Re: minutes of ESC call ...

On 11/2/2017 8:10 PM, Michael Meeks wrote:
> * Completed Action Items:
>      + ship the horror win / VC runtime DLLs with the installer (Cloph)
>          [ patch appears to work, but we already have them in the installer
>            if you do an admin-install they are already installed.
>            we ship them twice – once as LibreOffice, but once as a run-time module
>            not entirely elegant.
>            for 5.4 – merge it as-is, for 6.0 do something clever.
> http://dev-builds.libreoffice.org/daily/libreoffice-5-4/Win-x86@62-TDF/tdf_108580/
>          ]

1. For 6.0, we would not need to ship the merge module - because that 
module is only working for WinXP. So that leaves us with just one copy.

2. Still, having app-local DLLs is worse than system-updateable (at 
least security-wise: if we bundle app-local DLLs, then we would have to 
put their advisories to our site? so that users using not-up-to-date LO 
versions could know that they might be vulnerable, despite having 
updated their systems). So, we could try to include MSUs from KB2999226 
[1]. There are 3 different packages for each bitness that cover all 
supported platforms requiring the update (Win7, Win8, Win8.1):
    - for x86:
       Windows6.1-KB2999226-x86.msu
       Windows8-RT-KB2999226-x86.msu
       Windows8.1-KB2999226-x86.msu
    - for x64:
       Windows6.1-KB2999226-x64.msu
       Windows8-RT-KB2999226-x86.msu
       Windows8.1-KB2999226-x64.msu

The size of all three x86 packages is 1.77 MB total; three x64 packages 
are 3.24 MB total.

The MSUs are installable using Windows Update Standalone Installer [2] 
(system component in all those Windows versions). Custom actions would 
need to be created, with relevant conditions (VersionNT; [3]).

The drawbacks (besides extra size):
1. We need to also check for pre-conditions: if the KB2999226 is already 
installed; if required pre-requisite KBs are present (see [1]; 
prerequisites exist for Win7 and Win8.1 - curiously no preconditions for 
Win8). For Win7, the prerequisite is SP1, so may just state this version 
as system requirement? For Win8.1, the prerequisite is [4], which is 
several hundred MB...
2. We somehow need to get the packages to dev environment when building 
the installer - should we put the blobs to our server to fetch as 
external package on build? (I don't know if there's a static URL for 
those files on MS site.)

[1] https://support.microsoft.com/en-us/help/2999226
[2] https://support.microsoft.com/en-us/help/934307
[3] https://msdn.microsoft.com/en-us/library/aa370556
[4] https://support.microsoft.com/en-us/help/2919355

-- 
Best regards,
Mike Kaganski