Inno Landscape Installer

[UrosM]

Then a good and simple video tutorial for illiterates is way better solution than the security risk with executables, IMHO.

[janjansen]

I think literally everyone I know IRL that flies condor has at some point needed my help installing landscapes over skype/ts/phone, and if anyone has more than a dozen landscapes installed and never forgotten or missed at least one archive while downloading or extracting, then Im not sure I believe you. Ive certainly been there myself, more than once.

The problem is real enough, especially for many of the less tech savvy condor pilots (of which there are many).
This installer solves that problem, but unfortunately it does create a different one.

[wickid]

Please accept that this is the way the Condor team wants it done. We are aware of the issues with unsigned installers. Unfortunately the 7zip solution has proven to cause too many problems. Even a video is not going to solve this as every landscape maker packages their files differently.

The installer package we have written uses uses the same rules as are used for the Condor main installers, patches and Hangar updates.

once again we ask all landscape creators to use this script and provide an installer for your landscape. Besides that feel free to use any other method you see fit.

[OXO]

+1 against executable installer.

Unzipping few files is no rocket science. Put your effort and time in some more important improvements in C2.

Well, you are wrong. Just installing and using 7zip is a trial for many users. As has been said before we get a lot of tech support emails due to incorrect landscape installation.

So far we have had zero email about AA2 installation. Thats a huge win for us, and will give us more time to put into the improvements you want.

[BOD1]

I'm uncumfortable with this case: I've received a scenery to release on CC. This one comes with an unsigned .EXE presented as an installer. I've no way except to download and run it on my computer to see what it is. Even with that, I can't confirm the EXE is safe and it didn't infect my PC. So how could I take the responsibility to release an unknown application to CC users?
That's the reason why there is no Applications section in Goodies, I don't want to take the risk to spread malwares...

[OXO]

I'm uncumfortable with this case: I've received a scenery to release on CC. This one comes with an unsigned .EXE presented as an installer. I've no way except to download and run it on my computer to see what it is. Even with that, I can't confirm the EXE is safe and it didn't infect my PC. So how could I take the responsibility to release an unknown application to CC users?
That's the reason why there is no Applications section in Goodies, I don't want to take the risk to spread malwares...

I believe AA2 installer is unsigned on Condor Club. Over 900 downloads. How many complaints did you receive?

[BOD1]

I know... For AA2, I had a great confidence in work you provided. Another solution may *I* build the exe installer. Does anyone know if it's possible to run Inno Builder (or whatever is used to build Condor2 scenery script installer) on Linux/Ubuntu?

[OXO]

Looks like its possible, but needs some work..

https://katastrophos.net/andre/blog/200 ... on-debian/

Alternatively, Wiek will build installers, or I guess we could find someone else who would do it. There are plenty in beta team with the time (not sure about the inclination).

I'm back in France in 2 weeks time, and the 1GBit fibre is being installed in April. I could put a windows pc there for you to use for testing with remote desktop.

I'm sure we can find a way to do this. Does CC have a signing certificate? That would alleviate a possible future set of complaints..

[dgtfer]

So scenery builders would just send there zipped files to CC and BOD1 would build the installer?

[pstrzel]

Alternatively, if Thierry is concerned about malware, he could implement a verification process for people uploading sceneries to his servers. But yes, it does seem like extra work the makers to make it easier for the takers. Considering that Condor comes pre-installed with everything needed to use it, providing an installer for 3rd party software should not be on Condor team's list of concerns. Those are my thoughts, but I'm fine with it either way.

[wickid]

Yes or I build them and sent them to Thierry.

[SteveK]

Crikey! - What have I started I feel like I" lit the blue touch paper and retired to a safe distance!" in fact caring responsibilities and an event yesterday kept me from dipping back into the conversation.

I appreciate the support load that the ad-hoc installation methods must cause. I'd not considered the liability aspect (but had already considered that the Condor Team's main developer certificate would not be suitable for signing the third party content - hence my suggestion for a separate "Condor Community Content" Certificate).

If that can't be done then a poor man's solution would be checksumming the files and those worried could then verify the checksums. As I said, the condor and gliding communities are a generally trustworthy bunch*(1)/*(2), and my main assessment of risk was a malicious outsider compromising a download site and substituting something malicious in it's an installer's place. What makes me grimace sometimes is the habit of some download sites for general software providing hashes (checksums) for their files, alongside the files (ahh guys - if someone compromises your site and drops an infected version of the file in place of the original - don't you think they'd update the checksum as well - doh!), so file and checksum would need to be kept separately for maximum effect. This method would also have less uptake and understanding than the signing method.

*(1) - as long as the question does not involve who is at the head of the launch queue just as it turns soarable!
*(2) - and anyway if Wiek was building the installers then he would have knowledge of what went into them and that there was nothing... errm... unexpected.

[wickid]

The script does automatically hash the output files and puts the results in a file. This is mostly done for checking the integrity of the download but could of course be used for security as well.

I am happy to build installers for Landscapes. I do expect a certain quality though. All the instructions an requirments are incuded in the manual for the script which I will provide if you request it via PM. I guess not having the script publicly available adds some extra security as well.

[jcomm]

People concerned with the dangers of unsigned execs should also adopt protective measures in their computers.

Sandbox techniques used with most anti-virus / malware / bot products provide a way of determining if a given executable is compromised.

[congo]

Some of us have a long history, (we are older than you), and we also have
accurate memories of IT over the last 35 years or so.

Since Windows XP made the average PC user stupid, installers have been
used to make it easier for PC illiterates to install addons to their favourite
flight sims.

These installers were as often corrupt as they were accurate, causing a lot
of harm to the addon distributions. The problem stemmed from inaccurate
packing or inaccurate path addressing.

Ever since those early days of my PC experience, I distrusted nothing more
than an addon installer. For several years afterwards, I noticed that addon
distributions for many other game types used flawed installers as well as
flawed pathnames in their compressed zip files.

I believe it is human nature to rush an addon distro release after completion,
and this is where the flaws and mistakes are easily overlooked. Developers
need to be cautious as they move beyond BETA, and towards distribution.
Always get a third party to cross-check your distro!

Condor is no exception, and some of us here are aware that several Condor1
scenery installers were indeed flawed at a high ratio to the ones that actually
worked correctly, particularly with regard to doubled up folders and pathnames.

Who ever decrees the "way to do it", must also accept the responsibility for
it's implementation, cross checking, accuracy and security prior to release!
This is also going to take up your valuable time, albeit, probably not so bad as
supporting inexperienced Condor users who have no clue how to use
compression utilities...... but simply decreeing that devs must use the installer
forces you to accept a great responsibility.

Why have we not seen scenery developers taking advantage of the self installer
options available in compression utility software?
I have used self installers for very large distros for both flight and racing sim
addons of around 50Gb with success.

The size and complexity of an addon distribution is a factor, however, I have
released several addon distros that were easy to make and small in size. A
lot more time and effort was put into cross checking, documentation and
packing up the distro properly than I ever spent making the mod!