Inno Landscape Installer

Moderators: Uros, OXO, JBr

User avatar
OXO
Condor Team
Posts: 5779
Joined: Mon Feb 13, 2006 1:08 am
Contact:

Inno Landscape Installer

Post by OXO » Fri Mar 08, 2019 9:56 am

Topic for the landscape installer built by Bre901, wickid, and me, managed by Wiek "wickid"

Please post all requests and comments here

Installers built with our script will

- Install in correct folder for Condor 2, or let the user choose some other location if he is using the linking trick.
- make single installer, or one split into managable chunks for download
- check all files before installing so that download problems are detected

A beta version of the installer is already used on AA2, since then we have improved it a lot.

Condor Team requests that all landscapes are installed with a proper installer and do not use zip or 7-zip installers.
Chris Wedgwood,
Condor Team

User avatar
Capricorne
Posts: 394
Joined: Wed Jul 08, 2009 6:34 pm
Location: Strasbourg (France)
Contact:

Re: Inno Landscape Installer

Post by Capricorne » Sat Mar 09, 2019 2:24 pm

What's next ? A script to build a scenery ? :mrgreen:
Capricorne - S67

User avatar
SteveK
Posts: 835
Joined: Fri May 26, 2006 5:32 pm
Location: London, England

Re: Inno Landscape Installer

Post by SteveK » Sat Mar 09, 2019 2:28 pm

OK - I’ll kick off discussion by heading in what might be an unexpected direction.

TLDR: The new installer method seems to require the end user to run unsigned executables on their system - this process could be subverted.

My trade is IT. I’ve been involved with technology for over 40 years and actively supported computer networks for well over 30 of those. I have experience from component level, through firmware, software development (amateur) and both ISP and Corporate network design/management. A lot of the work I do at the moment revolves around IT security. “What does this have do do with installing landscapes?” I hear you ask… Bear with me, I’ve tried to write the argument below in a way that most non-technical people can follow.

Up until now, landscape installation has been a matter of placing a number of non-executable data files in ‘the right place’ and hoping for the best. The worst result being that the landscape was not available, or that it malfunctioned in some way. I can appreciate (and agree with) the need to improve upon that process, both for reliability, and for de-skilling of landscape installation procedure.

Unless the user does something really off-target, the old manual process could not make any system wide changes, or inject any executable code into the users system. It was only copying some files that are then interpreted as data.

Before I go further, I must say that I do not doubt the integrity of anyone here - this community is amazing, as is the RL gliding community.

The new installer method seems to rely on the end user running an executable on their system to make the changes required to install the scenery. Whether it actually does or not, the executable could potentially make system wide changes or introduce malicious code onto the target system. There is no easy way of knowing for sure.

A large amount of IT security is dependant on the management of ‘Trust’. In terms of software, these are the aspects of attribution/non-repudiation (can I identify the developer without doubt?), and of software integrity (“Has the code I have just downloaded been substituted/modified by a malicious third party since the developer released it?”).

For commercially produced software (including the Condor program and software updates from the Condor Team) such trust is engendered through the process of signing the executable by using a developer certificate. Signing by such a certificate proves that the developer had identified themselves to a competent authority, proves that the software is really attributable to them, and allows modifications to that software made after it left the developer’s hands to be detected. The only ‘human’ decision then is then whether you personally actually trust that developer. You know who he is, and that the installer that you are running is as he intended it.

Of course we cannot expect all of the various individuals landscape developers to jump through the hoops and costs involved in obtaining developer certificates, but without the installer being ‘signed’ we seem now now be advocating that users download and execute unsigned code from the internet. The main threat I suppose, a modified executable being substituted on a subverted distribution server, or that we are de-sensitising users to bypassing the reality check warnings that Windows throws up.

The solutions are not easy, but I suppose would be signing of such installers with a “Condor community content” developer certificate held and managed by a trusted individual, or a separate installer which never gets modified (as as such can be statically signed) but which knows how to extract landscape files and put then in their correct places, apply patches, and verify correct installation (and could not do anything else).

User avatar
wickid
Posts: 1485
Joined: Mon Dec 04, 2006 7:32 pm
Location: Venlo, NL
Contact:

Re: Inno Landscape Installer

Post by wickid » Sat Mar 09, 2019 2:38 pm

It is possible to sign the installer. The scenery creator will need to provide their own certificate.

Several solutions were discussed at lenght with the Condor team and the Beta team. This option was chosen as it is the easiest solution for Condor users that are not as good with computers as some of us here.

The condor team has a certificate but will not provide it due to potential liability issues when copyrighted content is provided with this certificate.
PH-1504, KOE
Image

User avatar
dgtfer
Posts: 358
Joined: Mon Nov 19, 2007 9:49 am
Location: Marseille - france

Re: Inno Landscape Installer

Post by dgtfer » Sat Mar 09, 2019 5:39 pm

SteveK wrote:
Sat Mar 09, 2019 2:28 pm
The solutions are not easy, but I suppose would be signing of such installers with a “Condor community content” developer certificate held and managed by a trusted individual, or a separate installer which never gets modified (as as such can be statically signed) but which knows how to extract landscape files and put them in their correct places, apply patches, and verify correct installation (and could not do anything else).
Couldn't this trusted individual be the CondorClub?
Or the static installer could be included in condor, and its task would be to search where the compressed files are located and install them properly (like some readers programs do to install new books )
Image

User avatar
BOD1
Posts: 1783
Joined: Mon Aug 07, 2006 2:45 pm
Location: Brittany, France
Contact:

Re: Inno Landscape Installer

Post by BOD1 » Sat Mar 09, 2019 6:10 pm

Yes, I've in mind to develop a Condor Update like Windows Update, but it's long to do :?
Image
Please use this button to send me a PM, Forum messaging is too limited.
Image

User avatar
Pit_R
Posts: 1161
Joined: Mon Feb 27, 2006 7:16 pm

Re: Inno Landscape Installer

Post by Pit_R » Sat Mar 09, 2019 6:20 pm

Hello!
What's wrong with zips and manual unpack? :roll:
Let's not treat people as idiots. More faith. With this direction starting C2 may be problematic very soon.
I remember during LLC (2007?) people was able to upload igcs to ftp server! Hard to imagine in 2019.

From other hand: what about to make impossible finishing scenery in Condor Landscape Toolkit if all needed files are not present (like filled forest map, thermal map, typical 3D buildings etc) + autmatically add sumcontrol to scenery folder (created by CLT after scenery is ready) so people would easy know which file is altered and makes trouble with connections or sink, axis etc. As for installer - maybe there is good idea to add it to future version of CLT. So scenery author may choose to make (unsigned) installer or typical zips (for those very advanced users ;)

Rgrds
No matter where you go... There you are...

Image
::::
Please use this envelope
Image
to send me a PM.

User avatar
wickid
Posts: 1485
Joined: Mon Dec 04, 2006 7:32 pm
Location: Venlo, NL
Contact:

Re: Inno Landscape Installer

Post by wickid » Sat Mar 09, 2019 6:39 pm

Pit_R wrote:
Sat Mar 09, 2019 6:20 pm
Hello!
What's wrong with zips and manual unpack? :roll:
Let's not treat people as idiots. More faith. With this direction starting C2 may be problematic very soon if desktop icon accidentally disapear.
I remember during LLC (2007?) people was able to upload igcs to ftp server! Hard to imagine in 2019.
OXO get's multiple emails per day to the support email address regarding landscape installation. The questions you see here on the forum are just the tip of the iceberg. As he much rather spends his time making new gliders for Condor we came up with this tool in order to reduce the number of support emails.

We really appreciate that you build these landscapes for Condor in your free time. We have worked hard to provide an easy tool to make installers for the landscape so the users get a uniform way of installing landscapes. We have been working on this for over a month and have discussed various options with the Beta team.

I do not want to discus different options for landscape installation in this thread. The Condor team has decided that this is the way they want it and requests landscape makers to use the script. This thread is meant for support if there are questions about the script.
PH-1504, KOE
Image

User avatar
Pit_R
Posts: 1161
Joined: Mon Feb 27, 2006 7:16 pm

Re: Inno Landscape Installer

Post by Pit_R » Sat Mar 09, 2019 7:21 pm

wickid wrote:
Sat Mar 09, 2019 6:39 pm
OXO get's multiple emails per day to the support email address regarding landscape installation. The questions you see here on the forum are just the tip of the iceberg. As he much rather spends his time making new gliders for Condor we came up with this tool in order to reduce the number of support emails.

Well - maybe make visual guide to be send by mail for such popular question (with very less words to not confused people ;)
if http://www.condorsoaring.com/manual/#in ... landscapes and https://www.condor-club.eu/generic/240/
Is not enough...

Unfortunaltelly SteveK may be right here and C2 scenery installers floating over internet may bring more serious troubles than hardship to learn how to unpack files to specific folder.

Rgrds
Last edited by Pit_R on Sat Mar 09, 2019 7:23 pm, edited 1 time in total.
No matter where you go... There you are...

Image
::::
Please use this envelope
Image
to send me a PM.

User avatar
wickid
Posts: 1485
Joined: Mon Dec 04, 2006 7:32 pm
Location: Venlo, NL
Contact:

Re: Inno Landscape Installer

Post by wickid » Sat Mar 09, 2019 7:23 pm

wickid wrote:
Sat Mar 09, 2019 6:39 pm
I do not want to discus different options for landscape installation in this thread.
PH-1504, KOE
Image

User avatar
OXO
Condor Team
Posts: 5779
Joined: Mon Feb 13, 2006 1:08 am
Contact:

Re: Inno Landscape Installer

Post by OXO » Sun Mar 10, 2019 4:53 am

The lack of signing did not prove to be an issue with the release of Alpin Arc 0,5
Chris Wedgwood,
Condor Team

janjansen
Posts: 1068
Joined: Wed Feb 24, 2016 9:26 pm

Re: Inno Landscape Installer

Post by janjansen » Sun Mar 10, 2019 10:30 am

In fairness, that doesnt prove much. One concern is that unsigned executable landscape installers could easily be infected/abused and spread malware. Condor club or other mirrors could get hacked or infected, someone could craft a malicious landscape installer and post it here, .. The fact this has not happened yet hardly invalidates that point.

User avatar
UrosM
Posts: 905
Joined: Thu Jun 23, 2005 6:46 pm
Location: Slovenia

Re: Inno Landscape Installer

Post by UrosM » Sun Mar 10, 2019 10:39 am

+1 against executable installer.

Unzipping few files is no rocket science. Put your effort and time in some more important improvements in C2.
Image

User avatar
wickid
Posts: 1485
Joined: Mon Dec 04, 2006 7:32 pm
Location: Venlo, NL
Contact:

Re: Inno Landscape Installer

Post by wickid » Sun Mar 10, 2019 10:45 am

As I said before. It was discussed with the beta team and the Condor team decided this is the way they want it.

We request landscape creator to provide landscapes as an installer. Feel free to provide it in any way you like besides the installer. User can decide for themselfs what they want to use.
PH-1504, KOE
Image

User avatar
Bre901
Posts: 953
Joined: Tue Nov 22, 2016 8:57 pm
Location: Annecy (France)
Contact:

Re: Inno Landscape Installer

Post by Bre901 » Sun Mar 10, 2019 10:45 am

UrosM wrote:
Sun Mar 10, 2019 10:39 am
Unzipping few files is no rocket science.
But a lot of users don't read manuals or instructions.
I have been working in IT for decades, it's definitely not improving :(
CN : MPT

Post Reply