Fix Windows 7 Updates

package           : tis-fix-windows-update-w7
version           : 1.1-5
architecture      : x86
section           : base
priority          : optional
name              : Fix Windows 7 Updates
categories        : System and network
maintainer        : WAPT Team,Tranquil IT,Jimmy PELÉ
description       : Fix issues related to Windows Update on W7 and WS2008 - 2019 SHA-2 Code Signing Support - A certificate chain processed but terminated in a root certificate which is not trusted by the trust provider
depends           : 
conflicts         : 
maturity          : PROD
locale            : 
target_os         : windows
min_os_version    : 6.1
max_os_version    : 6.2
min_wapt_version  : 1.7
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Correction des problèmes de mise à jour sur Windows 7 et Serveur 2008 - signature du code SHA-2 2019 - Une chaîne de certificats a été traitée mais s’est terminée par un certificat racine qui n’est pas approuvé par le fournisseur d’approbation.
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 181eb200-9b38-45f9-b817-8a57b0a5915e
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature         : DUdH9xG1X+rDuCgRi/mfaNNdXDVJxTcjHB77Z37yWH9ONB3cNcBuwKWfKsF709jt8Zy4S8vjpTjVarUYXI9B5t3GnJAHMtf6+vhoCfn6UbPTbQUY3LxytVHqOxdNez9PO7YkoY9HhbJ3yyzRPJ1VXa+9oMwVu1NI0/w4GAXkYFTSAhay/a9dr2RkfoxkzVs7gZ5fmD7oB2NKRokqniIj3p55MSkQtY/TDDCa77i2I8nvh7aidyQ548pOJQGM+E1dW/MNLY49d7buYt6Bo65vV7G3vTlvziqe8zZ6X5UblsPPxKUgRMdM+JW5XzJCbQgsAhtqwAl9I/s5QndGIY5pcQ==
signature_date    : 2020-11-13T12:04:25.634601
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_os_version,max_os_version,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,signer,signer_fingerprint,signature_date,signed_attributes

# -*- coding: utf-8 -*-
from setuphelpers import *
import platform

uninstallkey = []

# https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus
# 2019-03 Servicing Stack Update for Windows 7 (KB4490628)
# 2019-09 Security Update for Windows 7 (KB4474419)
# 2020-01 Update for Windows 7 (KB4539602)

# Defining variables
url_dl_kb_list = ("http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/03/windows6.1-kb4490628-x86_3cdb3df55b9cd7ef7fcb24fc4e237ea287ad0992.msu", "http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/09/windows6.1-kb4474419-v3-x86_0f687d50402790f340087c576886501b3223bec6.msu",
"http://download.windowsupdate.com/c/msdownload/update/software/updt/2020/01/windows6.1-kb4539602-x86_88331dcdecd5f05d23921d1dc26cf5715099a927.msu")
kb_list = ("windows6.1-kb4490628-x86_3cdb3df55b9cd7ef7fcb24fc4e237ea287ad0992.msu", "windows6.1-kb4474419-v3-x86_0f687d50402790f340087c576886501b3223bec6.msu","windows6.1-kb4539602-x86_88331dcdecd5f05d23921d1dc26cf5715099a927.msu")
ms_cert = 'MicrosoftRootCertificateAuthority2011.cer'


def install():
    # Installing the required KBs
    if windows_version(members_count=2) == WindowsVersions.Windows7:
        with EnsureWUAUServRunning():
            for kb_file in kb_list:
                kb_id = kb_file.split('-')[1].replace('kb','').replace('KB','')
                if not is_kb_installed(kb_id):
                    print('Installing: %s' % kb_file)
                    run('wusa.exe "%s" /quiet /norestart' % (kb_file),accept_returncodes=[0,3010,2359302,-2145124329],timeout=3600)
                else:
                    print('%s is already installed' % kb_file)

    # Adding Microsoft Root Certificate Authority to fix WUA
    try:
        run('"%s" -addstore "Root" "%s"' % (makepath(system32,'certutil.exe'),makepath(basedir,ms_cert)))
    except:
        print("WARNING: The certificate did not apply, you may need to apply it manually or with a GPO")

    if is_pending_reboot():
        print("A reboot is required.")


def update_package():
    print('Downloading/Updating package content from upstream binary sources')

    # Initializing variables
    proxies = get_proxies()
    if not proxies:
        proxies = get_proxies_from_wapt_console()
    version = control.version.split('-')[0]

    # Downloading latest KBs
    for dl_kb in url_dl_kb_list:
        file_name = dl_kb.split('/')[-1]
        if not isfile(file_name):
            print('Downloading: %s' % file_name)
            wget(dl_kb,file_name,proxies=proxies)

    # Downloading MS cert
    if not isfile(ms_cert):
        print('Downloading: %s' % ms_cert)
        wget('https://download.microsoft.com/download/2/4/8/248D8A62-FCCD-475C-85E7-6ED59520FC0F/MicrosoftRootCertificateAuthority2011.cer',ms_cert,proxies=proxies)

    # Incrementing version of the package
    control.version = '%s-%s'%(version,int(control.version.split('-')[-1])+1)
    control.save_control_to_wapt()
    print('Changing package version to: %s in WAPT\\control' % control.version)




def get_proxies():
    import platform
    if platform.python_version_tuple()[0] == '3':
        from urllib.request import getproxies
    else:
        from urllib import getproxies
    return getproxies()


def get_proxies_from_wapt_console():
    proxies = {}
    if platform.system() == 'Windows':
        waptconsole_ini_path = makepath(user_local_appdata(), 'waptconsole', 'waptconsole.ini')
    else:
        waptconsole_ini_path = makepath(user_home_directory(), '.config', 'waptconsole', 'waptconsole.ini')
    if isfile(waptconsole_ini_path):
        proxy_wapt = inifile_readstring(waptconsole_ini_path, 'global', 'http_proxy')
        if proxy_wapt:
            proxies = {'http': proxy_wapt, 'https': proxy_wapt}
    return proxies


def is_kb_installed(hotfixid):
    """Return True or False depending if a Windows update KB is installed.
    """
    installed_update = installed_windows_updates()
    if installed_update:
        if [kb for kb in installed_update if kb['HotFixID'].upper() == hotfixid.upper()]:
            return True
    return False


def is_pending_reboot():
    """Return True or False depending if Windows is waiting for a reboot.
    """
    if reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') or \
        reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') or \
        reg_key_exists(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Updates\UpdateExeVolatile'):
        return True
    return False

847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61 : MicrosoftRootCertificateAuthority2011.cer
3e4d86f740d9844c0b86b3f2ffd614923627280ed8b530fcbf80c87c11373a6a : setup.py
8cf49fc7ac61e0b217859313a96337b149ab41b3307eb0d9529615142ea34c6c : windows6.1-kb4474419-v3-x86_0f687d50402790f340087c576886501b3223bec6.msu
b86849fda570f906012992a033f6342373c00a3b3ec0089780eabb084a9a0182 : windows6.1-kb4490628-x86_3cdb3df55b9cd7ef7fcb24fc4e237ea287ad0992.msu
33d3450f07d538a1bc0d1b03460fc5d0e6a8bb0d1892329e6e46e6f47bf2a41f : windows6.1-kb4539602-x86_88331dcdecd5f05d23921d1dc26cf5715099a927.msu
a5a97261381e1d0ad46ee15916abec9c2631d0201f5cc50ceb0197a165a0bbbf : WAPT/certificate.crt
aeea4815193d731ace75e52b9aa9e131c7378dfd60d1554ff9913b31345e4a78 : WAPT/control