@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.4

package/src/windows_install/payload.zig

@@ -0,0 +1,146 @@
+//! The setup program's payload: `native package --installer` appends the
+//! install configuration and the install image (a ZIP) to the setup
+//! program, followed by a fixed trailer that locates both and carries
+//! their SHA-256. Signing setup.exe with Authenticode appends the
+//! certificate table after the trailer (8-byte aligned), so the reader
+//! looks for the trailer just before that table when the PE header names
+//! one, and at the end of the file otherwise.
+
+const std = @import("std");
+
+pub const magic = "NSDK-SETUP-V1\x00\x00\x00";
+pub const trailer_len: usize = magic.len + 4 * @sizeOf(u64) + Sha256.digest_length;
+
+const Sha256 = std.crypto.hash.sha2.Sha256;
+
+pub const Trailer = struct {
+    config_offset: u64,
+    config_size: u64,
+    zip_offset: u64,
+    zip_size: u64,
+    sha256: [Sha256.digest_length]u8,
+
+    /// The setup program itself: everything before the configuration.
+    pub fn programSize(self: Trailer) u64 {
+        return self.config_offset;
+    }
+};
+
+pub fn encode(trailer: Trailer) [trailer_len]u8 {
+    var bytes: [trailer_len]u8 = undefined;
+    @memcpy(bytes[0..magic.len], magic);
+    std.mem.writeInt(u64, bytes[16..24], trailer.config_offset, .little);
+    std.mem.writeInt(u64, bytes[24..32], trailer.config_size, .little);
+    std.mem.writeInt(u64, bytes[32..40], trailer.zip_offset, .little);
+    std.mem.writeInt(u64, bytes[40..48], trailer.zip_size, .little);
+    @memcpy(bytes[48..80], &trailer.sha256);
+    return bytes;
+}
+
+/// Decodes a trailer and checks that the regions it names sit in order
+/// before `trailer_offset`.
+pub fn decode(bytes: *const [trailer_len]u8, trailer_offset: u64) ?Trailer {
+    if (!std.mem.eql(u8, bytes[0..magic.len], magic)) return null;
+    const trailer: Trailer = .{
+        .config_offset = std.mem.readInt(u64, bytes[16..24], .little),
+        .config_size = std.mem.readInt(u64, bytes[24..32], .little),
+        .zip_offset = std.mem.readInt(u64, bytes[32..40], .little),
+        .zip_size = std.mem.readInt(u64, bytes[40..48], .little),
+        .sha256 = bytes[48..80].*,
+    };
+    if (trailer.config_offset == 0 or trailer.config_size == 0 or trailer.zip_size == 0) return null;
+    const config_end = std.math.add(u64, trailer.config_offset, trailer.config_size) catch return null;
+    if (trailer.zip_offset != config_end) return null;
+    const zip_end = std.math.add(u64, trailer.zip_offset, trailer.zip_size) catch return null;
+    if (zip_end != trailer_offset) return null;
+    return trailer;
+}
+
+/// Where the setup data ends: the start of the Authenticode certificate
+/// table when the PE header names one that ends the file, else the file
+/// size. `headers` holds the file's first bytes (at least the PE headers).
+pub fn dataEnd(headers: []const u8, file_size: u64) u64 {
+    if (headers.len < 0x40 or !std.mem.eql(u8, headers[0..2], "MZ")) return file_size;
+    const pe_offset: usize = std.mem.readInt(u32, headers[0x3c..0x40], .little);
+    if (pe_offset > headers.len -| 24 or !std.mem.eql(u8, headers[pe_offset..][0..4], "PE\x00\x00")) return file_size;
+    const optional_offset = pe_offset + 24;
+    if (optional_offset + 2 > headers.len) return file_size;
+    const directories_offset: usize = switch (std.mem.readInt(u16, headers[optional_offset..][0..2], .little)) {
+        0x10b => optional_offset + 96,
+        0x20b => optional_offset + 112,
+        else => return file_size,
+    };
+    const security_offset = directories_offset + 4 * 8;
+    if (security_offset + 8 > headers.len) return file_size;
+    const table_offset: u64 = std.mem.readInt(u32, headers[security_offset..][0..4], .little);
+    const table_size: u64 = std.mem.readInt(u32, headers[security_offset + 4 ..][0..4], .little);
+    if (table_offset == 0 or table_size == 0 or table_offset + table_size != file_size) return file_size;
+    return table_offset;
+}
+
+/// Finds the trailer in the bytes that end at `end` (`tail` holds those
+/// bytes, at least `trailer_len + 7` of them when available), allowing
+/// the up to seven zero bytes of padding signing adds before the
+/// certificate table.
+pub fn find(tail: []const u8, end: u64) ?Trailer {
+    var padding: usize = 0;
+    while (padding <= 7 and padding + trailer_len <= tail.len) : (padding += 1) {
+        const at = tail.len - padding - trailer_len;
+        for (tail[tail.len - padding ..]) |byte| {
+            if (byte != 0) return null;
+        }
+        if (decode(tail[at..][0..trailer_len], end - padding - trailer_len)) |trailer| return trailer;
+    }
+    return null;
+}
+
+pub fn digest(config_bytes: []const u8, zip_bytes: []const u8) [Sha256.digest_length]u8 {
+    var hasher = Sha256.init(.{});
+    hasher.update(config_bytes);
+    hasher.update(zip_bytes);
+    var out: [Sha256.digest_length]u8 = undefined;
+    hasher.final(&out);
+    return out;
+}
+
+test "a trailer locates the configuration and image before it" {
+    const trailer: Trailer = .{ .config_offset = 1000, .config_size = 200, .zip_offset = 1200, .zip_size = 5000, .sha256 = [_]u8{7} ** 32 };
+    const bytes = encode(trailer);
+    const decoded = decode(&bytes, 6200).?;
+    try std.testing.expectEqual(@as(u64, 1200), decoded.zip_offset);
+    try std.testing.expectEqual(@as(u64, 1000), decoded.programSize());
+    try std.testing.expect(decode(&bytes, 6300) == null);
+    var corrupt = bytes;
+    corrupt[0] = 'X';
+    try std.testing.expect(decode(&corrupt, 6200) == null);
+}
+
+test "the trailer is found before signing padding" {
+    const trailer: Trailer = .{ .config_offset = 10, .config_size = 5, .zip_offset = 15, .zip_size = 20, .sha256 = [_]u8{1} ** 32 };
+    var tail: [trailer_len + 7]u8 = undefined;
+    @memcpy(tail[0..trailer_len], &encode(trailer));
+    @memset(tail[trailer_len..], 0);
+    // Payload ends at 35, the trailer takes 80 bytes, then 7 bytes of
+    // padding precede the certificate table at 122.
+    try std.testing.expectEqual(@as(u64, 15), find(&tail, 35 + trailer_len + 7).?.zip_offset);
+    try std.testing.expectEqual(@as(u64, 15), find(tail[0..trailer_len], 35 + trailer_len).?.zip_offset);
+    tail[trailer_len + 3] = 1;
+    try std.testing.expect(find(&tail, 35 + trailer_len + 7) == null);
+}
+
+test "data ends at a certificate table that ends the file" {
+    var headers = [_]u8{0} ** 0x200;
+    headers[0] = 'M';
+    headers[1] = 'Z';
+    std.mem.writeInt(u32, headers[0x3c..0x40], 0x80, .little);
+    @memcpy(headers[0x80..0x84], "PE\x00\x00");
+    std.mem.writeInt(u16, headers[0x98..0x9a], 0x20b, .little);
+    const security = 0x98 + 112 + 32;
+    std.mem.writeInt(u32, headers[security..][0..4], 4096, .little);
+    std.mem.writeInt(u32, headers[security + 4 ..][0..4], 512, .little);
+    try std.testing.expectEqual(@as(u64, 4096), dataEnd(&headers, 4608));
+    try std.testing.expectEqual(@as(u64, 9000), dataEnd(&headers, 9000));
+    std.mem.writeInt(u32, headers[security..][0..4], 0, .little);
+    try std.testing.expectEqual(@as(u64, 4608), dataEnd(&headers, 4608));
+    try std.testing.expectEqual(@as(u64, 77), dataEnd("not a pe file", 77));
+}

package/src/windows_install/switch.zig

@@ -0,0 +1,184 @@
+//! Moving a staged app version into place inside an install root:
+//!
+//!   <root>\<name>.exe   the launcher, at a stable path
+//!   <root>\app\         the current version
+//!   <root>\app.next\    a staged version, complete once it holds .native-staged
+//!   <root>\app.prev\    the version before the last switch
+//!
+//! The executable inside app\ keeps one path across versions, so the
+//! settings Windows keys to that path (firewall rules, GPU preference,
+//! compatibility flags) survive updates. The switch renames whole
+//! directories. Windows renames a directory even while an executable in
+//! it runs, so callers first make sure no process runs from app\; a
+//! rename that still fails (another program holding a file open) leaves
+//! the install as it was. A journal file marks the window between the two
+//! renames, and `recover` finishes or undoes an interrupted switch on the
+//! next launch.
+
+const std = @import("std");
+
+pub const current = "app";
+pub const staged = "app.next";
+pub const previous = "app.prev";
+pub const journal = ".native-switch";
+/// Written into app.next last, after every file of the staged version.
+pub const staged_marker = ".native-staged";
+/// `updated <from> <to>`, written by the launcher after it switched to a
+/// staged version, and read once by that version's updater.
+pub const update_result = ".native-update-result";
+
+pub const Outcome = enum {
+    /// No complete staged version.
+    nothing_staged,
+    switched,
+    /// A file of the current version is held open; nothing changed.
+    busy,
+};
+
+/// Finishes an interrupted switch, then moves a complete staged version
+/// into place. The caller has checked that no process runs from app\.
+/// The steps:
+///   1. remove an old app.prev,
+///   2. write the journal,
+///   3. rename app -> app.prev,
+///   4. rename app.next -> app,
+///   5. remove the journal.
+/// A failed step 1 or 3 leaves the install as it was.
+pub fn applyStaged(root: std.Io.Dir, io: std.Io) !Outcome {
+    try recover(root, io);
+    if (!exists(root, io, staged ++ "/" ++ staged_marker)) return .nothing_staged;
+
+    if (exists(root, io, previous)) {
+        root.deleteTree(io, previous) catch return .busy;
+    }
+    const had_current = exists(root, io, current);
+    try root.writeFile(io, .{ .sub_path = journal, .data = "switching\n" });
+    if (had_current) {
+        root.renamePreserve(current, root, previous, io) catch {
+            root.deleteFile(io, journal) catch {};
+            return .busy;
+        };
+    }
+    try root.renamePreserve(staged, root, current, io);
+    root.deleteFile(io, current ++ "/" ++ staged_marker) catch {};
+    try root.deleteFile(io, journal);
+    return .switched;
+}
+
+/// Completes or undoes a switch a crash interrupted. Only acts while the
+/// journal exists.
+pub fn recover(root: std.Io.Dir, io: std.Io) !void {
+    if (!exists(root, io, journal)) return;
+    if (!exists(root, io, current)) {
+        if (exists(root, io, staged)) {
+            try root.renamePreserve(staged, root, current, io);
+            root.deleteFile(io, current ++ "/" ++ staged_marker) catch {};
+        } else if (exists(root, io, previous)) {
+            try root.renamePreserve(previous, root, current, io);
+        }
+    }
+    try root.deleteFile(io, journal);
+}
+
+/// Prepares app.next for a new staged copy, removing an earlier one.
+pub fn clearStaged(root: std.Io.Dir, io: std.Io) !void {
+    if (exists(root, io, staged)) try root.deleteTree(io, staged);
+}
+
+/// Marks app.next complete. Call after every file is in place.
+pub fn markStaged(root: std.Io.Dir, io: std.Io) !void {
+    try root.writeFile(io, .{ .sub_path = staged ++ "/" ++ staged_marker, .data = "staged\n" });
+}
+
+fn exists(root: std.Io.Dir, io: std.Io, sub_path: []const u8) bool {
+    root.access(io, sub_path, .{}) catch return false;
+    return true;
+}
+
+fn writeVersion(root: std.Io.Dir, io: std.Io, comptime dir: []const u8, version: []const u8) !void {
+    try root.createDirPath(io, dir ++ "/bin");
+    const path = try std.fmt.allocPrint(std.testing.allocator, "{s}/bin/version.txt", .{dir});
+    defer std.testing.allocator.free(path);
+    try root.writeFile(io, .{ .sub_path = path, .data = version });
+}
+
+fn readVersion(root: std.Io.Dir, io: std.Io, dir: []const u8) ![]u8 {
+    const path = try std.fmt.allocPrint(std.testing.allocator, "{s}/bin/version.txt", .{dir});
+    defer std.testing.allocator.free(path);
+    return root.readFileAlloc(io, path, std.testing.allocator, .limited(64));
+}
+
+test "a first install moves the staged version into place" {
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    const io = std.testing.io;
+    try writeVersion(tmp.dir, io, staged, "1.0.0");
+    try std.testing.expectEqual(Outcome.nothing_staged, try applyStaged(tmp.dir, io));
+    try markStaged(tmp.dir, io);
+    try std.testing.expectEqual(Outcome.switched, try applyStaged(tmp.dir, io));
+    const version = try readVersion(tmp.dir, io, current);
+    defer std.testing.allocator.free(version);
+    try std.testing.expectEqualStrings("1.0.0", version);
+    try std.testing.expect(!exists(tmp.dir, io, staged));
+    try std.testing.expect(!exists(tmp.dir, io, journal));
+    try std.testing.expect(!exists(tmp.dir, io, current ++ "/" ++ staged_marker));
+}
+
+test "a switch keeps the previous version and replaces an older one" {
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    const io = std.testing.io;
+    try writeVersion(tmp.dir, io, previous, "0.9.0");
+    try writeVersion(tmp.dir, io, current, "1.0.0");
+    try writeVersion(tmp.dir, io, staged, "1.1.0");
+    try markStaged(tmp.dir, io);
+    try std.testing.expectEqual(Outcome.switched, try applyStaged(tmp.dir, io));
+    const now = try readVersion(tmp.dir, io, current);
+    defer std.testing.allocator.free(now);
+    const before = try readVersion(tmp.dir, io, previous);
+    defer std.testing.allocator.free(before);
+    try std.testing.expectEqualStrings("1.1.0", now);
+    try std.testing.expectEqualStrings("1.0.0", before);
+}
+
+test "recovery finishes a switch interrupted between its renames" {
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    const io = std.testing.io;
+    // A crash after app -> app.prev and before app.next -> app.
+    try writeVersion(tmp.dir, io, previous, "1.0.0");
+    try writeVersion(tmp.dir, io, staged, "1.1.0");
+    try markStaged(tmp.dir, io);
+    try tmp.dir.writeFile(io, .{ .sub_path = journal, .data = "switching\n" });
+    try recover(tmp.dir, io);
+    const version = try readVersion(tmp.dir, io, current);
+    defer std.testing.allocator.free(version);
+    try std.testing.expectEqualStrings("1.1.0", version);
+    try std.testing.expect(!exists(tmp.dir, io, journal));
+}
+
+test "recovery restores the previous version when the staged copy is gone" {
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    const io = std.testing.io;
+    try writeVersion(tmp.dir, io, previous, "1.0.0");
+    try tmp.dir.writeFile(io, .{ .sub_path = journal, .data = "switching\n" });
+    try recover(tmp.dir, io);
+    const version = try readVersion(tmp.dir, io, current);
+    defer std.testing.allocator.free(version);
+    try std.testing.expectEqualStrings("1.0.0", version);
+}
+
+test "an incomplete staged copy is never switched in" {
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    const io = std.testing.io;
+    try writeVersion(tmp.dir, io, current, "1.0.0");
+    try writeVersion(tmp.dir, io, staged, "1.1.0");
+    try std.testing.expectEqual(Outcome.nothing_staged, try applyStaged(tmp.dir, io));
+    const version = try readVersion(tmp.dir, io, current);
+    defer std.testing.allocator.free(version);
+    try std.testing.expectEqualStrings("1.0.0", version);
+    try clearStaged(tmp.dir, io);
+    try std.testing.expect(!exists(tmp.dir, io, staged));
+}

package/src/windows_install/tests.zig

@@ -0,0 +1,11 @@
+//! Test root for the Windows setup program, launcher and uninstaller.
+//! The modules other than win32/main run on every host; the Windows-only
+//! program entry is never analyzed here.
+
+test {
+    _ = @import("config.zig");
+    _ = @import("payload.zig");
+    _ = @import("switch.zig");
+    _ = @import("win32.zig");
+    _ = @import("main.zig");
+}

package/src/windows_install/win32.zig

@@ -0,0 +1,248 @@
+//! The Win32 surface the setup program, launcher and uninstaller use,
+//! declared here so the program links nothing beyond the system DLLs.
+
+const std = @import("std");
+
+pub const HANDLE = std.os.windows.HANDLE;
+pub const HKEY = *opaque {};
+pub const HWND = *opaque {};
+pub const DWORD = u32;
+pub const BOOL = i32;
+pub const HRESULT = i32;
+pub const WCHAR = u16;
+
+pub const GUID = extern struct {
+    data1: u32,
+    data2: u16,
+    data3: u16,
+    data4: [8]u8,
+
+    pub fn parse(comptime text: []const u8) GUID {
+        @setEvalBranchQuota(10_000);
+        var guid: GUID = undefined;
+        guid.data1 = std.fmt.parseInt(u32, text[0..8], 16) catch unreachable;
+        guid.data2 = std.fmt.parseInt(u16, text[9..13], 16) catch unreachable;
+        guid.data3 = std.fmt.parseInt(u16, text[14..18], 16) catch unreachable;
+        guid.data4[0] = std.fmt.parseInt(u8, text[19..21], 16) catch unreachable;
+        guid.data4[1] = std.fmt.parseInt(u8, text[21..23], 16) catch unreachable;
+        for (0..6) |index| {
+            guid.data4[2 + index] = std.fmt.parseInt(u8, text[24 + 2 * index ..][0..2], 16) catch unreachable;
+        }
+        return guid;
+    }
+};
+
+pub const STARTUPINFOW = extern struct {
+    cb: DWORD = @sizeOf(STARTUPINFOW),
+    lpReserved: ?[*:0]u16 = null,
+    lpDesktop: ?[*:0]u16 = null,
+    lpTitle: ?[*:0]u16 = null,
+    dwX: DWORD = 0,
+    dwY: DWORD = 0,
+    dwXSize: DWORD = 0,
+    dwYSize: DWORD = 0,
+    dwXCountChars: DWORD = 0,
+    dwYCountChars: DWORD = 0,
+    dwFillAttribute: DWORD = 0,
+    dwFlags: DWORD = 0,
+    wShowWindow: u16 = 0,
+    cbReserved2: u16 = 0,
+    lpReserved2: ?*u8 = null,
+    hStdInput: ?HANDLE = null,
+    hStdOutput: ?HANDLE = null,
+    hStdError: ?HANDLE = null,
+};
+
+pub const PROCESS_INFORMATION = extern struct {
+    hProcess: HANDLE,
+    hThread: HANDLE,
+    dwProcessId: DWORD,
+    dwThreadId: DWORD,
+};
+
+pub const PROPERTYKEY = extern struct {
+    fmtid: GUID,
+    pid: DWORD,
+};
+
+/// PROPVARIANT, 16 bytes on 32-bit and 24 bytes on 64-bit Windows; only
+/// the VT_LPWSTR form is used here.
+pub const PROPVARIANT = extern struct {
+    vt: u16,
+    reserved1: u16 = 0,
+    reserved2: u16 = 0,
+    reserved3: u16 = 0,
+    value: [2]usize = .{ 0, 0 },
+};
+
+/// The longest path the wide-character file APIs accept.
+pub const MAX_PATH_WIDE: usize = 32768;
+
+pub const HKEY_CURRENT_USER: HKEY = @ptrFromInt(0x80000001);
+pub const KEY_READ: DWORD = 0x20019;
+pub const KEY_WRITE: DWORD = 0x20006;
+pub const REG_SZ: DWORD = 1;
+pub const REG_DWORD: DWORD = 4;
+pub const ERROR_SUCCESS: i32 = 0;
+pub const ERROR_FILE_NOT_FOUND: i32 = 2;
+
+pub const PROCESS_QUERY_LIMITED_INFORMATION: DWORD = 0x1000;
+pub const SYNCHRONIZE: DWORD = 0x0010_0000;
+pub const WAIT_OBJECT_0: DWORD = 0;
+pub const WAIT_ABANDONED: DWORD = 0x80;
+pub const CREATE_UNICODE_ENVIRONMENT: DWORD = 0x400;
+pub const CREATE_NO_WINDOW: DWORD = 0x0800_0000;
+
+pub const MB_OK: u32 = 0x0;
+pub const MB_RETRYCANCEL: u32 = 0x5;
+pub const MB_YESNO: u32 = 0x4;
+pub const MB_ICONERROR: u32 = 0x10;
+pub const MB_ICONQUESTION: u32 = 0x20;
+pub const MB_SETFOREGROUND: u32 = 0x10000;
+pub const IDYES: i32 = 6;
+pub const IDRETRY: i32 = 4;
+
+pub const COINIT_APARTMENTTHREADED: DWORD = 0x2;
+pub const CLSCTX_INPROC_SERVER: DWORD = 0x1;
+pub const SHCNE_ASSOCCHANGED: i32 = 0x0800_0000;
+pub const SHCNF_IDLIST: u32 = 0;
+pub const VT_LPWSTR: u16 = 31;
+pub const MOVEFILE_REPLACE_EXISTING: DWORD = 0x1;
+pub const MOVEFILE_WRITE_THROUGH: DWORD = 0x8;
+
+pub const FOLDERID_LocalAppData = GUID.parse("F1B32785-6FBA-4FCF-9D55-7B8E7F157091");
+/// The current user's Start menu Programs folder.
+pub const FOLDERID_Programs = GUID.parse("A77F5D77-2E2B-44C3-A6A2-ABA601054A51");
+pub const CLSID_ShellLink = GUID.parse("00021401-0000-0000-C000-000000000046");
+pub const IID_IShellLinkW = GUID.parse("000214F9-0000-0000-C000-000000000046");
+pub const IID_IPersistFile = GUID.parse("0000010B-0000-0000-C000-000000000046");
+pub const IID_IPropertyStore = GUID.parse("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99");
+pub const PKEY_AppUserModel_ID: PROPERTYKEY = .{ .fmtid = GUID.parse("9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3"), .pid = 5 };
+
+pub const IUnknownVtbl = extern struct {
+    QueryInterface: *const fn (*anyopaque, *const GUID, *?*anyopaque) callconv(.winapi) HRESULT,
+    AddRef: *const fn (*anyopaque) callconv(.winapi) u32,
+    Release: *const fn (*anyopaque) callconv(.winapi) u32,
+};
+
+pub const IShellLinkW = extern struct {
+    vtable: *const Vtbl,
+    pub const Vtbl = extern struct {
+        unknown: IUnknownVtbl,
+        GetPath: *const anyopaque,
+        GetIDList: *const anyopaque,
+        SetIDList: *const anyopaque,
+        GetDescription: *const anyopaque,
+        SetDescription: *const fn (*IShellLinkW, [*:0]const u16) callconv(.winapi) HRESULT,
+        GetWorkingDirectory: *const anyopaque,
+        SetWorkingDirectory: *const fn (*IShellLinkW, [*:0]const u16) callconv(.winapi) HRESULT,
+        GetArguments: *const anyopaque,
+        SetArguments: *const fn (*IShellLinkW, [*:0]const u16) callconv(.winapi) HRESULT,
+        GetHotkey: *const anyopaque,
+        SetHotkey: *const anyopaque,
+        GetShowCmd: *const anyopaque,
+        SetShowCmd: *const anyopaque,
+        GetIconLocation: *const anyopaque,
+        SetIconLocation: *const fn (*IShellLinkW, [*:0]const u16, i32) callconv(.winapi) HRESULT,
+        SetRelativePath: *const anyopaque,
+        Resolve: *const anyopaque,
+        SetPath: *const fn (*IShellLinkW, [*:0]const u16) callconv(.winapi) HRESULT,
+    };
+};
+
+pub const IPersistFile = extern struct {
+    vtable: *const Vtbl,
+    pub const Vtbl = extern struct {
+        unknown: IUnknownVtbl,
+        GetClassID: *const anyopaque,
+        IsDirty: *const anyopaque,
+        Load: *const anyopaque,
+        Save: *const fn (*IPersistFile, [*:0]const u16, BOOL) callconv(.winapi) HRESULT,
+        SaveCompleted: *const anyopaque,
+        GetCurFile: *const anyopaque,
+    };
+};
+
+pub const IPropertyStore = extern struct {
+    vtable: *const Vtbl,
+    pub const Vtbl = extern struct {
+        unknown: IUnknownVtbl,
+        GetCount: *const anyopaque,
+        GetAt: *const anyopaque,
+        GetValue: *const anyopaque,
+        SetValue: *const fn (*IPropertyStore, *const PROPERTYKEY, *const PROPVARIANT) callconv(.winapi) HRESULT,
+        Commit: *const fn (*IPropertyStore) callconv(.winapi) HRESULT,
+    };
+};
+
+pub extern "kernel32" fn GetLastError() callconv(.winapi) DWORD;
+pub extern "kernel32" fn GetModuleFileNameW(hModule: ?HANDLE, lpFilename: [*]u16, nSize: DWORD) callconv(.winapi) DWORD;
+pub extern "kernel32" fn GetCommandLineW() callconv(.winapi) [*:0]u16;
+pub extern "kernel32" fn CreateProcessW(
+    lpApplicationName: ?[*:0]const u16,
+    lpCommandLine: ?[*:0]u16,
+    lpProcessAttributes: ?*anyopaque,
+    lpThreadAttributes: ?*anyopaque,
+    bInheritHandles: BOOL,
+    dwCreationFlags: DWORD,
+    lpEnvironment: ?*anyopaque,
+    lpCurrentDirectory: ?[*:0]const u16,
+    lpStartupInfo: *STARTUPINFOW,
+    lpProcessInformation: *PROCESS_INFORMATION,
+) callconv(.winapi) BOOL;
+pub extern "kernel32" fn CloseHandle(hObject: HANDLE) callconv(.winapi) BOOL;
+pub extern "kernel32" fn WaitForSingleObject(hHandle: HANDLE, dwMilliseconds: DWORD) callconv(.winapi) DWORD;
+pub extern "kernel32" fn CreateMutexW(lpMutexAttributes: ?*anyopaque, bInitialOwner: BOOL, lpName: ?[*:0]const u16) callconv(.winapi) ?HANDLE;
+pub extern "kernel32" fn ReleaseMutex(hMutex: HANDLE) callconv(.winapi) BOOL;
+pub extern "kernel32" fn OpenProcess(dwDesiredAccess: DWORD, bInheritHandle: BOOL, dwProcessId: DWORD) callconv(.winapi) ?HANDLE;
+pub extern "kernel32" fn GetCurrentProcessId() callconv(.winapi) DWORD;
+pub extern "kernel32" fn K32EnumProcesses(lpidProcess: [*]DWORD, cb: DWORD, lpcbNeeded: *DWORD) callconv(.winapi) BOOL;
+pub extern "kernel32" fn QueryFullProcessImageNameW(hProcess: HANDLE, dwFlags: DWORD, lpExeName: [*]u16, lpdwSize: *DWORD) callconv(.winapi) BOOL;
+pub extern "kernel32" fn CopyFileW(lpExistingFileName: [*:0]const u16, lpNewFileName: [*:0]const u16, bFailIfExists: BOOL) callconv(.winapi) BOOL;
+pub extern "kernel32" fn MoveFileExW(lpExistingFileName: [*:0]const u16, lpNewFileName: ?[*:0]const u16, dwFlags: DWORD) callconv(.winapi) BOOL;
+pub extern "kernel32" fn DeleteFileW(lpFileName: [*:0]const u16) callconv(.winapi) BOOL;
+pub extern "kernel32" fn GetTempPathW(nBufferLength: DWORD, lpBuffer: [*]u16) callconv(.winapi) DWORD;
+pub extern "kernel32" fn GetSystemDirectoryW(lpBuffer: [*]u16, uSize: u32) callconv(.winapi) u32;
+pub extern "kernel32" fn Sleep(dwMilliseconds: DWORD) callconv(.winapi) void;
+
+pub extern "user32" fn MessageBoxW(hWnd: ?HWND, lpText: [*:0]const u16, lpCaption: [*:0]const u16, uType: u32) callconv(.winapi) i32;
+pub extern "user32" fn AllowSetForegroundWindow(dwProcessId: DWORD) callconv(.winapi) BOOL;
+
+pub extern "shell32" fn SHGetKnownFolderPath(rfid: *const GUID, dwFlags: DWORD, hToken: ?HANDLE, ppszPath: *?[*:0]u16) callconv(.winapi) HRESULT;
+pub extern "shell32" fn SHChangeNotify(wEventId: i32, uFlags: u32, dwItem1: ?*const anyopaque, dwItem2: ?*const anyopaque) callconv(.winapi) void;
+
+pub extern "ole32" fn CoInitializeEx(pvReserved: ?*anyopaque, dwCoInit: DWORD) callconv(.winapi) HRESULT;
+pub extern "ole32" fn CoUninitialize() callconv(.winapi) void;
+pub extern "ole32" fn CoCreateInstance(rclsid: *const GUID, pUnkOuter: ?*anyopaque, dwClsContext: DWORD, riid: *const GUID, ppv: *?*anyopaque) callconv(.winapi) HRESULT;
+pub extern "ole32" fn CoTaskMemFree(pv: ?*anyopaque) callconv(.winapi) void;
+
+pub extern "advapi32" fn RegCreateKeyExW(hKey: HKEY, lpSubKey: [*:0]const u16, Reserved: DWORD, lpClass: ?[*:0]const u16, dwOptions: DWORD, samDesired: DWORD, lpSecurityAttributes: ?*anyopaque, phkResult: *HKEY, lpdwDisposition: ?*DWORD) callconv(.winapi) i32;
+pub extern "advapi32" fn RegOpenKeyExW(hKey: HKEY, lpSubKey: [*:0]const u16, ulOptions: DWORD, samDesired: DWORD, phkResult: *HKEY) callconv(.winapi) i32;
+pub extern "advapi32" fn RegSetValueExW(hKey: HKEY, lpValueName: ?[*:0]const u16, Reserved: DWORD, dwType: DWORD, lpData: [*]const u8, cbData: DWORD) callconv(.winapi) i32;
+pub extern "advapi32" fn RegQueryValueExW(hKey: HKEY, lpValueName: ?[*:0]const u16, lpReserved: ?*DWORD, lpType: ?*DWORD, lpData: ?[*]u8, lpcbData: ?*DWORD) callconv(.winapi) i32;
+pub extern "advapi32" fn RegDeleteValueW(hKey: HKEY, lpValueName: ?[*:0]const u16) callconv(.winapi) i32;
+pub extern "advapi32" fn RegDeleteTreeW(hKey: HKEY, lpSubKey: ?[*:0]const u16) callconv(.winapi) i32;
+pub extern "advapi32" fn RegDeleteKeyW(hKey: HKEY, lpSubKey: [*:0]const u16) callconv(.winapi) i32;
+pub extern "advapi32" fn RegQueryInfoKeyW(
+    hKey: HKEY,
+    lpClass: ?[*]u16,
+    lpcchClass: ?*DWORD,
+    lpReserved: ?*DWORD,
+    lpcSubKeys: ?*DWORD,
+    lpcbMaxSubKeyLen: ?*DWORD,
+    lpcbMaxClassLen: ?*DWORD,
+    lpcValues: ?*DWORD,
+    lpcbMaxValueNameLen: ?*DWORD,
+    lpcbMaxValueLen: ?*DWORD,
+    lpcbSecurityDescriptor: ?*DWORD,
+    lpftLastWriteTime: ?*anyopaque,
+) callconv(.winapi) i32;
+pub extern "advapi32" fn RegCloseKey(hKey: HKEY) callconv(.winapi) i32;
+
+test "GUIDs parse from their registry form" {
+    const guid = GUID.parse("00021401-0000-0000-C000-000000000046");
+    try std.testing.expectEqual(@as(u32, 0x00021401), guid.data1);
+    try std.testing.expectEqual(@as(u8, 0xC0), guid.data4[0]);
+    try std.testing.expectEqual(@as(u8, 0x46), guid.data4[7]);
+    try std.testing.expectEqual(@as(usize, if (@sizeOf(usize) == 8) 24 else 16), @sizeOf(PROPVARIANT));
+}

package/tools/native-sdk/main.zig

@@ -6,7 +6,7 @@ const tooling = @import("tooling");
 const automation_protocol = @import("automation_protocol");
 const cli_build_info = @import("cli_build_info");
 
-const version = "0.11.0-fork.3";
+const version = "0.11.0-fork.4";
 
 pub fn main(init: std.process.Init) !void {
     const allocator = init.arena.allocator();
@@ -105,15 +105,15 @@ pub fn main(init: std.process.Init) !void {
         };
     } else if (std.mem.eql(u8, command, "update")) {
         tooling.update.run(allocator, init.io, args[2..]) catch |err| switch (err) {
-            error.InvalidArguments => fail("usage: native update keygen [--private-key path] | sign --archive app.zip --url https://example.com/app.zip --target macos-aarch64|macos-x86_64 [--manifest app.json] [--private-key path] [--notes text] [--output native-update.json]"),
+            error.InvalidArguments => fail("usage: native update keygen [--private-key path] | sign --archive app.zip --url https://example.com/app.zip --target macos-aarch64|macos-x86_64|windows-x86_64|windows-aarch64 [--manifest app.json] [--private-key path] [--notes text] [--output native-update.json] [--allow-loopback-http]"),
             error.KeyAlreadyExists => fail("the private update key already exists; choose another --private-key path or move the existing key explicitly"),
-            error.InvalidArchiveUrl => fail("update archive URLs must use HTTPS and be at most 4096 bytes"),
-            error.InvalidTarget => fail("update target must be macos-aarch64 or macos-x86_64"),
+            error.InvalidArchiveUrl => fail("update archive URLs must use HTTPS and be at most 4096 bytes (--allow-loopback-http also admits http://127.0.0.1, http://[::1] and http://localhost for local testing)"),
+            error.InvalidTarget => fail("update target must be macos-aarch64, macos-x86_64, windows-x86_64 or windows-aarch64"),
             error.UpdateArchitectureMismatch => fail("the update archive executable does not contain the architecture named by --target"),
-            error.InvalidArchive => fail("the update archive must be a non-empty .zip containing the packaged .app bundle"),
+            error.InvalidArchive => fail("the update archive must be the .zip `native package --update-archive` writes: the packaged .app bundle for macOS, the installed app image for Windows"),
             error.UpdatesNotConfigured => fail("the app manifest has no updates block; add feed_url and public_key before signing releases"),
             error.InvalidManifestVersion => fail("the app manifest version must use canonical X.Y.Z numeric components without leading zeroes"),
-            error.InvalidUpdatePublicKey => fail("the app manifest update public_key is not a valid base64 Ed25519 public key"),
+            error.InvalidUpdatePublicKey => fail("the app manifest update public_key or a public_keys entry is not a valid base64 Ed25519 public key"),
             error.UpdateKeyMismatch => fail("the private update key does not match the public_key embedded in the app manifest"),
             error.GeneratedFeedInvalid => fail("the generated update feed failed its own verification; no feed was written"),
             else => return err,
@@ -204,9 +204,9 @@ pub fn main(init: std.process.Init) !void {
         std.debug.print("bundled {d} assets into {s}\n", .{ stats.asset_count, output_dir });
     } else if (std.mem.eql(u8, command, "package")) {
         checkVerbFlags("package", args[2..], .{
-            .usage = "package [--target macos] [--output path] [--binary path] [--service-binary path] [--assets path] [--web-engine system|chromium] [--web-layer auto|include|exclude] [--cef-dir path] [--cef-auto-install] [--signing none|adhoc|identity] [--identity name] [--entitlements path] [--notarize --notary-profile name] [--archive] [--update-archive]",
+            .usage = "package [--target macos] [--output path] [--binary path] [--service-binary path] [--assets path] [--web-engine system|chromium] [--web-layer auto|include|exclude] [--cef-dir path] [--cef-auto-install] [--signing none|adhoc|identity] [--identity name] [--entitlements path] [--notarize --notary-profile name] [--archive] [--update-archive] [--installer]",
             .value_flags = &.{ "--manifest", "--target", "--output", "--binary", "--service-binary", "--assets", "--web-engine", "--web-layer", "--cef-dir", "--signing", "--identity", "--entitlements", "--notary-profile", "--optimize" },
-            .bool_flags = &.{ "--cef-auto-install", "--notarize", "--archive", "--update-archive" },
+            .bool_flags = &.{ "--cef-auto-install", "--notarize", "--archive", "--update-archive", "--installer" },
         });
         const manifest_path = try flagValue(args, "--manifest") orelse tooling.manifest.defaultPath(init.io) orelse "app.json";
         const metadata = tooling.manifest.readMetadata(allocator, init.io, manifest_path) catch |err| switch (err) {
@@ -283,6 +283,7 @@ pub fn main(init: std.process.Init) !void {
             .archive = archive,
             .notarize = flagBool(args, "--notarize"),
             .update_archive = flagBool(args, "--update-archive"),
+            .installer = flagBool(args, "--installer"),
             .env_map = init.environ_map,
         });
         tooling.package.printDiagnostic(stats);
@@ -485,7 +486,7 @@ fn usage() void {
         \\  doctor [--strict] [--manifest app.json] [--web-engine system|chromium] [--cef-dir path] [--cef-auto-install]
         \\  validate [app.json|app.zon]
         \\  bundle-assets [app.json|app.zon] [assets] [output]
-        \\  package [--target macos|windows|linux|ios|android] [--output path] [--binary path] [--service-binary path] [--assets path] [--web-engine system|chromium] [--web-layer auto|include|exclude] [--cef-dir path] [--cef-auto-install] [--signing none|adhoc|identity] [--identity name] [--entitlements path] [--notarize --notary-profile name] [--archive] [--update-archive]
+        \\  package [--target macos|windows|linux|ios|android] [--output path] [--binary path] [--service-binary path] [--assets path] [--web-engine system|chromium] [--web-layer auto|include|exclude] [--cef-dir path] [--cef-auto-install] [--signing none|adhoc|identity] [--identity name] [--entitlements path] [--notarize --notary-profile name] [--archive] [--update-archive] [--installer]
         \\  dev [--manifest app.json] --binary path [--url http://127.0.0.1:5173/] [--command "npm run dev"] [--timeout-ms 30000]
         \\  package-windows [--output path] [--binary path] [--service-binary path]
         \\  package-linux [--output path] [--binary path] [--service-binary path]