Fix Windows 7 Updates

package           : tis-fix-windows-update-w7
version           : 1.0-3
architecture      : x86
section           : base
priority          : optional
name              : Fix Windows 7 Updates
categories        : System and network
maintainer        : WAPT Team,Tranquil IT,Jimmy PELÉ
description       : Fix issues related to Windows Update on W7 and WS2008 - 2019 SHA-2 Code Signing Support - A certificate chain processed but terminated in a root certificate which is not trusted by the trust provider
depends           : 
conflicts         : 
maturity          : PROD
locale            : 
target_os         : windows
min_os_version    : 6.1
max_os_version    : 6.2
min_wapt_version  : 1.7
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Correction des problèmes de mise à jour sur Windows 7 et Serveur 2008 - signature du code SHA-2 2019 - Une chaîne de certificats a été traitée mais s’est terminée par un certificat racine qui n’est pas approuvé par le fournisseur d’approbation.
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 4f6d6f2e-12ec-424b-af7f-27fcf930c860
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature         : mZ29GlbkNkmblApMpW1mWi3KvMpMoUgzwCaS4ZPWvxA8oC++EyHuo+QTZ9t/WXYqF0hro5WCzEsQ+BHeX3HVrZnTHCuDUDT04d67adqTMDqrUFqWT02T62Fi6vDsQRxhgERRYbV8YJW+quZCRFKr9jVuI0X9xWdJUWmpA0SkZNWoNzNuhswcYAtqoo6oqF9vMDhUJWoc09v/0YJXWgMNQsCogKmXCa+l+yCOMRxO5TRB3SjahSSR8phzni4TVVdrzlBzAb1AKec/tyU+KppmKo/caD4Omq9Jue0YPef5aRPaoQrX7cU+uOcgtEQ1Z77Qjr1Lk4HglySnjFR289vybw==
signature_date    : 2020-10-21T15:06:02.233853
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_os_version,max_os_version,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,signer,signer_fingerprint,signature_date,signed_attributes

# -*- coding: utf-8 -*-
from setuphelpers import *

uninstallkey = []

# https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus
# 2019-03 Servicing Stack Update for Windows 7 (KB4490628)
# 2019-09 Security Update for Windows 7 (KB4474419)

# Defining variables
url_dl_kb_list = ("http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/03/windows6.1-kb4490628-x86_3cdb3df55b9cd7ef7fcb24fc4e237ea287ad0992.msu", "http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/09/windows6.1-kb4474419-v3-x86_0f687d50402790f340087c576886501b3223bec6.msu")
kb_list = ("windows6.1-kb4490628-x86_3cdb3df55b9cd7ef7fcb24fc4e237ea287ad0992.msu", "windows6.1-kb4474419-v3-x86_0f687d50402790f340087c576886501b3223bec6.msu")
ms_cert = 'MicrosoftRootCertificateAuthority2011.cer'


def install():
    # Installing the required KBs
    if windows_version(members_count=2) == WindowsVersions.Windows7:
        with EnsureWUAUServRunning():
            for kb_file in kb_list:
                kb_id = kb_file.split('-')[1].replace('kb','').replace('KB','')
                if not is_kb_installed(kb_id):
                    print('Installing: %s' % kb_file)
                    run('wusa.exe "%s" /quiet /norestart' % (kb_file),accept_returncodes=[0,3010,2359302,-2145124329],timeout=3600)
                else:
                    print('%s is already installed' % kb_file)

    # Adding Microsoft Root Certificate Authority to fix WUA
    try:
        run('"%s" -addstore "Root" "%s"' % (makepath(system32,'certutil.exe'),makepath(basedir,ms_cert)))
    except:
        print("WARNING: The certificate did not apply, you may need to apply it manually or with a GPO")

    if is_pending_reboot():
        print("A reboot is required.")


def update_package():
    print('Downloading/Updating package content from upstream binary sources')

    # Initializing variables
    proxies = get_proxies()

    # Downloading latest KBs
    for dl_kb in url_dl_kb_list:
        file_name = dl_kb.split('/')[-1]
        if not isfile(file_name):
            print('Downloading: %s' % file_name)
            wget(dl_kb,file_name,proxies=proxies)

    # Downloading MS cert
    if not isfile(ms_cert):
        print('Downloading: %s' % ms_cert)
        wget('https://download.microsoft.com/download/2/4/8/248D8A62-FCCD-475C-85E7-6ED59520FC0F/MicrosoftRootCertificateAuthority2011.cer',ms_cert,proxies=proxies)




def get_proxies():
    import platform
    if platform.python_version_tuple()[0] == '3':
        from urllib.request import getproxies
    else:
        from urllib import getproxies
    return getproxies()


def is_kb_installed(hotfixid):
    """Return True or False depending if a Windows update KB is installed.
    """
    installed_update = installed_windows_updates()
    if installed_update:
        if [kb for kb in installed_update if kb['HotFixID'].upper() == hotfixid.upper()]:
            return True
    return False


def is_pending_reboot():
    """Return True or False depending if Windows is waiting for a reboot.
    """
    if reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') or \
        reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') or \
        reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Updates\UpdateExeVolatile'):
        return True
    return False

847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61 : MicrosoftRootCertificateAuthority2011.cer
9f468eade36c0b207d4205166fc7667e0502a678fb95c8f7d0d638324124e2e5 : setup.py
8cf49fc7ac61e0b217859313a96337b149ab41b3307eb0d9529615142ea34c6c : windows6.1-kb4474419-v3-x86_0f687d50402790f340087c576886501b3223bec6.msu
b86849fda570f906012992a033f6342373c00a3b3ec0089780eabb084a9a0182 : windows6.1-kb4490628-x86_3cdb3df55b9cd7ef7fcb24fc4e237ea287ad0992.msu
a5a97261381e1d0ad46ee15916abec9c2631d0201f5cc50ceb0197a165a0bbbf : WAPT/certificate.crt
47b396097918b4cda5acd597f95fc66eada9cfe61f52e3ac5aa08eebd5349e41 : WAPT/control