[inqrphl]

AI generated PR description, I was working with it for a while doing non-elevated / elevated winget installs/uninstalls.

Summary

This adds Windows Package Manager (winget) support for SNClient and improves the MSI's Add/Remove Programs metadata.

Included

• packaging/winget/ — multi-file winget manifest set for ConSol.SNClient 1.01.0:
  • x64, x86 and arm64 installers from the v1.01 release
  • InstallerType: wix, Scope: machine
  • InstallModes: interactive, silent, silentWithProgress
  • ElevationRequirement: elevatesSelf
  • InstallationMetadata runs snclient.exe --version
  • AppsAndFeaturesEntries with ProductCode/UpgradeCode
• packaging/windows/snclient.wxs — MSI ARP metadata:
  • ARPPRODUCTICON
  • ARPINSTALLLOCATION (set after CostFinalize)
  • ARPHELPLINK
  • ARPURLINFOABOUT
• packaging/windows/snclient.ico — multi-size icon (16, 24, 32, 48, 64, 128, 256 px)
  generated from the 256x256 winres/icon16.png

Verification status

Tested on Windows 11 against the signed v1.01.0 release MSI via winget install --manifest .\winget\:

Check	Result
winget validate --manifest .\winget\	Pass
Non-elevated install with UAC	Pass
snclient service created/started	Pass
SNClient firewall rule created	Pass
Remote check_snclient	Pass
Reinstall picks up snclient_local.ini	Pass
Elevated winget uninstall --silent	Pass
Non-elevated uninstall with UAC	Pass
Service/firewall/ARP/files removed	Pass
Reboot persistence	Pass
Non-elevated silent install	Pass (UAC)
Non-elevated silent uninstall	Fail (1603 / MSI 1730)

Reboot persistence was verified on Windows 11: the delayed auto-start service returned as RUNNING, the firewall rule and 8443 listener were still present, and the remote check succeeded.

The MSI changes were verified at MSI table level by rebuilding locally with WiX 3.14.1.8722:

• Icon table contains SNClientIcon.ico with 16-256 px entries
• ARPPRODUCTICON, ARPHELPLINK, ARPURLINFOABOUT are present
• SetARPINSTALLLOCATION is sequenced at 1001, after CostFinalize
• No CNDL1077 warning

They are not exercised by an installed build yet, because the v1.01.0 release MSI predates them.

What does not work / known limitations

1. ElevationRequirement: elevationRequired cannot be used

Using elevationRequired makes winget launch the MSI with ShellExecute(..., "runas"), which fails with:

This file does not have an app associated with it for performing this action.

This is the known winget MSI elevation bug:

• elevationRequired does not work for MSIs microsoft/winget-cli#2231
• winget install from non-elevated terminal: "no app associated with this file" dialog then exits 0x800704C7 microsoft/winget-cli#6173

The manifests use elevatesSelf instead. Winget then invokes msiexec, which requests UAC itself. Microsoft.PowerShell uses the same workaround for its per-machine WiX MSI.

This should be revisited once the winget MSI elevation bug is fixed.

2. Non-elevated --silent uninstall fails with 1603

winget uninstall --manifest .\winget\ --silent from a non-elevated shell does not get the UAC prompt and fails with winget exit code 1603. The Windows Installer log shows the real cause: error 1730, You must be an Administrator to remove this application. The same uninstall works:

• from an elevated shell with --silent, and
• from a non-elevated shell without --silent, after accepting the UAC prompt.

The non-elevated silent install is different: msiexec does request UAC (MsiRunningElevated = 1) and the install succeeds. Only the silent uninstall lacks elevation.

The winget-pkgs validation pipeline installs and uninstalls silently, so this is the main validation risk. There is a working precedent (Microsoft.PowerShell), but it should be tested in the validation environment before relying on it.

3. The v1.01.0 MSI does not contain the new icon/ARP metadata

The winget manifests currently point at the v1.01.0 release assets. The icon/ARP changes in this PR only apply to the next release.

If the winget package should include them, cut a release from this branch first and update the manifests.

4. MSI upgrades reset parts of snclient.ini

On upgrade, snclient.exe install pkg merges the installer defaults into snclient.ini. allowed hosts, ports, SSL and module toggles are overwritten.

Custom settings should live in snclient_local.ini, which the MSI does not touch. A future fix should skip the merge when WIX_UPGRADE_DETECTED is set.

5. Default password is fail-closed

The default password remains CHANGEME, but login is rejected while it is unchanged. A fresh winget install is therefore not remotely usable until configured. This is safe by default, but worth documenting for users.

6. Server-side winget validation may still flag things

winget validate only checks the manifest schema. The winget-pkgs validation can still flag:

• executable discovery for a service/background agent — the snclient.exe --version metadata is intended to help,
• icon validation — the MSI now carries a 16-256 px icon generated from winres/icon16.png,
• URL/domain reputation for the GitHub release URL.

Before submitting to winget-pkgs

1. Decide which release to submit:
   • v1.01.0 as-is, or
   • merge this branch, cut a new release with the icon/ARP changes, and update the manifests.
2. Update the manifests for that release:
   • PackageVersion
   • installer URLs and InstallerSha256
   • ProductCode per architecture (the MSI uses Id="*", so these change per build)
   • ReleaseDate and ReleaseNotesUrl
   • the manifests/c/ConSol/SNClient/<version>/ path
3. Run:

   winget validate --manifest packaging\winget
   

4. Test in a clean Windows VM or Windows Sandbox:
   • non-elevated install with UAC,
   • silent install and uninstall (or elevated silent),
   • service start, firewall rule, remote check,
   • reboot persistence,
   • uninstall cleanup.
5. Submit a PR to microsoft/winget-pkgs under:

   manifests/c/ConSol/SNClient/<version>/
   

   with the three YAML files. One package version per PR; sign the CLA.
6. Mention in the winget PR:
   • per-machine MSI with a Windows service,
   • the elevatesSelf workaround and the open winget bug,
   • InstallationMetadata for snclient.exe --version,
   • snclient_local.ini is intentionally preserved on uninstall.

Follow-ups (not required for this PR)

• Add a ServiceControl entry for snclient:

  <ServiceControl Id="StopSNClient" Name="snclient"
                  Stop="both" Remove="uninstall" Wait="yes" />
  

• Condition CustomInstallerAction with NOT REMOVE ~= "ALL".
• Skip mergeIniFile defaults on WIX_UPGRADE_DETECTED.
• Merge/fix the upgrade scheduling from fix-msi-installer-hang-when-service-is-runnning (stop the old service before RemoveExistingProducts).
• Consider restricting the firewall rule or making it opt-in.

Testing notes

• Windows 11 with the current winget release.
• Signed v1.01.0 MSI from the GitHub release.
• Remote check from a Linux client over VPN.
• Local MSI rebuilt with WiX 3.14.1.8722 for the ARP metadata verification.