_PROFILE_REPOSITORY_URL`; administrators explicitly choose profiles to install.
Software packages can be exported as `.ampkg` and re-imported. If the package was created from an analyzer profile, the export can embed that `.amprofile`; the importing administrator may explicitly choose whether to install the embedded profile as a Community profile.