Inno Setup is Flagged as Trojan?

[DanH]

@Christoph-Hart Yup my InnoSetup installers only very occasionally get flagged on a users system (I suspect more than I know because users are used to this and simply install them anyway), so I would send some out to beta testers and see what happens @aaronventure

[d.healey]

@DanH There's also browsers which have their own system for flagging suspicious binaries and preventing the user downloading them.

[DanH]

@d-healey haven't had any issues with those thus far far :crossed_fingers:

[aaronventure]

@Christoph-Hart I tried it on another computer, instantly flagged. No files at all inside, just a blank installer, no changes to the script.

That one won't event build one. I'm scanning with VirusTotal.

I just need to ask the user where they want the samples, then put the vst3 into the right folder, and create the LinkWindows file. That can be done with HISE, right? Had a brief look at the file and filesystem api...

[DanH]

@aaronventure yes that can all be done with a Hise app, but perhaps try building your inno stuff on a different computer first

[Christoph Hart]

Have you named your installer setup.exe or a custom name? Apparently calling it setup.exe will raise the probability of a false positive.

You gotta appreciate the brain power and excellence that went into developing antivirus software, that‘s some peak genius move.

[Lindon]

@aaronventure said in Inno Setup is Flagged as Trojan?:

@Christoph-Hart I tried it on another computer, instantly flagged. No files at all inside, just a blank installer, no changes to the script.

That one won't event build one. I'm scanning with VirusTotal.

I just need to ask the user where they want the samples, then put the vst3 into the right folder, and create the LinkWindows file. That can be done with HISE, right? Had a brief look at the file and filesystem api...

So we use (from time to time) a single custom installer for MacOS and Windows written in HISE, it seems to work fine. This shows the user the EULA and gets them to agree then installs the plugins (VST3, AU, AAX) as required by each OS, asks the user where they want the samples placing - and puts them there - and creates the LinkOS file. It puts the factory presets in the correct folder, the HISE HWT files in the correct folder and all the wav files (Convolutions and file player stuff) in the correct location. Finally it puts a bunch of meta data in the APP folder (usually json and js files).

Basically it uses an internal manifest file - that lists a series of zip files (renamed as something other than .zip to get around Safari) with a destination for each of the unzipped contents. Here's an example with a lot of samples in it..

var manifest =  [
	
	{	"DataType" : VST3,
		"Location" : VST3LOCATION,
		"WindowsZipName"  : ["Atmosia25Data01.cra"],
		"MacOSZipName" : ["Atmosia25Data02.cra"],
		"MegaBytesRequired" : 1
	},
	{
		"DataType" : AU,
		"Location" : AULOCATION,
		"WindowsZipName"  : ["UNUSED"],
		"MacOSZipName" : ["Atmosia25Data03.cra"],
		"MegaBytesRequired" : 1
	},
	{
		"DataType" : CHFILES,
		"Location" : EXISTINGLOCATION,
		"WindowsZipName"  : ["Atmosia25Data04.cra","Atmosia25Data05.cra","Atmosia25Data06.cra"],
		"MacOSZipName" : ["Atmosia25Data04.cra","Atmosia25Data05.cra","Atmosia25Data06.cra"],
		"MegaBytesRequired" : 2600
	},
	{
		"DataType" : METAFILES,
		"Location" : PRESETLOCATION,
		"WindowsZipName"  : ["Atmosia25Data07.cra"],
		"MacOSZipName" : ["Atmosia25Data07.cra"],
		"MegaBytesRequired" : 1
	},
	{
		"DataType" : WAVFILES,
		"Location" : AUDIOFILESLOCATION,
		"WindowsZipName"  : ["Atmosia25Data08.cra"],
		"MacOSZipName" : ["Atmosia25Data08.cra"],
		"MegaBytesRequired" : 26 
	},
	{
		"DataType" : PRESETFILES,
		"Location" : PRESETLOCATION,
		"WindowsZipName"  : ["Atmosia25Data09.cra"],
		"MacOSZipName" : ["Atmosia25Data09.cra"],
		"MegaBytesRequired" : 13
	} 
];

Then it uses the file system API to get the locations and the File.extractZipFile() to put things in the correct place

So the customer has to download these renamed zip files and a zip containing the installer - then run the installer. If you dont want the user doing these multiple downloads(the example above is 9 .cra files) you can even add that into the installer app and then the user downloads and unzips the installer - runs it and follows the instructions in the installer...

On MacOS you will need to codesign the plugins and the installer App and also notarize the Installer App - to be honest we notarize the plugins too...AU and VST3..

[Oli Ullmann]

@Lindon
Have you never had writing permission problems? And if you did, how did you solve them?

[d.healey]

@Oli-Ullmann On Windows there is a checkbox in HISE preference to enable admin permissions. Doesn't work from plugins though, only standalone. No issue on MacOS as far as I'm aware.

[Lindon]

@d-healey said in Inno Setup is Flagged as Trojan?:

@Oli-Ullmann On Windows there is a checkbox in HISE preference to enable admin permissions. Doesn't work from plugins though, only standalone. No issue on MacOS as far as I'm aware.

on the Mac you may well need to turn on the sandbox authorisation...

[Oli Ullmann]

@d-healey
Thank you for the tip! :-)

[Oli Ullmann]

@Lindon
Many thanks for the information! Can you tell me where I can do this? In the HISE Preferences?

[DanH]

@d-healey i still get users having issues with permissions on windows even with this checked. Not often but it happens and is annoying. Do you not?

[d.healey]

@DanH I haven't had any issues in a standalone build.

[Lindon]

@Oli-Ullmann said in Inno Setup is Flagged as Trojan?:

@Lindon
Many thanks for the information! Can you tell me where I can do this? In the HISE Preferences?

if I remember correctly its in projuicer

[aaronventure]

Let's see if we can't fuck over the mafia, at least the one dealing certs for Windows.

Does extractzip work on split zip files?

How do I point to the folder where the standalone is currently located? I don't see a Filesystem.special for this.

I'm thinking of having a very generic installer that works for all. Server interfacing, if necessary, is then up to each individual project to be done from inside the plugin.

I'm working on one right now.

• deliver one zip, when unpacked contains setup.exe (built in HISE), Plugins.zip, Samples.zip, etc.
• check current exe directory (how?) extract Plugins.zip to FileSystem.temp, check for each extension, if it exists, move it to the correct place
• extract Samples.zip, which can contain all the big files, to a folder the user specified
• write the linkfile for the user specified folder
• if there are files you'd like in a different place, simply zip them into a different archive.
• this also allows the user to do a manual install if they wish
• ship a text file that stores CompanyName and ProjectName so that the correct base path, title etc. can be displayed.

This kind of installer can then be shipped with any HISE-based plugin and just work out of the box.

[d.healey]

@aaronventure said in Inno Setup is Flagged as Trojan?:

Does extractzip work on split zip files?

There is no split zip in the zip standard, I think programs like winrar might have their own version. But you can loop over multiple zip files and call extractZip in a loop.

deliver one zip, when unpacked contains setup.exe (built in HISE), Plugins.zip, Samples.zip, etc.

Be sure to change the file extension otherwise it will automatically be extracted if the user is using Safari, or has enabled the auto-extract setting in their browser.

check current exe directory (how?)

What are you checking for?

@aaronventure said in Inno Setup is Flagged as Trojan?:

I'm thinking of having a very generic installer that works for all.

This guy had the same idea ;) - https://forum.hise.audio/topic/8707/rhapsody-plugin-installer

[aaronventure]

@d-healey said in Inno Setup is Flagged as Trojan?:

There is no split zip in the zip standard, I think programs like winrar might have their own version. But you can loop over multiple zip files and call extractZip in a loop.

Alright, do you think would be necessary in the first place? In what situations, other than FAT32, are large archives an issue?

Would be somewhat weird to ship an 80GB Samples.zip, but if it works, who cares.

Not being able to simply zip up all the samples into a split archive with a single task makes it a bit problematic, no?

If I split a zip file using 7zip, it creates file.zip.001, zip.002, and 7zip has no issues extracting from these files if the extraction is initiated on the .001 file.

@d-healey said in Inno Setup is Flagged as Trojan?:

Be sure to change the file extension otherwise it will automatically be extracted if the user is using Safari, or has enabled the auto-extract setting in their browser.

That's great, didn't know about that. Can I just change it to anything and HISE will still unzip it? the .002, .003 split system from 7zip bypasses this issue, no?

@d-healey said in Inno Setup is Flagged as Trojan?:

What are you checking for?

The idea is to script the installer to extract the archives that are in the same directory as the installer itself. So I need a constant that will always return the current standalone .exe directory.

@d-healey said in Inno Setup is Flagged as Trojan?:

This guy had the same idea ;)

Haha that's great! Do you think a dedicated project that's then licensed as MIT, would be a good default option for HISE on Windows? That way anything we make here can still go into Rhapsody under GPL and anywhere else.

[Lindon]

@d-healey said in Inno Setup is Flagged as Trojan?:

@aaronventure said in Inno Setup is Flagged as Trojan?:

Does extractzip work on split zip files?

There is no split zip in the zip standard, I think programs like winrar might have their own version. But you can loop over multiple zip files and call extractZip in a loop.

deliver one zip, when unpacked contains setup.exe (built in HISE), Plugins.zip, Samples.zip, etc.

Be sure to change the file extension otherwise it will automatically be extracted if the user is using Safari, or has enabled the auto-extract setting in their browser.

check current exe directory (how?)

What are you checking for?

@aaronventure said in Inno Setup is Flagged as Trojan?:

I'm thinking of having a very generic installer that works for all.

This guy had the same idea ;) - https://forum.hise.audio/topic/8707/rhapsody-plugin-installer

so did this guy:

[d.healey]

@aaronventure said in Inno Setup is Flagged as Trojan?:

Alright, do you think would be necessary in the first place? In what situations, other than FAT32, are large archives an issue?

I wouldn't provide a file larger than 2GB. Some users have dodgy internet connections and if it goes down during a 2GB file it's not a problem but a 10GB file that they've been downloading for hours will be annoying. 4GB is probably ok, but I like to keep it to 2. I also suspect some browsers might have limitations on the download size for a single file, though I've not looked into it.

Not being able to simply zip up all the samples into a split archive with a single task makes it a bit problematic, no?

I make my own multi-part zips (HISE will do this for you automatically for samples). It's just a case of bundling the samples into multiple zip files and adding part1, part2, etc. to the name. Before you extract them you can sort the files alphabetically so that they will be extracted in order, which is sometimes necessary.

Can I just change it to anything and HISE will still unzip it?

Yup

@aaronventure said in Inno Setup is Flagged as Trojan?:

The idea is to script the installer to extract the archives that are in the same directory as the installer itself. So I need a constant that will always return the current standalone .exe directory.

Why? I just ask the user to select the location of the files.

@aaronventure said in Inno Setup is Flagged as Trojan?:

Do you think a dedicated project that's then licensed as MIT,

Can you release JUCE/HISE code under the MIT license without paying a license fee?