tl;dr: I need a way to setup an inner invocation of makensis so that it creates a User level installer for an Admin level uninstaller and an outer invocation of makensis such that it creates an Admin level installer.
==================================
I have implemented the two-pass solution to getting a signed uninstaller that has been detailed in earlier threads here. It works well, however there is a wrinkle that I've just discovered due to our "hermetic" build systems...
I am creating an Admin level installer/uninstaller -- they need to write to both $PROGRAMFILES and HKLM. The act of running makensis, however, does not require elevation.
Our build environment for releases uses a farm of servers that are "hermetically sealed," very secure, headless, and do not run the builds with elevated access.
What I'm getting hit by is the nature of the two-phase solution to getting a signed uninstaller which is to run an inner instance of makensis just to create a temporary installer that, when run, writes the uninstaller to disk so that it can be signed and incorporated as a normal file in the initial (outer) instance of makensis.
If I set the required user level to Admin (which it ultimately needs) then the attempt to execute the temporary installer causes the build systems to hang (waiting for the UAC confirmation that can never occur since they are headless).
If I set the required user level to User for the inner invocation of makensis it avoids this issue, but results in an uninstaller that does not request elevation and thus does not properly clean up in $PROGRAMFILES or HKLM.
Uninstallers, code signing, and admin level woes
2 posts