Fix Windows 7 Updates

package           : tis-fix-windows-update-w7
version           : 1.0-3
architecture      : x64
section           : base
priority          : optional
name              : Fix Windows 7 Updates
categories        : System and network
maintainer        : WAPT Team,Tranquil IT,Jimmy PELÉ
description       : Fix issues related to Windows Update on W7 and WS2008 - 2019 SHA-2 Code Signing Support - A certificate chain processed but terminated in a root certificate which is not trusted by the trust provider
depends           : 
conflicts         : 
maturity          : PROD
locale            : 
target_os         : windows
min_os_version    : 6.1
max_os_version    : 6.2
min_wapt_version  : 1.7
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Correction des problèmes de mise à jour sur Windows 7 et Serveur 2008 - signature du code SHA-2 2019 - Une chaîne de certificats a été traitée mais s’est terminée par un certificat racine qui n’est pas approuvé par le fournisseur d’approbation.
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 8fde965b-3932-4ace-85b6-bb8d33db9e94
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature         : QHm0qaHEqI83Zx9qaEd0TVife4bolNkaJbtrZm4oj4HysUYrvU6X+6688iV2IYzmdMWgSc/aRaBcF/dGd6A5rX2U0+Hvy+ppoOivJxMvG3Jo5pjF0HmHsjl1A28Wsd6+ixyLuPnZIIj3LbSZ384Cae4BxrV8CGxSdK8C8SKJ+bAdA3nOvAWPLgDrVeG179XpweatycNbfOqLXR3rLtdCqnVbH/Sl2pxlqQyLcsRiPBw3O5RVQJ8XT/6Qfm1eKtvpJDAfrW7liN9CDgqOGP/NUxU5O+us9wOYuZfdgE3lICnJTap0iZ4OFwXmR3Cngmux9x9f0eZQyU8GzpiqEMFt7Q==
signature_date    : 2020-10-21T15:05:45.531096
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_os_version,max_os_version,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,signer,signer_fingerprint,signature_date,signed_attributes

# -*- coding: utf-8 -*-
from setuphelpers import *

uninstallkey = []

# https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus
# 2019-03 Servicing Stack Update for Windows 7 (KB4490628)
# 2019-09 Security Update for Windows 7 (KB4474419)

# Defining variables
url_dl_kb_list = ("http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/03/windows6.1-kb4490628-x64_d3de52d6987f7c8bdc2c015dca69eac96047c76e.msu", "http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/09/windows6.1-kb4474419-v3-x64_b5614c6cea5cb4e198717789633dca16308ef79c.msu")
kb_list = ("windows6.1-kb4490628-x64_d3de52d6987f7c8bdc2c015dca69eac96047c76e.msu", "windows6.1-kb4474419-v3-x64_b5614c6cea5cb4e198717789633dca16308ef79c.msu")
ms_cert = 'MicrosoftRootCertificateAuthority2011.cer'


def install():
    # Installing the required KBs
    if windows_version(members_count=2) == WindowsVersions.Windows7:
        with EnsureWUAUServRunning():
            for kb_file in kb_list:
                kb_id = kb_file.split('-')[1].replace('kb','').replace('KB','')
                if not is_kb_installed(kb_id):
                    print('Installing: %s' % kb_file)
                    run('wusa.exe "%s" /quiet /norestart' % (kb_file),accept_returncodes=[0,3010,2359302,-2145124329],timeout=3600)
                else:
                    print('%s is already installed' % kb_file)

    # Adding Microsoft Root Certificate Authority to fix WUA
    try:
        run('"%s" -addstore "Root" "%s"' % (makepath(system32,'certutil.exe'),makepath(basedir,ms_cert)))
    except:
        print("WARNING: The certificate did not apply, you may need to apply it manually or with a GPO")

    if is_pending_reboot():
        print("A reboot is required.")


def update_package():
    print('Downloading/Updating package content from upstream binary sources')

    # Initializing variables
    proxies = get_proxies()

    # Downloading latest KBs
    for dl_kb in url_dl_kb_list:
        file_name = dl_kb.split('/')[-1]
        if not isfile(file_name):
            print('Downloading: %s' % file_name)
            wget(dl_kb,file_name,proxies=proxies)

    # Downloading MS cert
    if not isfile(ms_cert):
        print('Downloading: %s' % ms_cert)
        wget('https://download.microsoft.com/download/2/4/8/248D8A62-FCCD-475C-85E7-6ED59520FC0F/MicrosoftRootCertificateAuthority2011.cer',ms_cert,proxies=proxies)




def get_proxies():
    import platform
    if platform.python_version_tuple()[0] == '3':
        from urllib.request import getproxies
    else:
        from urllib import getproxies
    return getproxies()


def is_kb_installed(hotfixid):
    """Return True or False depending if a Windows update KB is installed.
    """
    installed_update = installed_windows_updates()
    if installed_update:
        if [kb for kb in installed_update if kb['HotFixID'].upper() == hotfixid.upper()]:
            return True
    return False


def is_pending_reboot():
    """Return True or False depending if Windows is waiting for a reboot.
    """
    if reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') or \
        reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') or \
        reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Updates\UpdateExeVolatile'):
        return True
    return False

847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61 : MicrosoftRootCertificateAuthority2011.cer
1d8f4a224d04e2efbd6875e621e0b31723a6debc569f032bc39b1d680726de28 : setup.py
99312df792b376f02e25607d2eb3355725c47d124d8da253193195515fe90213 : windows6.1-kb4474419-v3-x64_b5614c6cea5cb4e198717789633dca16308ef79c.msu
8075f6d889bcb27be6f52ed47081675e5bb8a5390f2f5bfe4ec27a2bb70cbf5e : windows6.1-kb4490628-x64_d3de52d6987f7c8bdc2c015dca69eac96047c76e.msu
a5a97261381e1d0ad46ee15916abec9c2631d0201f5cc50ceb0197a165a0bbbf : WAPT/certificate.crt
d22c9ed7f5fef52c9322cc2d95ae585bac04267c3ea5974253776979b61c6462 : WAPT/control