Changelog¶

WAPT-2.6 Serie¶

WAPT-2.6.0.16883 [CSPN] (2026-10-07)¶

hash: 225350ff

This is a security hardening and a COTS update release.

COTS upgrades

Python dependency changes¶
Package	Previous version	New version
Python	3.10.21	3.11.17
OpenSSL	3.5.7	3.5.9
Pgsql connector	15.18	15.19
Innosetup	6.7.3	7.1.0
7zip	26.01	26.03
Sqlite	35.3.2	35.3.4

Python packages dependencies updates

Python dependency changes¶
Package	Previous version	New version
arpy	2.3.0	2.4.0
bidict	0.23.1	0.24.1
cachelib	0.14.0	0.17.0
certifi	2026.5.20	2026.7.22
cffi	2.0.0	2.1.1
chardet	7.4.3	7.6.0
charset-normalizer	3.4.7	3.5.2
click	8.4.1	8.5.0
cryptography	46.0.7	50.0.2
eventlet	0.41.0	0.41.2
greenlet	3.5.1	3.5.6
huey	3.0.1	3.4.0
idna	3.18	3.20
importlib-metadata	9.0.0	9.0.1
iniparse	0.5	0.5.1
jaraco-functools	4.5.0	4.6.0
msgspec `[linux]`	0.21.1	0.22.0
packaging `[darwin]`	26.2	26.3
peewee	3.19.0	4.5.2
psycopg2 `[linux]`	2.9.12	2.9.13
pyparsing `[linux]`	3.3.2	3.3.3
python-engineio	4.13.2	4.14.0
python-pam `[linux, darwin]`	2.0.2	2.1.0
python-socketio	5.16.2	5.17.0
setuptools	82.0.1	84.0.0
soupsieve	2.8.4	2.10
typing_extensions	4.15.0	4.16.0
ujson	5.12.1	6.0.0
urllib3	2.7.0	2.8.0
wakeonlan	3.3.0	4.0.0
websocket-client	1.9.0	1.9.2
werkzeug	3.1.8	3.1.9

Security Hardening:

[SEC] waptserver: in depth hardening of SQL handling
[SEC] waptserver: hardening of db connexion : use readonly db connexion in api endpoint where only read access is required
[SEC] waptserver: add extra checks for path validation for in depth hardening
[SEC] waptagent: waptexit add extra check for path validatoin for in depth hardening

WAPT-2.6.1.17870 (2026-09-01)¶

hash: d3b9238d

This is a bugfix and COTS release.

[SEC] waptcore: update to Python 3.10.21, OpenSSL 3.5.8 and other COTS updates
[FIX] waptserver: fix regression on waptserver version request in ping. Fixes unable to get and upload linux agents
[FIX] waptserver: fix homepage auth with Chrome. Don’t return Negociate auth header if it has failed
[FIX] waptserver wads: regression in drivers upload
[IMP] waptsetup: use KillExe() function instead of {sysnative}\taskkill.exe to avoid install deadlock
[IMP] waptsetup: ExecAndWait: use ExecAndCaptureOutputWithNativeSysDir for better logging of stdout and stderr
[FIX] waptsetup: fix RestoreSSL (rename back %WAPT_HOME%\ssl\*.crt.upgrade -> %WAPT_HOME%\ssl\*.crt) if install is interrupted due to locked files
[FIX] waptwua: on client don’t keep non http url in DownloadUrls collection to avoid cluttering inventories with non-usable urls
[FIX] waptserver: hardened update_all_crls function, fix update_crls inverted offset
[IMP] waptserver: regenerate crl signature 12 hours before expiry to have some overlap.
[IMP] waptdeploy: incluse a manifest to tell Windows to avoid being run with UAC virtualization.
[FIX] waptdeploy: use %SYSTEMROOT%\SystemTemp if current user is LOCALSYSTEM account if directory exists, else use %SYSTEMROOT%\Temp. This should solve the issue where waptdeploy don’t wait for waptsetup.exe terminate
[IMP] waptdeploy: add retry check waptservice status ping 3 times with 3s delay

WAPT-2.6.1.17861 (2026-08-27)¶

hash: 33c1eb1e

This is a security and bugfix release. It is recommended to upgrade.

Note

Kerberos authentication is now processed by WaptServer and removed from Nginx. This removes the dependency on Nginx SPNego Kerberos module. The postconf.sh script will update the nginx.conf script accordingly. Be sure to run the postconf script after upgrade.

[IMP] waptagent: waptdeploy now downloads waptagent.exe in %SYSTEMDRIVE%\Windows\SystemTemp if it exists (from Windows 10 22h2 and above) and fallback on %SYSTEMDRIVE%\Windows\Temp if SystemTemp does not exists.
[FIX] waptcore: fix memory leak in THttpRequestThread (HttpClient not freed)
[FIX] waptcore: fix potential AV in waptwget
[FIX] waptconsole: in the inventory tab, fix regression on “show host’s waptagent configuration” where the popup with said configuration may fail to display.
[FIX] waptconsole: in remote repo tab, fix import repo rules from file
[IMP] waptconsole: removed spurious “acls changed” warning message
[IMP] waptserver: for kerberos auth, use gssapi lib from mormot instead of libnginx-mod-http-auth-spnego. This remove the requirement for libnginx-mod-http-auth-spnego. It is not supported on Windows yet.
[SEC] waptserver: fix bypass SQL select query scope restrictions for authenticated waptconsole users
[FIX] setuphelpers: fix regression on wmi_info_basic() and Wapt.get_hardware_uuid :
- wmi_info_basic() : ‘System_Information’ key value is a list
- dmi_info() is now mormot’s one. Key is System.Uuid

WAPT-2.6.0.16859 [CSPN] (2026-07-17)¶

hash: d3e86c84

This is the first release of the CSPN certified version of Wapt 2.6.0. It is based on the Wapt 2.6.0 serie with security backports and hardening.

CSPN Certificate (in French): https://messervices.cyber.gouv.fr/visas/ANSSI-CSPN-2026-12-certificat.pdf
Evaluation report (in French): https://messervices.cyber.gouv.fr/visas/ANSSI-CSPN-2026-12-rapport.pdf
Target of Evaluation (ToE) (in French): https://messervices.cyber.gouv.fr/visas/ANSSI-CSPN-2026-12-cible.pdf

WAPT-2.6.1.17834 (2026-06-29)¶

hash: bd5dd3d4

This is a bugfix and COTS update release

[UPD] waptcore: update python to 3.10.20 and all python modules and other COTS
[FIX] waptagent: in waptsetup, removed the ping.exe call to avoid triggering false positive in EDR.
[SEC] waptagent: on secondary repos harden filename safety check when synchronizing from waptserver
[FIX] waptagent: fix potential AV in wapt-get build-waptagent
[FIX] waptserver: fix SELinux configuration error during postconf run on rhel <= 9.x
[FIX] waptserver: add timeout to tasks and cleanup hung tasks at startup to avoid hung wsusscn2.cab download
[FIX] wads: increase EFI partition size to 500Mo
[UPD] wads: during upload_winpe, force filenames in lowercase in pxe folder for TFTP over HTTP support using proxycache

WAPT-2.6.1.17813 (2026-06-09)¶

hash: 08e5ee5b

This is a security release (CVSS 8.8). It is highly recommended to upgrade.

Warning

Tranquil IT EV Code Signing certificate has been renewed after the last one expired on March the 7th. All new Tranquil IT assets are signed with the new certificate.

AFTER upgrading the WaptServer FROM Wapt version 2.6.1.17765 and below, if the WaptConsole has NOT YET been upgraded, you will have a warning popup like the one below when starting WaptConsole.

Error while creating waptagent.exe. Checking hashes of executables on server (waptbinaries.sha256) against Tranquil IT certificate has failed: ERROR: Signer Tranquil I.T. Systems is not trusted. Reason: unable to get local issuer certificate "Tranquil I.T. Systems" is not a trusted certificate...

This is due to the fact that the older waptconsole trie to check the signature of server binaries using the old certificate and refuse to download because it does match.

Thus the wapt admin have to download the new waptsetup.exe binary directly from the WaptServer https://srvwapt.mydomain.lan/wapt/waptsetup.exe and install it on management machine.

Note

If you have put the fingerprint of previous EV certificate in your security tooling, be sure to update the fingerprint.

NEW fingerprint: sha1:ebf9e32295791c318ddf81ce165b56eb87a02bbf / sha256:e55a1bcf9d90026c6f456e550ba76f214de2e08cb4bd67ed837c90c3ef45c66a
OLD fingerprint: sha1:c3c12a0a3cf2453ad3b293fd86600108cebffe38/ sha256:6ada4e4988570164733c713c1ca4e96551fe6a9577a60ab0a705aba85f570cba

[SEC] waptserver: fix auth bypass issue
[SEC] waptserver: better sanitize search_expression for filters on json fields.
[SEC] waptserver: better enforce token expiration if token is passed in password field
[SEC] waptserver: better sanitizing of headers to avoid potential wrong source ip logging
[SEC] waptserver: fix URL allowlist validation in waptwua WSUS download
[SEC] wads: fix path traversal issue
[SEC] waptagent: fix potential path traversal when install / removal of json config in case the json config files comes from non trusted sources.
[SEC] waptagent: ensure display_time typing in show_message via start_interactive_process
[SEC] waptagent: better enforce acl for local waptservice /waptservicerestart endpoint
[IMP] waptcore: don’t compress binaries ‘.exe’,’.cab’,’.bz2’,’.deb’,’.rpm’,’.msix’ in zipped packages
[IMP] waptagent: during waptsetup install, abort installation before starting it if some files are locked by other processes to avoid deadlock during files updates
[FIX] waptserver : improve delete_non_assigned_kb to avoid OOM issue during db cleanup during night cronjob.
[FIX] waptwua: avoid stopping / restarting running wua scan or install when there is a agent reconfiguration event
[FIX] waptwua: fix corner case of Windows Update state where calling the service wuauserv could result in potential AV in waptagent

WAPT-2.6.0.16856 (2026-06-09)¶

hash: c5bfaabc

This is a security release (CVSS 8.8). It is highly recommended to upgrade.

Warning

Tranquil IT EV Code Signing certificate has been renewed after the last one expired on March the 7th. All new Tranquil IT assets are signed with the new certificate (cf. note in 2.6.1.17786)

[SEC] waptserver: fix auth bypass issue
[SEC] waptserver: better sanitize search_expression for filters on json fields.
[SEC] waptserver: better enforce token expiration if token is passed in password field
[SEC] waptserver: better sanitizing of headers to avoid potential wrong source ip logging
[SEC] waptserver: fix URL allowlist validation in waptwua WSUS download
[SEC] wads: fix path traversal issue
[SEC] waptagent: fix potential path traversal when install / removal of json config in case the json config files comes from non trusted sources.
[SEC] waptagent: ensure display_time typing in show_message via start_interactive_process
[SEC] waptagent: better enforce acl for local waptservice /waptservicerestart endpoint
[SEC] waptcore: updated Tranquil IT code signing keys, update python 3.10.20 / sqlite 3.53.2 / lipq 15.19, update pip requirements to latest version

WAPT-2.6.1.17787 (2026-05-12)¶

hash: a1b9ea84

This is a bugfix release.

Warning

Tranquil IT EV Code Signing certificate has been renewed after the last one expired on March the 7th. All new Tranquil IT assets are signed with the new certificate.

AFTER upgrading the WaptServer FROM Wapt version 2.6.1.17765 and below, if the WaptConsole has NOT YET been upgraded, you will have a warning popup like the one below when starting WaptConsole.

This is due to the fact that the older waptconsole trie to check the signature of server binaries using the old certificate and refuse to download because it does match.

Thus the wapt admin have to download the new waptsetup.exe binary directly from the WaptServer https://srvwapt.mydomain.lan/wapt/waptsetup.exe and install it on management machine.

Note

If you have put the fingerprint of previous EV certificate in your security tooling, be sure to update the fingerprint.

NEW fingerprint: sha1:ebf9e32295791c318ddf81ce165b56eb87a02bbf / sha256:e55a1bcf9d90026c6f456e550ba76f214de2e08cb4bd67ed837c90c3ef45c66a
OLD fingerprint: sha1:c3c12a0a3cf2453ad3b293fd86600108cebffe38/ sha256:6ada4e4988570164733c713c1ca4e96551fe6a9577a60ab0a705aba85f570cba

Detailed changelog:

[FIX] wads: fix a bug in djoin when adding the computer to an Active Directory group larger than 1500 members that could wipe the group content
[IMP] wads: fix wapttftpserver startup error on Redhat and derivatives. Use root_dir from waptserver.ini, removed –root_dir from systemd service file
[NEW] waptcore: in waptagent, wads, wgetwads, add a check_rules_signature ini parameter (default False). By default, we don’t check rules signature anymore as it does not add additional security. In some large organizations where there are a lot of administrators, checking signature is problematic as rules are common to all departments. Indeed adding a rule or reordering rules trigger re-signature of all rules, which are then refused by part of clients not accepting the specific administrator certificate. Fallback to main server raises a potential DDOS.
[FIX] waptcore: fix batteries audit function (waptlicences PyPowerRequest and power_manage_request)
[IMP] waptcore: updated Tranquil IT code signing keys. Old certificates expired on March the 7th 2026. If you have pinned Tranquil IT old certificate, be sure to update the fingerprint. New fingerprint : ebf9e32295791c318ddf81ce165b56eb87a02bbf
[NEW] waptcore : add agent packages_default_allow boolean parameter for packages_blacklist / packages_whitelist handling
- add packages_default_allow_default in TRepositoryConfigParameters
- add packages_default_allow in python WaptBaseRepo and HostCapabilities
[IMP] waptserver: ignore Wapt machine certificate from inventory data send by a client during update_host call
[FIX] waptserver: fix 666 error due to connexion closed abruptly serverside on waptconsole or waptagent This was due to client connection close socket in socket auth callback with Negotiate test in SSPI/GSSAPIAuthorize.
[FIX] waptconsole: don’t throw away newly created users when filtering the ACL view
[FIX] waptconsole: in dynamic configurations edit, don’t add empty item in treeview when switching to another conf
[FIX] waptwua: fix potential AV in TWaptWUA that could make Windows Updates fails in some corner cases
[IMP] waptagent: in client waptserver threaded request, init from actual existing IWaptServer instance instead of inifile. It is more efficient, and avoid potential issue if ini file has been updated externally during waptconsole session.

WAPT-2.6.1.17765 (2026-02-27)¶

hash: f1ef6f1c

This is a security, bugfix, and COTS update release.

Detailed changelog:

[UPD] waptconsole: adding wpeutil UpdateBootInfo command in WinPE startup script
[IMP] waptconsole: keep the new user when searching in the ACL view
[IMP] waptconsole: add same words highlighting in integrated code editor
[FIX] waptconsole: fix error “unable to read key data” when loading signer key.
[IMP] waptconsole: fix temp certificate not deleted at program exit
[IMP] waptagent: add no_sleep flag to wapt-get install / upgrade tasks to disable sleep mode when wapt installs are running
[FIX] waptgent: on linux agent fix ad groups lookup issue in self service. Add Environment=KRB5_CLIENT_KTNAME=/etc/krb5.keytab to waptservice.service
[IMP] waptagent: add peercache_enable ini parameter to wapt-get build-waptagent
[FIX] waptagent: waptupgrade package: use only XML file for schtasks calls. New location of waptdeploy and waptsetup during upgrade is incompatible with the /TR option (path longer than 256 chars). Improve package cleanup
[FIX] waptagent: during calls to waptserve (Wget JsonPostStr JsonDeleteStr JsonMultipartFilePost raise exception earlier if HttpStatus is >= 400 to avoid unecessary calls
[FIX] waptagent: handle config name detection in waptsetup.exe filename like waptsetup-2.6.2.17873_ac-cgdd_bf2e87a7f74d4fef1ae3fc25ffe22adc1aef9c4d7f54617a10496c74f66ee8a9.exe
[IMP] waptagent: on Windows add CoInitializeEx(Nil, COINIT_MULTITHREADED) for wmi_get and wmi_search
[IMP] waptagent: in WaptExit cleanup small visual glitch due to leftover design time items in treeview
[FIX] waptagent: fix incorrect wapt-get get-json-config output
[IMP] waptagent: wapt-get: open local sqlite3 public and private db in readonly mode except during write operations On linux, opening sqlite db in read write locks the db and raises an access violation if another process tries to open it at the same time. Fix get-public-param and memory leak in waptdb.select()
[FIX] waptagent: add wapt-get --notify_server=0/1 option to force or force disable notification. Update inline help
[FIX] waptagent: on Linux and macOS, fix host_info false dmidecode error message
[UPD] waptagent: add option wapt-get create-keycert --export_pkcs12=0/1 option (default 1)
[UPD] waptagent: add option wapt-get create-keycert --CA=0/1 CA parameter (default to 0)
[FIX] waptserver: on WaptServer on Windows, in winsetup: set default dhparam size to 2048, and force recreate dhparam 2048 if it looks like too small (necessary for nginx >=1.28)
[UPD] wads: Switch default value for boot type (UEFI vs. legacy) to UEFI (PEFirmwareType = 2) winpe boot type detection fails (ie if wpeutil UpdateBootInfo fails)
[IMP] waptwua: wapt-get -S waptwua-install --uuids=<csv> and wapt-get -S waptwua-download --uuids=<csv> arg to specify which updates ids to install
[SEC] waptcore: remove additional chars (accents, ':',',','/','','*','?','|','#') in console MakeValidPackageName
[IMP] waptcore: add class no_sleep, if task running no_sleep = True (disable sleep when wapt running task)
[IMP] waptcore: normalize domaingroup into group@domain in get_allowed_domain_usergroups
- pyldap get_authorized_user_groups does not support having backslashes in group names (as it is a bad ldap syntax)
[IMP] waptcore: save setup.params updates after package’s install hook has been called. Allow to save in local private DB some information for further use in audit or uninstall
[IMP] waptcore: in waptlicences add PyPowerRequest and power_manage_request(reason: str, request_type: int) context handler
- request_type : PowerRequestDisplayRequired = 0, PowerRequestSystemRequired = 1, PowerRequestAwayModeRequired = 2, PowerRequestExecutionRequired = 3
[FIX] waptcore: ldap search tokenGroups not working if search_scope!=base
[FIX] waptcore: fix bug in pyLdapClient.add that could make add operation fails.
[IMP] setuphelpers: Unix get_domain_info() : by default, don’t run code:kinit. TGT is automatically requested when KRB5_CLIENT_KTNAME environment variable is set
[FIX] setuphelpers: waptupgrade: fix create_startup_task time tuple error
[IMP] setuphelpers: on Linux use mORMot instead of dmidecode binary for hardware information. get_dmi_info() return dict with keys ['Bios', 'System', 'Security', 'Board', 'Chassis', 'Processor', 'Memory', 'Connector', 'Slot', 'PointingDevice', 'Battery', 'Oem']

WAPT-2.6.1.17705 (2026-02-04)¶

hash: 092e11fc

This is a security, bugfix, and COTS update release. Security hardening includes update OpenSSL to 3.5.5 and hardening of waptdeploy.exe to avoid potential dll search path hijacking (thanks to myst404 from French company Almond for the input).

Note

If you have configured waptdeploy GPO using Scheduled task deployment in c:\Windows\Temp, please update the GPO to point to c:\Windows\SystemTemp, cf. Wapt GPO documentation

Detailed

[IMP] wads: wapttftpserver refactor and fixes. Improve logging and command line parsing.
[IMP] wads: in djoin, fix auto search ldap group when adding manually computer groups
[SEC] waptagent: in tis-waptupgrade wapt package: use %WAPT_HOME%\private\tmp` a wapt private temp dir to store waptagent.exe Cleanup old waptdeploy location (c:\windows\temp) and new one (%WAPT_HOME%\private\tmp\waptdeploy-*)
[SEC] waptagent: waptdeploy: embed custom manifest to limit dll search path to system32 folder to avoid potential dll highjacking
[FIX] waptagent: fix waptagentclient PROXY in pure HTTP mode. In pure HTTP mode, Squid seem to require full absolute-URI in http header and not support origin-URI form anymore (cf. https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.2).
[IMP] waptserver: better handling of squid HTTP caching. Add cache_friendly_repo parameter to tweak http headers for /wapt and /waptwua endpoints to promote caching by downstream proxies. This shouldn’t be used except in very specific scenario as it disable security features of wapt: ssl client auth is disabled on repos /wapt and /waptwua if “cache_friendly_repo’ option is True.
[UPD] waptcore: fix disk space issues on recent Linux with ramdisk tmpfs. Change wapt_temp_dir now default to $WAPT_HOME/private/tmp This will fix package unzip disk space issue. One should be careful to have /opt/ on a large enough partition though.
[FIX] waptagent: on macOS improve retrieve local hostname for macOS if when the computer is not in a Active Directory domain
[FIX] waptagent: get_battery_infos() function listing all available batteries with -1 param value
[NEW] setuphelpers: add installed_softwares_user(), uninstall_key_exists(), Windows11v25H2 os version, iswinarm() function
[IMP] waptcore: wapt-get: print output filename when shellopen or html output
[FIX] setuphelpers: fix regression get_host_architecture and isARM64 for macOS. For legacy reasons, macosx is always considered as arm even if it is actually arm64

WAPT-2.6.1.17654 (2026-01-19)¶

hash: db56dcce

This is mainly a small bugfix and COTS upgrade release. The main hightlight are:

added support for WaptAgent on openSUSE
fix some highdpi gui glitches
on wads add the option to use bootmgfw_EX instead of bootmgfw to support new Microsoft UEFI 2023 secure boot certificates (old 2011 certificates are bound to expire in June 2026)

Detailed changelog:

[FIX] waptserver: on login, fix regression where one could get a Response not defined message
[IMP] waptserver: backport /api/v3/get_temp_client_cert from 2.7 for transitional compatibility of new 2.7 console with old 2.6.1 servers
[SEC] waptserver: when generating host and login temp certificate, use auth_date for not_valid_before certificate value.
[IMP] waptserver: on Windows, in winsetup: create a CA and a child cert for nginx https cert as on Linux
[IMP] waptserver: on redhat like distrib, during upgrade avoid error message on missing pyc files
[FIX] waptserver: on uwsgi, remove logto option in uwsgi configuration during postconf (not supported anymore)
[SEC] waptserver: fix nginx config to harden against potential Off-By-One Slash attack
[FIX] waptserver: auth renewal in case ‘ssl’ login auth method is enabled but user has no cert in users table (not common use case)
[FIX] waptserver: uwsgi issue: fix bind to Wapt lib OpenSSL 3 instead of system library. Add LD_PRELOAD in systemd as a safety measure
[FIX] waptserver: for uwsgi, fix Kerberos auth issue when having ServiceTicket with too large PAC size (too many groups). Add buffer-size=65535 for authentication / 502 errors with big Negotiate headers (“invalid request block size” message). Fix wapt-get register message when not successful.
[FIX] waptserver: try to fix issue where an existing registered host is reset on server
[FIX] waptagent: fix GetBatteryInfos battery idx argument not handled
[FIX] waptagent: in waptexit: mainform not visible if no upgrades pending but a task is running (like wua scan)
[FIX] waptagent: during waptsetup install delete cryptography-44 lib on install if win>=10
[FIX] waptagent: fix install on OpenSuse. There is still work to do in setuphelpers to better intergrate
[FIX] waptagent: fix memory leak in wmi_query/wmi_get ISWbemProperty.Name : accessing this property using early com binding leaks memory …
[FIX] waptagent: use waptlicences.wmi_xxx instead of python wmi in setuphelpers wmi query to avoid gen_py errors
[FIX] waptagent: on Win11 arm64, fix installed software detection. There could be issues detecting softwares installed through Prism
[FIX] waptconsole : when running waptagent, apply embedded configuration even if waptagent is already at right software version and the binary install wouldn’t be updated itself
[IMP] waptconsole: in certificate package wizard: during audit, if certificate is not found, reinstall it.
[FIX] waptconsole: high dpi layout restore: do it in formshow instead of formcreate to fix some highdpi layout issue
[FIX] waptconsole: fix trustcertificate form for highdpi layout
[UPD] waptconsole: removing grid settings for gridhosts if containing old value waptwua_status.status
[IMP] waptconsole: in private repo search : include package_uuid in searched text
[UPD] waptconsole: host grid: show last connected by default
[IMP] waptconsole hosts grid: allow to use mustache templates for custom column property to format data For example: mus:{{HumanBytes host_metrics/local_drives/C/FreeSpace}}
[FIX] waptwua: removed most ‘FAST’ DocVariant to ensure we don’t have side effects when DocVariantdata is temporary
[FIX] waptwua : waptdb : add a callback hook for waptdb.setparam to delegate writing to a thread locking the db for waptwua operations inside a audit or install package code. Open DB in readonly in waptwua
[UPD] waptwua: TWaptWUA.GetWaptWUARepoUrl: append wua if repourl ends with wapt or /wapt
[FIX] waptself: highdpi fix for tasks grid. Fix grid header height with highdpi
[IMP] waptself: keep last focused package frame into view when loading page after install/remove/upgrade
[FIX] waptself: macosx self service: fix local user groups lookup for self-service
[FIX] waptself: backport icons loading and search small improvements
[FIX] waptself: upgrade button remains when package install finished
[IMP] wads: replace boot efi by bootmgfw_EX option (Enabled by default) to support new Microsoft 2023 UEFI certificate
[FIX] waptcore: wapt-get waptwget: disable Gzip compression in http client for streamed wget over TStreamredirect since TStreamredirect does not handle compression. Disabled for waptwget_try HEAD too
[IMP] waptcore: update COTS : SQLite, Python pip libs, mORMot 2.4
[IMP] waptcore: wapt-get: fix register ERROR KeyError: 'success'
[FIX] waptcore: strip ending spaces from values when converting control file to dict. In agent control signature check, ending spaces are stripped. Fix error when having space at end of package description
[IMP] waptcore: licencing: add support for licences replacement in case a licence is splitted
[IMP] waptcore: pin the https Server CA’s certificate Issuer instead of server certificate itself. Add waptlicences.get_server_ca helper.
[IMP] setuphelpers: add get_wmi(wmi_class:str, property_names:List[str]=None, query: str=None, namespace: str="rootCIMV2") -> List[Dict] helper in waptlicences
[FIX] setuphelpers: arm64 missing in the isARM64 function
[FIX] setuphelpers: on unix system, in get_domain_info, be sure REALM is written in uppercase, be sure domain is lowercase for pyldap. Should fix issue on linux (ubuntu) if dns_lookup_kdc and dns_lookup_realm are not set in /etc/krb5.conf, but only default_realm

WAPT-2.6.1.17576 (2025-11-14)¶

hash: 407e255f

This is mainly a small bugfix and COTS upgrade release.

Detailed changelog:

[IMP] waptcore: update COTS : SQLite, Python pip libs
[IMP] waptserver: on Windows wapt server, fix migrade DB to pg15
[FIX] waptconsole: improve high dpi layout (regression)
[IMP] waptagent: run waptupgrade_task even if not on AC if battery level is sufficient. Run auto upgrade before forced install and audits to have latest scripts
[FIX] waptagent: fix audit and forced install schedule:
- set next_audit_on right after install to be sure audit is initiated
- run pending forced_install before audit to be sure we don’t run outdated scripts
- send audit data rows in packages_audit_inventory() where last_audit_on is null but next_audit_on is > last data date
[FIX] waptagent: better handling of dynamic json config. This may result in different behavior in case of non :
- fix reset_host_organizational_unit_dn when dynamic json config
- fix install error message when raise_exception_if_errors_or_unavailable is True
- for wapt config attributes ‘host_profiles’, ‘maturities’, ‘custom_tags’, ‘packages_whitelist’, packages_blacklist, ‘repositories’, ‘locales’
- resulting attribute value is the merging of initial value in wapt-get.ini and all overriden values found in json config file in $WAPT_HOME/conf.d/
- removed strange stripped windows custom tags (w, w10, win, win10, etc.). Keep only ‘windows’

WAPT-2.6.1.17567 (2025-10-30)¶

hash : d56a3600

This is mainly a bugfix and COTS upgrade release.

Note

There has been a fix for a race condition in waptdeploy.exe to avoid starting two wapt upgrade at the same time (for example during WADS deployment where there is also a GPO configured on the OU where the computer is joined). You are encouraged to update your GPO configuration with the new waptdeploy.exe binary file provided in this release.

Detailed changelog :

[UPD] waptcore: update python libpq to version 15.14
[IMP] waptcore: use dynamic module sqlite3.dll instead of static library for the binaries wapt-get, waptconsole, etc. to ensure consistent versioning
[FIX] waptcore: ignore packaging (hash after dash ‘-’) when comparing minimum waptsetup version with downloaded one. This could trigger spurious upgrade notification on console
[FIX] waptcore: false downloads / install errors on upgrade when same package appears several times in dependencies
[IMP] waptcore: wapt-get install: returns error code 1 if some packages are unavalable or have error on install
[UPD] waptcore: WAPT.install will now raise an exception in packages if there are install errors or missing dependencies One can set raise_exception_if_errors_or_unavailable=False to keep the old behavior
[FIX] waptcore: waptmustache pad and PadLeft: potential Access violation if bad arguments LocalDateTime LocalDate LocalTime: return null if null date.
[SEC] waptcore: switch to python 3.10.19
[FIX] waptcore: update mormot2 for fix regression on runCommand code -1 on success instead of 0
[SEC] waptcore: update all python modules to latest versions
- removed pyopenssl, pyad, pyasn1, future
[UPD] waptcore: build binaires with lazarus 4
- update bgrabitmap, bgracontrols, bgracontrolsfx to match github master sources
- update virtualtreesextra
- upgrade innosetup to 6.5.4
[FIX] waptcore: On linux, use wapt python launcher (/opt/wapt/wapt-get.bin with embedded waptlicences and pyldap modules) in scripts Instead of raw python launcher /opt/wapt/bin/python to avoid segfaults when there mismatchs between the python dylib loaded in .so and the python dylib loaded by python launcher
[IMP] waptcore: additional infos in system_infos_summary
[FIX] waptcore: waptlicences.waptwget try_local_peercache 403 status code
[FIX] waptcore: update mormot2 for fix on inverted timeout logic for mget. Timeout was 1000x to high
[FIX] waptcore: waptlicences evaluate: fix AV error if no context is provided in python script.
[IMP] waptcore: add evaluate helper in WaptMustache to evaluate expressions (for example {{ evaluate ,"a+1",.,"error message" }})
[IMP] waptcore: add Wapt.read_ini_setting() to ease reading initial configuration from wapt-get.ini
[IMP] waptcore: add Wapt.write_ini_setting() function to help setting an initial setting in wapt config file, taking in account default_xxx sections
[FIX] waptagent: waptself: bad error trapping when authentication failed in SYSTEM auth type
[FIX] waptagent: service tasks list issue when only non ready planned tasks in queue
- scheduled wapt tasks were not run until all planned tasks are over
- high cpu usage when only non ready planned tasks in queue
- fix timeout comparison in ms for long polling
[FIX] waptagent: try to use proper fqdn result for macOS and Linux. Don’t rely on reverse dns
[FIX] waptagent: regression bad windows version check, restore wapt-get.exe.manifest
[IMP] waptagent: wapt-get: add documentation for wget , server-wget and list-hosts command line actions
[SEC] waptagent: replace dmidecode usage with mORMot calls and remove dmidecode binary
[NEW] waptagent: add wapt-get trigger-action to trigger websocket signed actions to a selection of hosts
[IMP] waptagent: waptdeploy: check for waptagent.exe, waptsetup.exe, waptagent.tmp, waptsetup.tmp processes to terminate or kill them after --wait minutes timeout
[NEW] waptcore: wapt-get : add commandline options priority, start_not_before start_not_after always_append always_replace for all enqueued tasks.
- add only_priorities for download_upgrade task
- --always_append enqueue a new task even if a similar task is already in pending queue
- --always_replace enqueues a new task and removes similar tasks in pending queue
- format of start_not_before and start_not_after are local time ISO8601 datetime like 2025-10-16T08:59:00
- example wapt-get -S update --start_not_before="2025-10-16T08:13:00" --always_append --waitevents=0 --json
[FIX] waptagent: fix ordering of tasks in scheduler when start_not_before and start_not_after are used takes in account priority, force, notify_user, notify_server, start_not_before, start_not_after, always_replace, always_append url args when enqueuing tasks.
[NEW] waptagent: service local request: add replace_same_actions and append_always arguments for add_task
- available in local service url too as ?append_always=1 and ?append_always=1
- add start_not_before and start_not_after arg for service url
[FIX] waptagent: fix waptdeploy ProcessExists check to avoid starting a second waptdeploy if one is already running. Was checking full process path. This could create race condition when having both GPO and WADS starting waptdeploy at the same time Wait for ‘waptdeploy.exe’,’waptagent.exe’,’waptsetup.exe’,’waptagent.tmp’,’waptsetup.tmp’ up to 10 minutes (by default) to terminate before trying to do anything If still running, kill them then download new waptagent. Wait for termination of tasks up to 10 minutes.
[FIX] waptagent: propagate properly install_by and uninstall_by in public package status db to have proper history of who install what package and when in public local db.
[FIX] waptagent: during install on win7 use python cryptography 44 for windows version < 6.2 (rust module is not compiled to be compatible with win7 unfortunatly, this may be fixed later :( )
[UPD] waptagent: ensure waptmessage can be launched outside wapt base directory. Added --waptbasedir parameter if needed.
[IMP] waptagent: Linux/macos : switch to tokenGroups attribute for group member search
[IMP] waptagent: set FPU exception mask for python and sciter (avoid Floating point exception when importing pandas for example)
[FIX] waptagent: watpsetup: stop and start wapthttpserver if service available
[FIX] waptagent: waptselfservice: tisgrid and sogrid header height highdpi scaling
[FIX] waptserver: linux server postconf: csv list_subnet_skip_login_wads
[SEC] waptserver: reporting: require edit_report acl to be able to use api/v3/reporting_exec_raw endpoint
[IMP] waptserver: reporting: limit the maximum duration of statements to 30s by default. Added reporting_statement_timeout waptserver parameter to override this.
[FIX] waptserver: removed jsquery optional extension create
[FIX] waptserver: in postconf fix msktutil keytab create
[IMP] waptserver: added support Redhat 10
[IMP] waptserver : when calling server local users delete, delete both in db and in passwd in htpasswd too
[IMP] waptserver: model Packages.update_from_control: don’t update is_available if not changed to speed up store
[FIX] waptconsole: activate manifest as resources in binaries, make sure highdpi scaling is enabled
[IMP] waptconsole: developer page popup: add a menu item to import selected directory
[FIX] waptconsole: removed hour glass mouse cursor when triggering remote actions
[IMP] waptconsole: tasks templates: add created_by info
[FIX] waptconsole: during ini writing: don’t check IsEnterprise. Don’t try to get licencing if not yet logged in to avoid unexpected login popup windows
[FIX] waptconsole: Don’t allow to edit username on an existing row. Need to duplicate to change the name
[IMP] waptconsole: rule edition for repo_url
[FIX] waptconsole: fix unproper selection of newest packages in import from internet when having multiple constrains (for example firefox-esr for win7 + win10)
[FIX] waptconsole: reporting copy/paste and duplicate report definition
[IMP] waptconsole: use POST http request for audit data deletion to allow deleting large count of records
[FIX] waptconsole: fix serverconnection OnAuthorize unexpected clearing
- don’t try to reauthenticate on console close to avoid auth loop.
- recreate client cert key and cert if we don’t have the temp key password anymore in session.

WAPT-2.6.1.17472 (2025-09-24)¶

hash : 21f6d4b3

This is mainly a third party module update version (Python 3.10, pip modules, OpenSSL, etc.) and a few bugfixes since last version.

Main highlights:

Switch to Python 3.10, and all python modules upgraded to latest versions
Small security improvments on wapt based on CSPN evaluation results
PyScripter 3.6.4 does not handle python 3.10, no either use VSCode or use unofficial TranquilIT build 3.7.0 available on Wapt store tis-pyscripter3

Detailed changelog :

[FIX] waptconsole: fix filter on multiple OU
[FIX] waptconsole: properly fill AD groups combo on drop down
[FIX] waptconsole: restore display on show. Try to avoid flickering on Linux when computing components layout
[IMP] waptconsole: some layout adjustment for Linux
[IMP] waptconsole: when importing packages from Wapt Store, prefer to import amd64 than x86 by default
[IMP] waptconsole: show main connected server in caption
[BUG] waptserver: fix postconf if /etc/krb5.conf is missing (ie. when krb5-user is not installed for example)
[FIX] waptserver: fix SocketIO disconnect event issue ("Socket IO : An error has occurred for sid 5UWCSAJMcFuch_tWAADJ, uuid:None : TypeError('on_waptclient_disconnect() takes 0 positional arguments but 1 was given'))
[SEC] waptserver: API logs: don’t log post data for sensitive endpoints login, login_kerberos, change_password, set_account_otp, get_temp_client_cert, set_user_password, invalidate_user_password
[SEC] waptserver: in postconf CSPN TOE mode, when building certificate for agent CA PKI, take in account the client_certificate_lifetime setting. By default it is 10 years, but must be 3y in CSPN mode.
[FIX] waptserver: during postconf increase width of msgbox for keytab
[FIX] waptserver: fix /opt/wapt/conf/security.sqlite db upgrade/downgrade in init_db
[SEC] waptagent: on Windows be sure to create %WAPT_HOME%log directory in setup before restricting inherited ACLs on it
[FIX] waptagent : fix peercache interface_name filtering with a IP subnet mask like 192.168.1.0/24
[FIX] waptagent: during install, stop and start wapthttpserver if service is available (fix failed upgrade on windows based secondary repositories)
[FIX] waptagent: replace opendocument with openURL when document is an URL for proper handling on Linux
[FIX] waptagent: hide wapt-get create-keycert password while typing
[FIX] waptagent: use default translation locale (avoid French translations on English computers)
[IMP] waptagent: start agent with soWinJobCloseChildren option to allow ServiceUI.exe call during package install.
[FIX] waptagent: on Linux inventory fix regression: grp.getgrgid() requires int argument
[NEW] waptagent: wapthttpserver: add lib_folder_path parameter
[FIX] waptsetup: cleanup leftover German translation files which may create languages mixup in GUI (German translation will be re-introduced later)
[IMP] waptsetup: don’t change current configuration by default, on new setup configuration will be done in waptconsole
[UPD] waptwua: send status PENDING_REBOOT when update is uninstalled
[FIX] waptwua: fix GetKbDismName failing when OS not installed in French locale
[FIX] wads: fix DNS resolver issues where getwads.exe would resolve while ping would resolve
[FIX] wads: in djoin check servicePrincipalName in case-insensitive way to avoid trying to add an already existing SPN
[NEW] waptcore: on Windows add vcredist-x86 along vcredist-x64 for waptserver windows required for new greenlet version
[FIX] waptcore: when evaluating repo rules, use waptlicences.get_ip_addresses to avoid dns lookup timeout if repo is not available.
[UPD] waptcore: update all Python module to latest version
[UPD] waptcore: removed pefile Python module, replaced by a waptlicences.get_pefile_properties helper
[IMP] waptcore: edit with PyScripter: don’t specify Python version --python310 on command line
[FIX] waptcore: in waptwget fix regression: take in account limit_bandwith (Mb/s)

WAPT-2.6.0.17392 (2025-07-28)¶

hash: 0ac7bf48

This is a bugfixes releases.

Detailed changelog:

[FIX] potential AV in coreTSystemUse/TSynMonitor methods
[FIX] waptself access violation when there is only one category in published packages.
[IMP] waptlicences helpers add encrypt_aes_cbc and decrypt_aes_cbc
[FIX] wapt core: invalidate cached repo_url if rules or connected ips have changed.
[FIX] missing get_otp_code_from_password import in wapt-get.py
[IMP] wapt core: invalidate cached repo rules result if connected ips has changed, when for example vpn comes up or down
[FIX] for DNS cache (OPT inconsistent record layout)
[NEW] templates: add install-force for vscode_launch
[FIX] wapt: launch a detached process when editing a package on linux
[FIX] waptconsole: on package edit don’t filter available packages when managing dependencies and conflicts
[FIX] waptconsole: edit package / speed up editing package with huge number of files
[FIX] setuphelpers_macos: protect variable {0}
[FIX] djoin: computer creation with msad, if ‘.’ in DN
[UPD] LOGO 2025 TIS / WAPT
[UPD] waptconsole: acls / allow editing and search on user acls description
[UPD] waptserver: login, return a token only if get_token arg is true
[SEC] fix potential ReDDOS
[FIX] higher timeout for backup/restore cmd in waptconsolidate
[FIX] wapt: MakePackageTemplate with proper encoding
[FIX] waptcommon: “-c” configfilename argument when there is a dot in configname
[FIX] waptconsole: add missing update_packages_on_connect in dynamic config advanced dialog
[IMP] wapt-get server-request : default method=’POST’ if posted data is not empty
[FIX] waptutils: GetCmdParamsEx and GetCmdParams: remove double quotes around argument (on linux, they are not removed by shell)
[UPD] waptserver: be tolerant if domain mismatch in temp login CSR, to allow smoother migration to next wapt version when we will enforce user with domain

WAPT-2.6.0.17349 (2025-07-07)¶

hash: 3c37d1b8

This is a components upgrade releases.

Components upgrade:

7zip dll 24.9 -> 25.00
openssl 3.5.0 -> 3.5.1
krb5 1.21.2 -> 1.21.3
libp11 0.4.13 -> 0.4.16
libpostgresql 14.17 -> 14.18
libffi 3.4.7 -> 3.5.1
readline 8.2.13 -> 8.3
gdbm 1.24 -> 1.25

WAPT-2.6.0.17346 (2025-07-02)¶

hash: 889b7d0a97

This is a bugfixes releases.

Detailed changelog:

[FIX] waptserver model schema upgrade regression (missing schema argument in table_exists)
[FIX] waptwua cab download tasks on server: increase wget timeout to 10 minutes instead of 1 minutes, for slow proxies

WAPT-2.6.0.17343 (2025-06-30)¶

hash: aa76a06c55

This is a bugfixes releases.

Detailed changelog:

[IMP] use_ad_groups , Read HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup PolicyGroupMembership for get computer group member (helps reduce the load on active directories)
[FIX] Fixed a regression in selfservice under Linux in filetoken mode , waptservice: ‘root’ user is always considered as waptselfservice member
[FIX] Handle AMD64 and ARM64 for reg_openkey_noredir on windows (for windows ARM64)
[IMP] Improve kerberos configuration in postconf
[IMP] waptsetup: don’t propose to open documentation to avoid potential detection as Adware false positive in virustotal.
[IMP] wapt-get: removed old possibility to stop/start waptservice by non admin user with the allow_user_service_restart parameter. (false positive in virustotal)
[IMP] adds fedora to type_rhel
[FIX] increase WorkingMem for TZipRead operations, for big zipfile raising “corrupted Central Directory or too small WorkMem=1 MB for…”
[IMP] wapconsole configuration: hide client cert and key by default.

WAPT-2.6.0.17293 (2025-06-04)¶

hash: c9f777b0

This is a bugfixes releases.

Components upgrade:

python3 3.9.22 -> 3.9.23

Detailed changelog:

[FIX] waptconsole: for ldap Remove RootDN usage, use DefaultDN instead
[FIX] waptserver: waptwua, Increase the timeout time from 10s to 60s for downloading Windows Updates from the Internet

WAPT-2.6.0.17289 (2025-06-02)¶

hash: 67d38df2

This is a bugfixes releases.

Components upgrade:

uwsgi 2.0.28 -> 2.0.29
flask 3.1.0 -> 3.1.1
certifi 2024.12.14 -> 2025.4.26
h11 0.14.0 -> 0.16.0
jinja2 3.1.4 -> 3.1.6
setuptools -> 80.8.0

Detailed changelog:

[IMP] waptself: improve categories combbox
- improve hardcoded categories translations…
[FIX] update mormot2 for http proxy on http without TLS with waptwget
- use GET instead of CONNECT on proxy when rwa http without TLS.
- removed workaround in WaptPackage.download_packages
[FIX] waptagent: use http_proxy for packages download when use proxy is checked.
[FIX] waptagent: secondary repo rules: don’t use global proxy config for repo packages download if rule’s “has_proxy” property is False
[FIX] waptconsole: show totp token menu entry only for enterprise
[IMP] use_ad_group now supports nested groups (set ad_groups_use_nested_group = False in wapt-get.ini to disable).
[IMP] improve waptconsole login layout for linux
[REF] removed dns python from posix agent
- required by server’s eventlet only
[IMP] wapt-get : add a “list-hosts” cli action
- wapt-get list-hosts [search string] –query_id=<int> –reachable –order_by=[-]<column> –limit=<int> –need_upgrade –has_errors –uuid=<csv of uuids>
- –uuid and search are mutually exclusive
[IMP] peercache audit template: show history in a table
[IMP] wapt-get templates: add <wapt>/custom_templates to the list of searched directories for templates
- so that we can override templates for all users without conflicts with new version of wapt
- add <wapt>/bin directory to waptsetup.exe for search path and wapt-get and waptconsole links
- add wapt-logo.html default partials with base54 encoded wapt logo png image
[REF] wapt-get make-template: use mustache {{ var }} templates instead of python style %(var)s formatted templates
- use GetTemplateFilenames function for all templates search
[IMP] waptconsole html templates :
- add “updatedata:” onclick and href handler which allow to update local context json data for the template and refresh display.
- example : <a href=”updatedata:{show_details:true}” >See more</a>
- <input type=”checkbox” name=”show_details” id=”1” onclick=”updatedata:” {{ iif show_details,”checked”,”” }}>
- in the onclick, context data is also updated with “name”=checked state/value for checkbox and radio buttons
[IMP] wapt-get increase –waitevents default value to 7200s
- this is more a safety timeout in case waptservice tasks queue is dead
- reste lastMessageTime in OnChecktasksThreadNotify too
[FIX] wapt-get: regression: variable WaitEventsSecs was not set anymore := 60
- wapt-get -S actions were not waiting for termination
[IMP] Improve wads ubuntu template
[FIX] waptconsole compare capabilities with TPackageRequest.InitFromHostString os versions: don’t set a default min/max os target_os conditions coming from host tags
- tags have no version.
[FIX] waptconsole packages versions compare: when comparing 2 versions with different count of members, assume missing members on either side is ‘0’
- reintroduced wrongly deleted wazuh templates

WAPT-2.6.0.17226 (2025-04-24)¶

hash: 71f4e2e0

This is a bugfixes and small improvements release. The main highlights are fixes for the two regressions on WADS deployement in the last release.

Note : for WADS support, it is required to update tis-wads-requirement-minimal-x64 package to rebuild WinPE image.

Components upgrade:

OpenSSL 3.4.1 -> 3.5.0
Python 3.9.21 -> 3.9.22

Detailed changelog:

[IMP] wads : in waptconsole, add explicit message when building WinPE with missing packages or too old package wads-requirement-minimal
[FIX] wads: wapttftpserver: fix regression on Linux that could prevent download
[FIX] wads: properly add SecureStartup and EnhancedStorage packages during WinPE build. Note: the buildup of WinPE now needs admin right elevation.
[IMP] wads: Also add WMI packages to WinPE
[FIX] waptwua: fix automatic download tasks fail if download_urls field in db is None. This issue can only happen after a cleanup during remediation of spurious streaming urls.
[FIX] waptconsole: loading proper template for certificate_overview on grids for correct i18n support
[IMP] waptconsole delete packages: focus previous sibling of focused row
[FIX] waptconsole: fix profile group need to be lower case
[NEW] waptconsole: wapt templates: add support for partials in mustache templates !
- {{> style.css }} to incluse default style sheet
- partials are located in a “partials” subdirectory of <wapt>/templates . Only css, html, txt png, jpg files are taken in account.
- partials can be overriden in user appdata application’s template dir.
[FIX] waptconsole: allow acls package filtering of unit and profile packages
[NEW] waptconsole: add html audit data templates examples in <pf86>wapttemplates for many tis-audit-xxxx packages available on TIS public Repository
[IMP] waptagent: wapt-get edit <package>: requires server auth for client-side cert auth
[IMP] waptagent: wapt-get server-request <action> –method=”POST” –data=”[‘string1’, ‘string2’]” : transform into [“string1”, “string2”]
- workaround for poor windows cmd line parsing
- JsonQuoteToDoubleQuotes
[FIX] waptagent: in wapthttpserver, fix small files cache issue that could prevent downloading
[NEW] waptagent: wapt-get server-wget <wapt-server-relative-url> with optional param –filename=<path-to-local-file> or -O <path-to-local-file>
[NEW] waptagent: wapt-get wget <url> with optional arguments –http_proxy=<proxy> –verify_cert=[0/1/path]
[NEW] waptagent: wapt-get option –hash=<hash hexa> : if not provide explicitly, try to get hash from url resource filename (https://host/resource_<hash>.ext). md5, sha1 or sh256 type of hash is identified with the length of hash hexa string)
[IMP] waptagent: wapt-get server requests: set wapt-server-user to current user if param is empty and –not-interactive option. Allow kerberos authenticated requests without user input
[FIX] waptagent: fix unable to import p12 file on win7 if using new encryption mechanism Wapt-get create-keycert p12 : use legacy encryption for windows 7 import : NID_pbe_WithSHA1And3_Key_TripleDES_CBC / EVP_sha1
[FIX] waptagent: service events: max_count arg was renamed to max_events_count
[IMP] waptagent: wapt-get: don’t start polling thread if waitevents timeout is <=0
[IMP] waptagent: wapt-get -u -S install <package> : handle –update or -u option like python code -> insert a update task before other action.
[FIX] waptcore: waptaudit_task_period inconsistency between GUI and actual agent code: default is 2h
[IMP] waptcore: Switch to openssl 3.5.0 and python 3.9.22
[FIX] waptcore: fix wgets when http server does not return a content-type header
[FIX] waptcore: wapt-get edit <relative dir> : add/update psproj and vscode projects.
[IMP] waptcore: improve HTTP servers log - both async and threaded servers
[NEW] waptcore: wapt-get waptconsole templates: add helpers Items and IIf
- {{ items dict }} -> return [ {“key”:key1, “value”:value1}, {“key”:key2, “value”:value2}, … ]
- {{ iff value_bool,”value_if_true”,”value_if_false” }} -> return value (non empty list, non empty dict, non empty string are evaluated as True)
- add mustache helpers: UnCamelCase and UnSnakecase.
[FIX] setuphelpers_windows: fix UnpicklingError when importing win32com.client

WAPT-2.6.0.17177 (2025-04-09)¶

hash: eb7e78b9

This is a bugfixes releases. The main highlights are fixes and improvement on WaptWUA and Peercache. Microsoft made many changes on Windows Update after the Windows 11 24h2 release last September. Many of those changes where not properly documented or even properly handled (October and November 2024 CU where breaking havoc).

Peercache support has also been improved both in efficiency (a computer has a higher chance of doing a peercache download than a download from the server/repo), and in logging and reporting to check that everything when as it should be.

Components updates:

upgraded openssl 3.1.8 -> 3.4.1
upgraded python libpq 14.12 -> 14.17
upgraded python libffi 3.4.6 -> 3.4.7
upgraded python readline 8.2 -> 8.2.13
upgraded python gdbm 1.23 -> gdbm-1.24
removed python babel
removed python pytz

Note

Caveat / Issues in this release that are fixed in nightly and will be fixed in next release:

there is a regression in wapttftpserver.bin on Linux. If you use WADS with tftp, you have to downgrade wapttftpserver.bin binary after server upgrade with the following procedure:

wget https://wapt.tranquil.it/wapt/releases/wapt-2.6.0.16937-7ba7ea7a/bin/linux-x64/wapttftpserver
mv wapttftpserver  /opt/wapt/wapttftpserver.bin
chmod a+x /opt/wapt/wapttftpserver.bin
systemctl restart wapttftpserver

if you have secure boot enabled, the WADS template for Win11 might fail during installation. You have to add TMP check bypass in the unattend.xml template The TMP will be enabled after install.

<component name="Microsoft-Windows-Setup" processorArchitecture="{{architecture}}" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <RunSynchronous>
    <RunSynchronousCommand wcm:action="add">
      <Order>1</Order>
      <Path>reg add HKLM\System\Setup\LabConfig /v BypassTPMCheck /t reg_dword /d 0x00000001 /f</Path>
    </RunSynchronousCommand>
  </RunSynchronous>
</component>

Detailed changelog:

[FIX] waptserver: fix error 500 when trying to delete unassigned KB when donwload_urls is None
[IMP] waptserver: waptserverconnection: allow to have a diffrent set of client ssl key in same application. * in waptconsole. If we use pywaptlicences.waptserver_login with same user as console (in update_package), we don’t have the temp key password, so we have to create a different set.
[FIX] waptserver: allow unrestricted access to robots.txt
[FIX] waptserver: during upgrade db cleanup for download_urls and download tasks (due to wrong “filestreaming” url sent back by Windows Update agent)
[FIX] waptserver: use UTC timestamp for socketio connect/disconnect timestamps
[IMP] waptagent: wapt-get search: add install_status in output templates.
[FIX] waptagent: fix wapt-get regression on useless local password input for waptservice action
[FIX] waptagent: hardened the repo_url calculation in case of rules.json corruption. Fallback on raw main repo_url
[IMP] waptagent: in Windows service handler mORMot Angelize, disable CommandFile parameter to avoid unecessary C:WindowsSysWOW64waptserviceservicescmd.exe periodic file access
[SEC] waptagent fix the agent websocket still able to connect to server if verify_cert is set to a bad value
[IMP] waptagent: wapt-get: allow cmd commandline set-data json with hack on ‘ -> “ for tests
[IMP] waptagent: add wapt-get reset-config-from-base64 and set-config-from-base64
[FIX] waptagent: fix wapt-get set-config-from-url and set-config-from-file reset all when no hash is provided on command line after the url
[IMP] waptagent: wapt-get ping : add --waptservice_timeout , --trycount (default 1), --retrydelay (seconds) for ping
[FIX] waptagent: wapt-get sign-package command missing * allow to check a signed package directory
[FIX] waptagent: UFT-8 fixes in wapt-get and wapttray (show tasks)
[IMP] waptagent: update waptservice French translations
[IMP] waptagent: waptdeploy: fallback to https://<srvwapt>/wapt/waptagent.exe for wapt/waptagent.exe if not {{ip}} and the GetLocalIpAddress returns an empty address.
[FIX] waptagent: macos: handle user_is_member_of for macosx
[FIX] waptagent: macos: missing groups from function setuphelpers.get_groups() on mac
[FIX] waptagent: waptdeploy: compare relative paths case insensitive
[IMP] waptagent: better naming for packages to upgrade in WaptUpgrade task launch
[FIX] waptagent: fix packages authroization rules is None in discovery mode, fix error 500
[IMP] waptagent: improve wapt-get local service cred input.
- Don’t use WAPTSERVICE_TOKEN environment variable if WAPTSERVICE_USER does not match –waptservice-user option.
- When local auth method is filetoken, and we want to login with a different user as current one, we need to ask for a password.
- --waptservice-password=- (minus sign) force wapt-get to ask interactively for password.
- Allow local-request to continue even if no auth (to test auth…)
[IMP] waptagent: wapt-get server-request --data rework. Hack to replace single quote to double to workaround poor command line parsing We try to automatically detect json object like {‘key’:’value’} or [{‘key’…
[FIX] waptagent; local_login: add waptselfservice group for user == computer_name$ (windows) or user uid==0 (linux)
[FIX] waptagent: don’t use client.root_dn() for setuphelpers_unix
[FIX] waptagent: wapt-get: don’t ask interactively for local service password
[FIX] waptagent: in wapt-get reset-config, don’t remove json config file in conf.d. Removing them would mean that installed config packages have no matching install json anymore. There is no explicit way to distinguish them from json from config packages, so manually added dynamic config scenario is not supported. Reset means only reset initial wapt-get.ini config
[IMP] waptagent: wapt-get : add download-upgrade action in service mode
[IMP] waptagent: force reinstall certificates from json dynamic configurations when loading Wapt configuration from ini file. Fix potential bug in InstallJsonCerticates if ConfigName was not Default Add install_json_config_certificates waptlicences helper
[FIX] waptagent: add wapt-get get-public-param command line switch
[IMP] waptagent: wapt-get supports new parameter --waitevents=<max second to wait without event feedback> (default to 60 seconds). If <=0, don’t wait for tasks at all.
[FIX] waptagent: fix corner case install_json_config_file where there are no config name
[FIX] waptagent kerberos login for macos: Switch to /opt/wapt/krb5.conf and use KRB5_CONFIG env for macos
[IMP] waptagent: wapt-get ping : add –waptservice_timeout , –trycount (default 1), –retrydelay (seconds) for ping
[IMP] waptconsole: when editing Org Unit package from treeview, if thera more than one package (ie diffent os or maturity), show them in Packages private Repo, else just edit the latest matching unit package
[GUI] waptconsole grids hosts for package and host for winupdates: reduced default visible columns count, increase header height. Double click on host in HostsForPackage focused filter on host in inventory
[FIX] waptconsole edit Host package: package with incompatible maturity are listed. Add a warning if current host package is not compatible with known target host capabilities.
[IMP] waptconsole: wapt templates: add CSV helper * {{csv AList,”;”,”col1”,”col2” }}
[IMP] waptconsole: add template for host_audit_host_metrics_peercache
[FIX] waptconsole: editing package from importing form when no matching cert found
[FIX] waptconsole: improve restore of column layout
[FIX] waptconsole: fix software inventory tab cleanup button
[FIX] waptconsole: in repo rule grid, double check direct editing of sequence column due to potential type mismatch. Restrict column which can be edited directly into grid to ‘sequence’,’name’,’repo_url’
[IMP] waptconsole: edit host package allowing to save GridPackages properties
[UPD] waptconsole wua column image: no image if no wua status
[FIX] waptconsole packages only available in maturities other than PROD are not listed when editing package dependencies
[FIX] waptconsole: cleanup of download_urls in Windows Update tab
[FIX] waptconsole: keep SPN option during waptsetup build
[IMP] waptconsole: wapt packages search error message
[FIX] waptconsole: reporting. fix canceling the edit of a new query
[FIX] waptconsole: fix color theme in graph dependencies color for dark mode
[FIX] waptconsole: limit hostname to 15 chars when deploying linux using WADS and joining to an AD domain
[FIX] waptconsole: show MS Help on host’s windows updates
[FIX] waptconsole: reporting: fix saving reporting query failure in some case, like renaming
[FIX] waptconsole: dark mode in secondary repos errors
[FIX] waptconsole: pinning certificate warning
[FIX] waptconsole: update sogrid for Fix range check error in debug mode
[IMP] waptconsole: acls users, add search box
[UPD] waptconsole: reporting display: display bytes in human bytes if column ends with *_bytes in reorting
[FIX] waptconsole: fix for GetTemplateFilename to take custom template from user appdata instead of global one
[IMP] waptconsole: import hosts to wads
[FIX] waptconsole: regresseion. show developper (control, setup) tabs in edit package in deiscovery mode
[FIX] waptconsole: background edit color in package wizard
[IMP] waptconsole: agent creation with SPN domain
[IMP] waptconsole: create waptsetup : use GetTempWaptFilename for temp json filename
[IMP] waptconsole: add chr mustache helper
[IMP] waptconsole acls form: add _has_cert and _has_password columns. Disable some actions when more than one account is selected
[FIX] waptconsole fix toolbar customization glitches, should avoid buttons mismatch
[UPD] waptconsole: improve default html json mustache template. Add a basic tasks.html template for wapttasks, use local time
[NEW] waptconsole: reporting: add action “Show selected hosts in inventory”. Option available only if a column is designated to be the host_uuid. Filter the host inventory tab based on the selected uuids
[UPD] waptconsole: use a TSynEdit for add audit data form.
[FIX] waptconsole: image on os name if empty
[IMP] waptconsole: display a warning icon for pending_reboot waptwua status
[IMP] waptconsole: when editing Org Unit package from treeview, if thera more than one package (ie diffent os or maturity), show them in Packages private Repo, else just edit the latest matching unit package
[IMP] waptwua: update list of AuthorizedDomainRE for download_url report to server. Whitelist .exe, .cab, .msu, .psf, .wim, .msi, .esd in addition to current whitelisting
[IMP] waptwua: allow download_urls to be reported in WU mode if waptwua is enabled
[IMP] waptwua: fix SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateDisableWindowsUpdateAccess key for WU scan_mode
[FIX] waptwua: on Windows 24h2, when using wsusscn2.cab file download only MSU instead of all the download url list
[FIX] waptwua: fix regression: missing AcceptEULA for update installs.
[FIX] waptwua: fix incorrect discarded in status summary
[IMP] waptwua: update install history, display the error description
[FIX] waptwua: cleanup of unassigned win update when there are no urls
[FIX] waptwua: set fake wsus url registry key with https instead of http for fake wsus server to comply with audit tools
[IMP] waptwua: on waptserver during windows update download, check again that extension of downloaded file is allowed.
[FIX] waptwua: disable IsRescanNeeded waptwua. Now we always scan even if input conditions have not changed
[IMP] waptwua: waptserver: concat download_urls when updating wsusupdates table. In case different scans send different urls
[NEW] waptwua: add proxy_cmd parameter to start a local proxy for wsus when Wapt().waptwua(True) context is used. Defaults to proxylocal.py
[FIX] waptwua: fix corner case where Windows Update client could be triggered by Wapt agent. Set scan_service=OFFLINE if scan_service not defined explicitly
[IMP] waptwua: enable windows update service access if scan_service is not WSUS or OFFLINE. Allow to run wua online scan and install. Fixes error $8024002e Access to an unmanaged server isn't allowed in WU scan_service mode
[FIX] waptwua: direct_download with proxy only for waptwua
- if an http_proxy is defined in the [waptwua] section, use it for the wget actions of waptwua (else use the http_proxy of [global] if defined and use_http_proxy_for_repo is true)
- in the python callback, if returned value for url or proxy is None, keep input value
- fix FileIsDifferentOnServer when a full url with a diffrent server than actual repo server, and not only the relative one is provided.
[IMP] waptwua: re- add feedback to console when scanning and installing
- don’t set NEED-SCAN on wsusscn2cab changes if not in offline mode
- use same policy settings (ie. disable dualscan and so) for wsusscn2.cab scan mode than upsync (WSUS) mode
[FIX] waptwua: fix scan with updates without KBid. Fixes error invalid collection index, error code range check error, explicit error for 0x80240438. Add error description for Unable to get update_history
[FIX] waptwua: waptserver: fix wuserver config read
[NEW] waptwua: add a local wua proxy (WUfB), add WUServer option in server for NGinx
[FIX] waptwua: filering of url tlu.dl.delivery.mp.microsoft.com which are streaming urls that shouldn’t be use by waptwua on server side and client side.
[IMP] waptwua: waptconsole: handle Windows updates records deletion from waptconsole
[IMP] waptwua: cleanup: use variant for waptdb.SetParam value. Send wsus packages version to server in waptwua_status.rules_packages. Send specific waptwua settings in waptwua_status.settings
[IMP] waptwua: override wua status at the end of second scan after install to set PENDING_REBOOT
[IMP] waptwua : fix end install report and conditional rescan if updates have been actually installed
[IMP] waptwua: set ERROR status if download error
[IMP] waptwua: install_date in UTC
[IMP] waptwua: stores the bootup_time in waptwua.last_need_reboot_bootup_time local db param when setting wua PENDING_REBOOT status : to make it possible to detect scan after reboot.
[FIX] waptwua variant error for StoredWaptWUAStatus
[IMP] waptwua: protect against infinite recursion when include_potentially_superseded_updates=1
- calculate the PENDING_REBOOT status instead of storing it. (return PENDING_REBOOT when waptwua.status if PENDING_UPDATES and reboot needed is True)
- set waptwua.status = SCAN_NEEDED if stored status is PENDING_REBOOT and reboot needed is False.
[UPD] waptwua: set PENDING_REBOOT if install of some updates is still InProgress
[UPD] waptwua: send kb download_urls to server even if waptwua is disabled on agent
- some customers are using waptwua to scan and install in offline mode without actually enabling waptwua on agent.
- in this case, server still need to be able to download KB files.
- we are now filtering to keep only download urls ending with *.exe, *.cab, *.msu, *.psf, *.wim, *.msi, *.esd
[FIX] peercache: waptconsole default peercache_broadcast_timeout_ms_default = 200 and not 2000
[FIX] peercache: enforce disable peercache_enable if CSPN mode
[IMP] peercache: add random time.sleep 0-2 s when peercache enable and WaptDownloadUpgrade (websocket) call, add waptdownloadupgrade when trigger_host_upgrade
[UPD] peercache: reduce BroadcastTimeoutMS to 200ms * increase BroadcastMaxResponses to 100
[FIX] peercache: fixed THttpPartials wrong ID assumption
[FIX] peercache : netfixed THttpPeerCache.OnDownload with empty URI
[FIX] peercache: fix peercache response on POSIX, a broadcast with proper SetBroadcast() call seems mandatory
[FIX] peercache: process hardening, avoid file sharing issue when one peer try to rename partial file while another is getting the file
[IMP] peercache: improve logging, add firewall rules for windows in peercache audit log, add peercache settings
[IMP] peercache: local direct peercache: use url encoded arguments for cert auth and proxy instead of OnPeerCacheDirectOptions callback
[FIX] peercache: fix peercache_init parameters
[FIX] peercache: rewritten THttpPeerCache.OnDownloaded logic, mostly about partial file switch
[IMP] peercache: audit log: start / end time in iso utc, speed in kb/s,
[IMP] peercache: audit log: add wget_audit_count parameter to set the number of downloads audit history records on client (default to 30)
[IMP] peercache: wapt-get peercache waptwget: add audit data when file are downloaded
- section “host_metrics”, key “peercache”:
- keep last 100 downloads report for 30 days
- can be disabled with “enable_wget_audit=0” in wapt-get.ini (default true)
[UPD] peercache: wapt-get.py: allow –peercache switch to start peercache server (for debug purpose mainly)
[IMP] waptcore: wapt-get as python subsitute : handle -V and –version, fixes Pycharm python interpreter autodiscovery bug
[FIX] waptcore: use certifi bundle for websockets verify if True on Linux
[IMP] waptcore: display raw main repo url instead of calculated from rules in repr
[UPD] waptcore: waptlicences.waptserver_login: add otp_code optional argument
[FIX] waptcore: waptcrypto python: deprecation warning on certificates not_before / not_after and timezone
[FIX] waptcore : fix publicdb migrate from privatedb when upgrading from 2.5 to 2.6 (key error ‘install_by’ -> ‘explicit_by’)
[SEC] waptcore: switch to openssl 3.4.1
[SEC] waptcore: upgrade python modules
- libpq 14.12 -> 14.17
- libffi 3.4.6 -> 3.4.7
- readline 8.2 -> 8.2.13
- gdbm 1.23 -> gdbm-1.24
[UPD] waptcore: nginx upgrade from 1.22.1 -> 1.27.4
[UPD] waptcore: removed flask_babel and babel from agent and server installs
- basic translations in waptservice
- no translation in waptserver
- removed pytz requirement
- gettext _ is configured and imported from waptservice_common
[IMP] waptcore: add netbios_domain in info
[IMP] waptcore: add –templatestring option to wapt-get
[IMP] waptcore: use a temporary location to store the stripped down CA pem file when verify_cert=1
- this is to prevent user from using this file for cert pinning.
- add a waptlicences helper to get such a pem CA file from python
- clear stripped ca cache on waptconsole startup
[IMP] waptcore: python waptlicences: reenable python threading during lengthy operations in waptserver_login, waptserver_request, wapt_local_json_get , wapt_local_login, sz_extract_all
- enable python threading in waptwget too, and be sure to habe python lock in PrintHook callback
[IMP] waptcore: force mormot TAesGcm use in pywaptlicences
- instead of openssl AES-GCM of OpenSSL to circumvent issue with python ssl _load_windows_store_certs and PeerCacheProcess.HttpDirectUri
[FIX] waptcore: wapt-get server-request auth for url wapt-get server-request api/v3/login?get_token=1
[IMP] waptcore: json config
- don’t rewrite change “verify_cert” json key when installing json config file and in ApplyJsonConfigToIniFile
- set ‘name’ key in install_json_config when loading json configs
- RemoveJsonConfig returns now the list of removed files
- re-extract packages certificates and server certificates from json config at each config reload
- protect the wapt-get.ini build from json with a RLock in case 2 threads detects config changes ad try to merge json at the same time
[FIX] waptcore: wapt-get waptdb: don’t try to create directory if dbpath is :memory:
[UPD] waptcore reduce resolution of waptutils.bootup_time and makes it stable
[IMP] wads: Add win11 template to bypass requirements
[FIX] wads: increase efi partition size to 400
[FIX] wads: fix wads import host from wapt inventory
[FIX] waptself: install/uninstall package task status not updated on Card if we have switched to another user.
[FIX] waptself: fix blank list when opening selfservice with “All categories” selected in categories combobox
[IMP] waptself: assume user is member of waptselfservice group for local auth if user is a direct member of local administrators group in filetoken mode.
[FIX] waptsetup: cleanup __pycache__ folders between two installs
[IMP] wapt-get edit or edit-package <package_directory or package_filename or {package_uuid} or packagename > download, unzip, check and edit package in editor. replaces the equivalent command of wapt-get.py which did not work anymore

WAPT-2.6.0.16937 (2025-02-13)¶

hash: 7ba7ea7a

This is a bugfix release following client feedback, and integrate new parameters for Windows Update configuration, paving the way for incoming MS-WUSP protocol support in Wapt.

[FIX] waptagent: breaking change: don’t use wincomputername() api for windows host computer_name inventory. Use get_computer_name() instead.
[IMP] waptagent: don’t require server auth for server-request unless server requires it with a 401
[IMP] waptagent: updates to wapt-get search and list text templates using Mustache templating
[FIX] waptagent: use GetEnvironmentVariableUTF8('WINDIR') for GetWindowsFolder instead of GetSpecialFolderLocation(CSIDL_WINDOWS)
[FIX] waptagent: regression on faked host_organizational_unit_dn
[IMP] waptagent: waptserver register endpoint, optionaly returns configurations on register. Should allow to apply configurations right after registration
[IMP] waptagent: wapt-get: add local-login to get a local token for testing purpose. Take in account a WAPTSERVICE_TOKEN environment variable. Add a --waptservice-token option
[IMP] waptconsole: waptsetup build, add option to integrate full default json conf, even the parameter that are not displayed in waptsetup build GUI (otherwise, only graphically displayed parameters are taken into account). Resulting configuration will be shown upon saving or with Ctrl-Maj-J shortcut.
[FIX] waptconsole: fix violation access in reporting queries in some cases
[IMP] waptcore: improve --loglevel switch handling in FPC code of Wapt
[FIX] waptcore: local db param: be sure to escape ‘”’ in param db json value
[IMP] waptcore: replace cpu_info python module with mORMot equivalent. This module may starts a secondary python process which is not acceptable.
[FIX] waptcore: improve audit data handling when re-registering computer (after re-install of client computer or re-install of agent)
[NEW] waptwua: add use_downloader param to dynamic config form
[NEW] waptwua: in waptconsole, add wu_server key and last_scan_service info in WUAServerStatus report
[NEW] waptwua: add scan_service (can be set to WU, MU or WSUS) and wsus_server config parameters to add support for wsus proxy to Wapt Server
[IMP] waptwua: add intranet WSUS scan mode with direct_download using UpdateDownloader instead of CopyToCache.
[UPD] waptwua: additional registry settings to prevent internet access in wsus mode
[IMP] waptwua: in waptconsole, add “Error Code” column for windows updates install history
[IMP] waptwua: try to keep error message and code for each update installation
[FIX] waptwua: apply registry and service settings to waptwua if when calling reload_config
[UPD] waptwua: waptconsole: add loglevel_waptwua parameter to dynamic configuration form
[FIX] waptwua: fix remote repo and proxy handling in waptwua download
[FIX] waptwua: fix WUA registry keys with faulty ending spaces
[NEW] waptwua : load an optional download_urls override map from %WAPT_DIR%waptwuadownload_urls_patches.json when proper url are not mentionned in wsusscn2.cab file
[IMP] waptserver: Remove sudo in postconf, use run_as_user_unix()
[IMP] waptserver: OTP hint in authenticate realm
[FIX] waptself: regression on empty categories combo
[IMP] peercache: enhanced logged content in verbose mode
[FIX] peercache: peercache process could refuse to share with valid peercache peer due to mdSeq false positive error
[UPD] setuphelpers: don’t zero fill password in waptlicences wapt_local_json_get and wapt_local_login helpers. Python str was zero filled too …

WAPT-2.6.0.16881 (2025-01-30)¶

This is a bugfix release following client feedback. Noteworthy udates includes:

improvements for Windows 11 24h2 WaptWUA support due to changes in the way Microsoft handles updates for this new version
better support for spn_domain for inter-forest trust Kerberos auth

hash: 9f8470c4

[NEW] waptconsole: in waptagent build configuration gui, allow to specify spn_domain option to allow cross-forest Kerberos auth
[FIX] waptconsole: support darkmode for Windows 10 LTSC 2019 and later
[IMP] waptconsole: delete cached downloaded package if successfully imported from store and uploaded to waptserver
[IMP] waptconsole: in hosts list query, use POST request to handle large queries for large number of agent
[NEW] waptconsole: add a search box for reporting queries
[FIX] waptconsole: in password inputbox, disable tabstop on “show password” hint
[GUI] waptconsole: in wapt packages, section image type on name and packages
[GUI] waptconsole: host inventory platform image on os name
[FIX] waptconsole: during waptagent build, fix bad path build for explorer.exe when opening explorer
[FIX] waptconsole: purchase date and purchase_order main inventory property nmae
- so that they are stored in as custom audit data if supplied
[FIX] waptwua: improve download and caching of Windows udpates files, and deletion of files upon update completion
[FIX] waptwua: on Windows 11 24h2, use msu file when one with the update id is found in UUP file list
[NEW] waptwua: introduce loglevel_waptwua logger for wapt-get waptwua-xxx actions
[NEW] waptwua: add new wapt-get install-msu action
[FIX] waptwua: fix registry read error when value does not exists
[NEW] waptwua: breaking change: removed the ability to install Windows updates at shutdown in waptexit because it is not supported anymore in Windows 11 24h2. In waptsetup, the checkbox is replaced by a install scheduling combobox (if empty, no automatic install)
[FIX] waptwua: properly handle repote repo rules and proxy during waptwua downloads
[IMP] waptwua: use Dism.exe instead of wusa.exe to install .msu files
[FIX] waptagent: handle NULL value in dynamic json config to ini file. Now setting to NULL now remove the value from ini file instead of crash.
[FIX] waptagent: fix wapt-get reset-config-from-file not working in certain condition
[IMP] waptagent: wapt-get register: don’t as for password if --not-interactive
[FIX] waptagent: during install or update, when configuration waptexit on shutdown, better handle gpupdate errors when GPO engine is slow or crashed
[FIX] waptagent: when updating host status, check with computername instead of computer fqdn that agent is registered under correct name.
[REF] waptagent: improve wapt-get register, ask for totp if needed, fix basic auth callback in python WaptServer, fix waptlicences.waptserver_request basic auth, add use_ssl_auth to waptlicences.waptserver_request
[UPD] waptagent: on Linux / macOS, GetTempWaptDir is now located in user $HOME/.local/wapt/tmp on non Windows and %TEMP%wapt on windows * previous location was on global /tmp/wapt
[FIX] waptagent: fix breaking change on computer_name in update_host data: * in unix host_infos, revert computer_name to previous socket.gethostname().lower() value even if there is a keytab (kerberos)
[FIX] waptagent: better handling of hostname in get_domain_hostname_from_keytab when /etc/hostname and keytab are not coherent
[FIX] waptagent: wapt-get register / wapt-get unregister with a custom user specified with --wapt-server-user even if kerberos login with session user can authenticate * ie. when the session kerberos user has not the admin/register ACL right on waptserver but we still want to register manually
[FIX] waptagent: pid not reset in user db when wapt-get session-setup returns RETRY status
[FIX] waptagent: peercache uuid and peercache_set_secret
[FIX] waptagent: add support for wapt-get unregister with using kerberos auth
[FIX] waptagent: on Linux, fix incorrect chown for RPM & DEB packages
[FIX] waptagent: on Linux, DEB & RPM: mkdir cache icons folder
[FIX] waptagent: on Linux, for debian agent include ‘hold’ packages in installed_softwares
[FIX] waptagent: macOS: fix waptself icon display, ensure cache icons folder is created
[UPD] waptagent: on win7sp1 and below, reenable TLS1.1 on local service TLS server (only local loopback communication) due to waptdeploy using schannel limitation in win7. For agent server communication TLS version is TLS1.2
[IMP] waptagent: waptself: don’t propose to force install / remove on TASK_ERROR anymore. On Linux, don’t warn for running processes if impacted_process is not empty.
[UPD] waptagent: waptagent / WaptServer otp auth
- add a bearer_token prop
- use unicode for user and password in ask_user_password auth() callback
- default with_otp to None. If None, use WaptServer.with_otp property
- set with_otp to True if server returns a ‘Missing OTP’ auth hint on auth failure
- provides computer_name key in register and update_host data ( == setuphelpers.get_computername() )
[IMP] waptagent: wapt-get server requests: improve login basic auth.
[FIX] waptagent: waptdeploy local auth
- waptdeploy: use an extended local ping to check running_and_pending tasks count
- local service ping returns now a version_full and a tasks_count property
- if TLS does not connect, try without.
- use https for waptdeploy waptlocaljsonget
[FIX] waptserver: fix normalization_import_softwares in case two exact same software is reported in machine software inventory
[FIX] waptserver: connection: when updating session cookie, don’t dismiss other custome headers like add_host X-Signature
[IMP] waptserver: update_host: check matching host certificate CN with computer_name in addition to uuid and computer_fqdn (to handle cases where host account in AD is different from local computer_name on linux) If no signature, use nginx x_ssl_client_auth header to get the identity of provided data. allow_unsigned_status_data means either data is signed or connection is autheticated with a certificate CN which matches provided data (uuid, computer_name, computer_fqdn)
[FIX] waptserver: fixed TLdapClient.GetIsMemberOf() when UserDN contains an LDAP escaped character
[FIX] waptserver: postconf: fix test if db and user exist in waptserver postconf
[IMP] waptserver: on login: retry without kerberos if http 403 and use_kerberos=1 if client is configured to use kerberos but server is not.
[IMP] wads: allowing to save an empty format script
[FIX] wads: be sure to select only HostOSDeploy with not null mac_addresses
[NEW] wads: djoin: add option to remove SPN
[IMP] waptcore: pyldap: add SD flags in ldapClient instance, add support for NTSecurityDesriptor
[IMP] waptcore: pyldap: update mormot2 for ldap case-insensitive attribute names
[FIX] waptcore: wapt-get.py : use unicode for user and password auth callback
[IMP] setuphelpers: waptguihelper login dialog: allow to input empty password or empty otp

WAPT-2.6.0.16795 (2025-01-14)¶

This is a bugfix release following client feedback.

hash: 5c1227ae

[IMP] waptserver: removed wapt-get register check which disabled kerberos if not system account. This allow a kerberos authenticated normal user to register with proper ACLs
[IMP] waptserver: postconf: ask to define a totp if require_totp_for_admin is True an no TOTP yet on main wapt admin user
[FIX] waptserver: during install/upgrade, on linux debian postinst try-restart waptserver-uwsgi if configured
[FIX] waptagent: fix regression uninstall_date not set properly in public db when package installed and removed
[FIX] waptagent: on upgrade be sure to drop trigger in local public db (recursion issue when updating)
[FIX] waptagent: local auth: when a password is provided in service_auth_type = filetoken mode, switch to system mode fix not able to switch user in self-service
[FIX] waptagent: fix self service groups check which was not case insensitive. Now the check is case insensitive.
[UPD] waptagent: kerberos auth: introduce spn_domain in wapt-get.ini key to specify a domain to append to SPN in order to do cross forest auth when DNS suffix does not match When authenticating with kerberos, the SPN is calculated as HTTP/<server>@<spn_domain> eg. HTTP/srvwapt.ad.tranquil.it@ad.tranquil.it
[NEW] waptagent: add waptexit_disable_upgrade parameter in advanced initial json configurations edit.
[FIX] waptagent: run session-setup at graphical session start on Linux and macOS
[NEW] waptconsole: in private repository add an action to trust an untrusted package signer’s certificate
[UPD] waptconsole: display packages with untrusted signer’s certifcate in gray color instead of hiding them
[FIX] waptconsole: use proper conf when two waptconsole are opened and one needs to reauthenticate in ShowLoginDialog
[FIX] waptconsole: fix private repo sometimes empty on console startup (needed to press the refresh button to have the content displayed)
[NEW] waptconsole: login dialogs: add a button to show currently typed password in password dialog box for usability.
[FIX] wads: fix home folder umask in linux template
[UPD] setuphelpers: waptguihelper: improve login_password_dialog() (add description arg, handle named arguments for easier usage, etc.)
[NEW] setuphelpers: add search_filter to PyLdapClient.get_authorized_user_groups() (default to pyldap.ofAll)
[IMP] setuphelpers: on unix get_domain_info(): if not default root_dn from ad, calculate root DN from domain name

WAPT-2.6.0.16767 (2025-01-09)¶

This is a bugfix release following client feedback. The main fixes are a regression during Windows WaptServer install and another during package install on macOS arm64 WaptAgent.

Deprecation warning:

in waptserver.ini file, wapt_admin_group_dn parameter has been replaced by wapt_admin_group which needs a samAccountName as value

hash: 6f0468d8

[REF] waptserver: params require_totp_for_admin, prohibits login to users who have the administrator acl. A user must first log in as non-admin to set an OTP secret
[FIX] waptserver: API points are again callable in a method other than session
[REF] waptserver: remove config wapt_admin_group_dn replace by wapt_admin_group (specify a samaccountname)
[FIX] waptconsole: Linux filter on WAPT Packages and import from internet
[FIX] waptconsole: architecture filter for arm/arm64 in import from internet
[FIX] waptagent: fix regression on macOS arm64 agent where agent could produce an AV and restart after package installation
[IMP] waptagent: on Linux / macOS, computer_fqdn and domain_name are now extracted from keytab file. Set domain from keytab for filetoken mode
[FIX] waptagent: waptself local auth regression: force domain_groups in lowercase to check local user memberships
[FIX] waptagent: on macOS fix pkg 755 rights on symlinks
[FIX] waptserver: setup windows: initial empty files sync.json, rules.json, licences.json not created in the right place
[FIX] waptserver: setup windows: static Microsoft crt linking for greenlet module
[FIX] waptserver: improve testing-ldap-connectivity script, ldap_auth_base_dn removed not necessary anymore, more check added to prevent error
[FIX] waptcore: pylpdap.cldap_get_domain_info: use CldapGetLdapController to find the ldapserver without providing domain_name
[FIX] waptcore: wapt-get -S randomly unable to authenticate
[FIX] waptconsole config: improved layout, prevent trying setfocus if edit is not displayed, login: improved layout for linux
[IMP] wads: improve linux deployement
[NEW] wads: waptlicences.get_djoin_infos helper function for joining offline join of Linux clients

WAPT-2.6.0.16840 (2026-02-13)¶

hash: c6826e74

It includes mainly COTS updates and cleanup, and some security hardening backports from later wapt version. Additionnaly COTS that could be trivially removed have been removed.

All COTS are all in the latest published version, or in the latest version of the supported LTS release currently used. The build farm and toolchain has been improved and upgraded to better follow COTS upgrades and have single build for each components.

Note

As this version uses Python 3.10, if you use PyScripter you have to use PyScripter4 or PyScripter3 version 3.7 from Tranquil IT github which integrate Python 3.10 support.

Security related hardening:

[SEC] Updated COTS
- updated to Python 3.10 and its build dependencies to latest version
- updated all Python wheel modules to latest version
- upgrade build farm to latest toolchain Lazarus 4 / FPC 3.2.3
- removed pytz, pyasn1, pefile, pylibmc, py-cpuinfo, future, pyopenssl and pyad python requirements (modules straight forward to remove)
[SEC] waptagent: add a manifest to waptdeploy to force load version.ddl from %system32 folder and avoid potential dll hijacking.
[SEC] waptagent: hardening of tis-waptupgrade package. Use <wapt>privatetmp<random_guid> directory to store temp waptagent.exe and waptdeploy.exe
[SEC] waptserver: ensure update crls at server startup
[SEC] waptserver: server waptusers delete: delete user/passwd entry both in sqlite db and in htpasswd too
[SEC] waptserver: set hardened kerberos configuration : default_etypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 and msktutil --auto-update --enctypes 0x18
[SEC] waptserver: increase default RSA Key size to 3072 bits for recommended safe use after 2030 for Server auth keys.
[SEC] waptserver: in reporting, limit the maximum duration of SQL statements to 30s by default. Added reporting_statement_timeout waptserver parameter to override this.
[SEC] waptserver: require edit_report acl to be able to use api/v3/reporting_exec_raw endpoint
[SEC] waptagent: waptsetup: agent windows: be sure to create log directory in setup before restricting inherited acls on it
[SEC] waptserver: api logs: don’t log post data for sensitive endpoints login, login_kerberos, change_password, set_account_otp, get_temp_client_cert, set_user_password, invalidate_user_password
[SEC] waptserver postconf: when building certificate for Agent CA PKI, enforce the client_certificate_lifetime setting : by default it is 10 years, but must be 3y in CSPN mode.

Other small fixes and improvements backported from later 2.6 releases:

[IMP] waptconsole: waptlicencing refresh skipped if not logged in to avoid spurious login popups
[IMP] waptconsole: packages comparison in console now promote packages with all or 64 bits architectures armhf < arm < x86 < arm64 < x64 < all. This fix helps download the proper dependencies
[FIX] waptconsole: one may see a upgrade proposal when starting waptconsole even if console and server are in the same version. Properly compare version, including packaging hash (hash after dash ‘-’ in full version) when comparing minimum waptsetup version with downloaded one.
[IMP] waptconsole: in users grid: don’t allow to edit username of existing users (currently not properly supported. To rename one should delete and recreate the user in ACLs gui)
[BLD] wads : use single OpenSSL x64 build compiled by the toolchain (not included in TOE)
[IMP] waptcore: embed CertificateVerificationContext and CertificateRevocationListVerificationContext into waptcrypto python module to avoid overwriting x509.verification module provided by cryptopgraphy since v42
[IMP] waptagent: local IsEnterprise check skipped if no public db
[IMP] waptagent: in wapt-get remove improve message for uninstalled packages
[UPD] waptagent: WAPT.install will now raise an exception in packages if there are install errors or missing dependencies. One can set raise_exception_if_errors_or_unavailable=False to keep the old behavior
[FIX] waptagent: false downloads / install errors on upgrade when same package appears several times in dependencies
[FIX] waptagent: on win7 use our own compiled patched api-ms-win-core-path required for Python 3.10 (not included in TOE)
[BLD] waptagent: use same sqlite3 build for Python and Lazarus/FPC on windows
[IMP] waptagent: removed dmidecode binary
[IMP] waptagent: wapt-get install will returns error code 1 if some packages are unavalable or have error on install (used to return 0, which may trigger non-expected behavior in Bash or Powershell scripts)
[FIX] waptagent: waptdeploy ProcessExists was checking full process path instead of binary name itself. This may trigger concurrent upgrade when having both WADS and a GPO installing the waptagent on a newly installed computer
[IMP] waptagent: provide python-cryptography v44 for win7 support for industrial setups (not included in TOE)
[FIX] waptagent: propagate properly install_by and uninstall_by in public package status db
[FIX] waptagent: on linux waptagent inventory: grp.getgrgid requires int argument (due to python 3.10 upgrade)
[FIX] waptagent: fix wapt-get -S local auth (fix error message result undefined…)
[IMP] waptagent: waptsetup: updated GUI to highly suggest to not change config at initial install (configuration is done on first WaptConsole startup)
[FIX] waptagent: waptexit: cleanup of pending package treeview
[FIX] waptserver: server postconf: generate dhparam with python instead of OpenSSL (openssl binary is no more installed by default on newest Redhat >= 10)
[UPD] waptserver: on Windows waptserver, upgrade PostgreSQL to v15 (not included in TOE)
[IMP] waptserver: allow user to change their own TOTP, allow non admin user to use /api/v3/set_account_otp endpoint for thir own account, add action on waptconsole to set TOTP for non admin user
[FIX] waptserver: fix activated licence server_uuid check, auto activate licences on server startup
[FIX] waptserver: fix update all CRLs if no CRL file before

WAPT-2.6.0.16714 (2024-12-19)¶

hash: bc373938

This is a bugfix and security focused release following client feedback. Main changes:

add TOTP support for 2FA
upgrade of all dependencies (Python, Sqlite, etc.), remove pyobjc deps on macOS
convert local auth on waptservice to FILE_TOKEN mode instead of SYSTEM
use a separate DB for WaptUsers and WaptUserAcls tables

Detailed changelog:

[FIX] waptserver : during postconf fix potential chmod failure on keytab file
[NEW] waptserver: add TOTP support
[IMP] waptserver: server auth: random sleep only on primary auth.
[SEC] waptserver nginx kerberos: disable auth_gss_allow_basic_fallback as it allow to bypass ldap restrictions or otp restrictions
[FIX] waptserver: on authentication, propagate initial auth_method from session storage to be able to properly decide if otp is required.
[NEW] waptserver: --url option in get_linux_and_macos_agent.py
[UPD] waptserver: in CSPN toe or with require_totp_for_admin option
[IMP] waptserver: increase max_body_size for big package
[IMP] waptserver: check that all required fields have been filled in before running testing-ldap-connectivity.py
[SEC] waptserver: enable server side session and better logout handling using session_waptmemcache on port 11212 (ensabled by default when on cspn_toe mode)
[IMP] waptserver: in waptserverconnection.login introduce SetTOTPSecret argument to optionnaly set new totp secret on successful login
[SEC] waptserver: use a separate DB for WaptUsers and WaptUserAcls tables
[IMP] waptserver: properly disable all endpoints serverside when wads is disabled
[UPD] waptserver: when using cspn_toe mode, use shorter random login sleep which was too stringent
[IMP] waptconsole: hide certificate and prefix panel in config if not connected to server to prevent creating key with invalid parameters
[NEW] waptconsole: add TOTP support
[IMP] waptconsole: on login, keep the entered user name if login is displayed again to ask for totp code
[IMP] waptconsole: propose to register a totp for admin if require_totp_for_admin is set in server config.
[IMP] waptconsole: create setup: prevent disabling server cert check in cspn toe mode
[IMP] waptconsole: waptserver auth: ensure a 2FA TOTP token is set at login if in cspn_toe mode * feedback message if server is not available * server returns 2 specific forbidden messages when a totp cod eis required or when a token secret must be set * translations
[IMP] waptconsole: improve package wizard
[FIX] waptconsole regression on html templates search (cyberwatch)
[IMP] waptconsole: don’t update hash on server if wads is disabled
[IMP] waptconsole: otp layout fixes and translations
[IMP] waptconsole: hide reset websockets action
[FIX] waptconsole: Improve path in ShowFileInFileManager dialog box
[FIX] waptconsole sql error for auth logs view when sorting on a column
[FIX] waptconsole: set / clear OTP token in acls form
[NEW] waptconsole: handle TOTP token on waptserver accounts. Set / change OTP for current user_infos. user must login to set new otp * clear / set accounts OTP in wapt users Acls form if current user has admin rights .
[NEW] waptconsole login: show otp edit in login form if last login required an otp
[FIX] waptconsole: rustdesk helper: improve connection gui feedback in case of impossible decryption of secret
[FIX] waptagent: bad decode of login error message from server
[UPD] waptagent: add a wapt-get.ini [global] option enable_otp_input to force wapt-get to ask for a otp code
[IMP] waptagent: be tolerant if wapt/conf.d does not exist yet
[UPD] waptagent: breaking change: default waptservice authtype is now SSO “filetoken” instead of “system” * this provides SSO for waptself without specific configuration * auth is based on a token stored by the waptservice in a file with user’s restricted ACLs. * if user can read the file token
[IMP] waptagent: waptmessage windows closed automatically after 30 secondes
[NEW] waptagent: wapt-get.py : add totp support for unregister * add Wapt.waptserver_login() and Wapt.waptserver_logout()
[NEW] waptagent: add --with-otp switch to ask otp on server login
[IMP] waptagent: waptsetup: during build, disable peercache and use repo rules to match server settings (CSPN)
[FIX] waptagent: wapt-get.py: enable-check-certificate result if server not available
[FIX] waptagent: regression wapt-get --hide access violation on windows
[FIX] waptcore : default value for service auth type to filetoken
[FIX] waptcore: fix set-cookie in waptlicences.waptserver_request * set expires and path match
[FIX] waptcore: waptlicences: change waptserver_login to accept a tuple of (cert_path,key_path,[keypwd]) instead of only keypassword
[FIX] waptcore: fix CreateRecursiveZip missing hidden files/directories
[FIX] waptcore: mustache helper toJson2: produce compact pure json (jsonEscapeUnicode) * quoted keys * escape unicode
[FIX] wads: using OTP
[FIX] wads: check_auth : use app.conf['default_auth_methods']
[FIX] waptwua: IsRescanNeeded = True if previous status was ERROR
[FIX] waptwua: fix downloads_url may contains array of identical urls
[FIX] waptwua: potential fix for duplicated download urls
[IMP] setuphelpers: few changes:
- add better logging to install_msi_if_needed
- removed unused func from keyfinder
- fix host_info.os_name for windows 11
- fix windows_product_infos
- add Windows11v24H2 to WindowsVersions class
[IMP] setupdevhelpers: waptguihelpers: add otp option for LoginPasswordDialog

WAPT-2.6.0.16613 (2024-12-10)¶

hash: 4de25b0a

This is a bugfixe release following client feedback.

[SEC] waptcore: update 7zip and python39 to latest version due to security release
[FIX] waptcore: waptcrypto IX509Certificate.IsValid: don’t include a 0.5d threshold. Should fix waptconsole need to be restarted on session expiration. Globally set CERT_DEPRECATION_THRESHOLD to 0day
[IMP] waptconsole: index audit data by <section>_<key> to allow easy access in host overview html template
[IMP] waptconsole: edit package valid from, until forced: Add a checkbox to make it easier to clear date. Add hint for N key
[FIX] waptconsole: some temporary files are not deleted when closing application.
[FIX] waptconsole: fix filtering packages in private repos with signer certs issued from a CA and CA is trusted
[FIX] wads: fix regression, missing result assigment in GetRandomPassword for djoin
[NEW] wads: improve managing disk partitioning and formating scripts for wads
[FIX] wads: create wads config: regression in {{ mustache }} being replaced too early. {{random_password}} place holder is now LOCAL_ADMIN_PASSWORD_PLACE_HOLDER to avoid confision with mustache
[IMP] waptagent: wapt-get add server-request action to trigger a custom an action on server (mostly for debug for now)
[IMP] waptagent: waptself: add “Show all variants” option
[FIX] waptagent: waptself: when searching latest package by package name, don’t take maturity and locale in account.
[UPD] waptagent: wapt-get and wapttray: handle html output for installed packages status
[UPD] waptagent: peercache: restart peercache process on network settings change
[IMP] waptagent: wapt-get -S, displays enqueued tasks only if loglevel debug
[NEW] waptagent: wapt-get: add local-request debug and automation action. Add --templatestring to provide an output specific mustache template. Ex. wapt-get -c "c:program files (x86)waptwapt-get.ini" local-request ping --json --templatestring="{{result}}"
[FIX] waptagent: wapt-get list-registry list softwares with empty names too
[UPD] waptagent: on windows, don’t ignore softwares with empty names for software inventory and for need_install
[FIX] waptwua: fix regression in install_delay parameter
[FIX] waptwua: be safe if no wsus packages records in local db (waptwua regression on fresh install: null variant to string)
[FIX] waptwua: ensure we create privatecache directory before downloading cab.
[IMP] waptcore: improve pyldap module performance for large domains
[IMP] waptcore: create temp files and directories in %TEMP%/wapt
[NEW] waptcore: allow to localize html templates for wapt-get and waptconsole
[FIX] waptcore: fix html viewer onclick handler
[NEW] waptcore: add b64encode, b64decode, sha256, sha1 and md5 mustache helpers.
[IMP] waptcore: waptguihelper: improve searching in waptgrid
[IMP] waptcore: improve testing of LDAP connectivity
[UPD] waptcore: use REALM instead of NetBIOS name in user name mapping
[FIX] waptserver: fix get_linux_and_macos_agent.py and remove symlink agent linux (broken in wapttasks)
[FIX] waptserver: error when uploading large ISO in uwsgi mode due to uwsgi_request_buffering
[IMP] waptserver: added uwsgi_send_timeout and uwsgi_read_timeout to 120s instead of 60s to reduce risk of timeous

WAPT-2.6.0.16552 (2024-11-19)¶

hash : 49ddf2d3

This is the first release for WAPT 2.6 serie.

The focus of this release is the security and performance improvement.

Main new features:

Add peercache support for agent to agent package distribution : on a subnet, the first computer to download a package can share the download to other computer from the same subnet
Add support for session_cleanup function to integrate cleanup in user session during package uninstall
Improved support for timezone in WADS
Add support for dark mode in WaptConsole on Windows (dark mode on Linux and macOS was already supported).
Add support for remote assistance through rustdesk, teamviewer, anydesk (need to first install audit packages)
Add support for json output to wapt-get for easier automation
In WaptConsole add manual audit values, such as warranty expiration date, etc.
WaptConsole: automatically match installed software with corresponding package in software inventory tab
WaptConsole: enhanced html templating with possible actions ( HttpGet, HttpPost, Join, Get, Count, Pad, PadLeft Values, Keys )
Customise output of wapt-get command through templates

New technical and security features:

Switch to LDAP SASL GSSAPI Kerberos authentication for Active Directory
Hardening of local wapt service : local waptservice is now listening on https TLS socket, split of local db in public and private db
Support for waptconsole authentication for “Protected Users” group members
WAPT Windows Update now use COM early bindings rather than late binding to avoid being broken by yearly incorrect COM TLB updates from Microsoft

Update of all components

Python 3.9.20 and all Python librairies
OpenSSL 3.1.7
Lazarus 3.2 / FPC 2.3 / mORMot 2.3

Caveat and removal:

waptpython is now a symlink pointing to wapt-get binary. Wapt-get binary does PYTHONPATH and PATH cleanup before startup for security reasons and might behave differently compared to original waptpython if you use if for other use than WAPT.
WAPT now use Python certify certificate bundle by default
removal of dmi / wmi inventory upload. It is now provided through audit data with audit_wmi and audit_dmi packages
if you use non-ActiveDirectory LDAP / Kerberos Authentication, SASL/GSSAPI Kerberos bind may fail
support for Samba Active Directory needs Samba minimum version of 4.16.
if you upgrade from WAPT 2.4, please be sure to read the upgrade procedure, it is required to have verify_cert enabled! If you upgrade from Wapt 2.5 you are ok.
there is a bug during package upload on a uWGSI enabled server. The bug is already fixed in today’s nightly release and will be shipped in Wapt 2.6.1.
dark mode is not yet supported on Windows Server 2k22 and later

Detailed changelog:

[REF] waptservice: removal / cleanup of unused endpoints * check_install package_download waptupgrade install_log enable disable /wapt/<string:input_package_name>
[SEC] waptservice: restrict “show” endpoint on authorized packages * based on selfservice rules
[FIX] waptservice: under macOS keep service running even if session is closed and reopened
[FIX] waptservice : wapttray: fix cpu usage
[SEC] waptservice: set MinProtocol = TLSv1.3 for openssl client
[FIX] waptservice: fix TWaptRepo.FileIsDifferentOnServer if url argument is not relative to repo url.
[NEW] waptservice: Introduce waptwua/uwaptwua.pas, Lazarus porting of waptwua/client.py
[SEC] waptservice: introduce owner on events to filter broadcasting
[SEC] waptservice: https server: be sure to require TLSv1.3 and safe ciphers
[FIX] waptservice: html text is hidden on some linux for waptmessage and waptself
[IMP] waptservice: increase http server threads numbers * as we are keeping connections for long polling, it’s better to allow more threads if we don’t want to wait for free ones. * add waptservice_poll_timeout and waptservice_keep_alive_ms parameters
[IMP] waptservice: when scanning local repo, if Packages index is corrupted, try to recreate it once.
[IMP] waptservice: improve memory leak issue
[IMP] waptservice: try to reduce memory pressure * share the flask Wapt instance * share the sqlite cursor across threads (writes are serialized with lock)
[IMP] waptservice: session_cleanup(): don’t run it if another package with name is still installed.
[NEW] waptservice. Introduce support for per package and user session_cleanup() package hook
[FIX] waptservice: handle in WaptDB.db property getter the case of cross threads access to same WaptDB instance. * reset the sqlite db instance when calling thread is not the create thread * make the db initilization atomic with a lock (prevents ._db to be None for concurrent foreign threads) * store host_uuid as a property of WaptSocketIORemoteCalls to avoid the need of db access. WaptSocketIORemoteCalls is recreated anyway in case of host_uuid change.
[SEC] waptservice: require token for wua local service endpoints
[UPD] waptservice: auth: improve logging
[FIX] waptservice: wapttray: missing token
[SEC] waptservice: removed ‘waptservice_user’,’waptservice_password’ local wapt specific user account (not used) * introduced a allow_local_token decorator to replace most allow_local * added a allow_html (default False) to enable/disable html rendering of local endpoints * /login writes a (optionnaly encrypted) token in user home directory for local auth * /localtoken writes a encrypted token in user home directory for local auth (no groups) on service * allow POST on /login and /localtoken to post secret key * introduce disable_tls parameter. * use TLS for local service http server unless is True * create at each serice startup a new pair of RSA keys in private/localservice.pem and public/localservice.crt for https server * (local client can access public/localservice.crt to validate local server certificate) * host inventory: add a ‘updated_on’ key for dict delta data to know last update date on server.
[NEW] waptservice: allow “forced” download/upgrade/install/remove even if battery is too low
[FIX] waptservice: report of host_metrics peercache_status on Unix platforms
[FIX] waptservice: regression on service startup with Babel configuration * after upgrade of flaskbabel python module
[FIX] waptservice: setuppy not stored properly in private db * audit not working
[BUG] waptservice: linux: add Defaults:wapt !requiretty
[FIX] waptservice: regression on show_message
[UPD] waptservice: try to keep db compatible in case of a revert of agent from to 2.5.5 (becuase of split of private/public data
[FIX] waptservice: waptmessage: when started from cmd, wait for application terminate. * allocate console if -c is provided for html forms json submit * example : waptmessage -c -b PGh0bWw+PGZvcm0gbWV0aG9kPSJTVERPVVQiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ0b3RvIj48aW5wdXQgdHlwZT0ic3VibWl0Ij48L2Zvcm0+PC9odG1sPg== –waptbasedir=”c:program files (x86)wapt” -t 10 -n * honor -t timeout even if no border
[IMP] waptservice: in “nopassword” auth service mode, a single user can be added in self service rules
[IMP] waptservice: cleanup windows PATH on exe startup
[SEC] waptservice: add a openssl.cnf file for win32 exe * to avoid openssl looking in other locations
[SEC] waptservice: disable TLS1 and TLS1.1, disable unsafe ciphers * should comply with CC criteria. * allowed ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:AES256-SHA
[IMP] waptservice: on windows: removed waptScripts * no more useful for pyscripter * waptpython.exe == original python.exe * waptwapt-get == waptpython.exe (for pyscripter “venv”) * python38.pth does _not_ import site anymore to avoid sys.path erroneous guessing in waptparent folder
[SEC] waptservice: restrict service local https server cert validity to 3 days * waptservice is restarted every 24h, cert is recreated on start. * be sure local clients (wapt-get, waptexit, waptself, etc..L.) provide a secret long enough (>64chars)
[IMP] waptservice: don’t check if personal certificate actually exists on disk to enable/disable actions to avoid excessive file accesses on app idle
[IMP] waptservice: We can now only perform Windows Update scans without having to activate waptwua
[FIX] waptservice: be tolearant at socketio clinet create. sometimes, local db is locked when upgrading.
[FIX] waptservice: migrate host_organizational_unit_dn to public db
[FIX] waptservice: server auth for wapt-get build-waptagent * store host_uuid in public db too
[SEC] waptservice: move waptdb.sqlite to agent private dir at startup of service
[NEW] waptservice: add cheeroot requirement for agent.
[FIX] waptservice: store local licencing cache in public DB
[FIX] waptservice: migrate installed package status to publicdb
[SEC] waptservice: core: move waptdb.sqlite into private wapt dir * add a new waptpublicdb.sqlite in waptdb for session-setup * add setuppy and whole control of package in waptpublicdb.sqlite after each successful install * set package removal_date when not available anymore in repository * set uninstall_date when package is removed (uninstalled)
[SEC] waptservice: moved packages cache dir and waptdb.sqlite to private wapt dir. * renamed package_cache_dir to packages_cache_dir
[IMP] waptservice: better handling of server reauthentication when cookie expires. * don’t free the httpclient, just disconnect the socket * don’t clear ClearCachedAuthInfos on failed login as we can have 2 successive attempts with same certificates and keys
[IMP] waptservice: for backward compatibility, stores uuid, hardware_uuid, hostname in private db too
[IMP] waptservice: keep storing setuppy in private local like before the split of private/public local db * for compatibity with older wapt. Allows to revert to old wapt.
[IMP] waptcore: improve display in html templates: waptmustache: HumanBytes is now default in mormot
[NEW] waptcore macos: create /etc/krb5.conf if not exist when call get_domain_info
[FIX] waptcore: distro has changed operation, change of result to find historical behavior
[FIX] waptcore: fix TWaptPackage.ParseCapabilitiesTargetOs target_os ParseComparisonOperators
[SEC] waptcore: remove python uptime unmaintained module
[SEC] waptcore: removed python netifaces unmaintained module
[IMP] waptcore: switch python 3.9.20
[FIX] waptcore: fix for non pure ascii system cacert files (as seen on rocky linux 9) * we load the file ourself in python because openssl is slow reading the cacert store, 2 bytes at a time when using context.load_verify_locations(cafile=cacert_path())
[FIX] waptcore: fix wakeonlan issuers: networking: calc missing broadcast address from ip and netmask * be tolerant if mac is None in DB
[SEC] waptcore: switch to openssl 3.1.7
[IMP] waptcore: add wine based api-ms-win-core-path-l1-1-0.dll for python-3.9 compatibility on windows 7
[FIX] waptcore: uwaptserverconnection: using proper gssapi lib under linux like macOS
[FIX] waptcore: CheckCodeSigned flags set to WTD_CACHE_ONLY_URL_RETRIEVAL
[NEW] waptcore: introduce T7zLib in mormot for compressed file handling
[NEW] waptcore: waptlicences: sz_extract_all function based on T7zLib
[IMP] waptcore: wmi to json: set datetime as ISO8601 in json
[SEC] waptcore: default storage of params is now private only * instead of being public and private by default. * open 2 transactions on both public and private db if public
[NEW] waptcore: introduce “on_connect” audit_schedule option * one can put audit_schedule : on_connect in package control file to trigger the audit on package each time acgent’s websocket is (re)connnected * we can have several audit schedule : audit_schedule : 1h,on_connect
[IMP] waptcore: Wapt.audit(): add ignore_schedule argument
[IMP] waptcore: harden the audit_schedule decoding with a regexp * add bootup_time in waptutils
[IMP] waptcore: better handling of abort status * avoid OSEXC in logs.
[FIX] waptcore: fix MatchOS for generic linux and unix tags.
[SEC] waptcore: wapt-get / waptexit / wapttray : use TLS and token to access local waptservice. * verify local server cert with public/localservice.crt * get simple token with GetLocalServiceToken calling /localtoken * remove use of cookies in wapt-get and waptself * pass token in Bearer auth header instead of Basic header
[FIX] waptcore: PackageRequest: IsMatching function resulting to wrong result if targeting no OS
[FIX] waptcore: djoin: selecting last AD and DC automatically if available
[NEW] waptcore: waptlicences: add wapt_local_json_get helpers. * wapt_local_json_get(action, authtoken, user, password: str, timeoutms:int =-1 ) -> dict * get_wapt_base_dir() -> str * set_wapt_base_dir(adir: str)
[FIX] waptcore: waptutils: makepath with UNC paths
[IMP] waptcore: imporve reconnection after cookie expiration * don’t free HttpClient too early to avoid Access violation in mormot httpclientsocket. use a secondary parallel http server connection to make the actual login * if acls can’t be refreshed, keep previous one. * if acls are nil, just return False in IsUserActionAllowed
[IMP] waptcore: python certifi: use waptlicences.get_system_cabundle_path() if possible on windows * to have a consistent behaviour between fpc code and python code for the where() and windows CA certicates extraction from system store
[IMP] waptcore: improve waptlicences.waptserver_login * optional get_acls * provides optional login_token * improve randomness of temporary client private key password * improve http_keep_alive for waptserver POST * fix potential AV in GetUserToken
[FIX] waptcore: update python4delphi using code from https://github.com/Alexey-T/Python-for-Lazarus * TODO : use directly the Python-for-Lazarus repo and add our patches on top of it.
[FIX] waptcore: update SanitizeFilename * allow @ ( ) * * disallow / “ and #127 (del) * removed unused IsUnsafeFilename * update waptservice localurl to https
[SEC] waptcore: fix password eching on linux console
[UPD] waptcore: calc default private public dirs from wapt_base_dir
[SEC] waptcore: cleanup of PYTHONPATH when starting agent
[SEC] waptcore: improve randomness of GetRandomPassword in waptcommon
[FIX] waptcore: install package with parameters raise FATAL ERROR : AttributeError: ‘Wapt’ object has no attribute ‘execute’
[FIX] waptcore: allow head method with WaptHttpGetString
[FIX] waptcore: Close ldap connection even if bound failed to avoid socket not being reinitialized
[IMP] waptcore: cleanup * make sure we don’t overflow key and value len when decoding control and packages
[IMP] waptcore: On windows, if current user is system account, use <WaptBaseDir>sslservercacert.pem for cacert.pem file path containg extraction of system store certificates. On windows disable address random for debug. close http connection to reauthorize properly (recrete TLS connection)
[IMP] wapt-get: better handling json output format for some actions.
[IMP] wapt-get: improve console output of tasks events
[IMP] wapt-get: wapt-get build-package: set exit code >0 if bad argument.
[IMP] wapt-get: avoid requesting server uuid when building a package locally
[IMP] wapt-get: wapt-get wua actions in service mode (-S) renamed to waptwua-scan, waptwua-download and waptwua-install * for consistency with direct mode
[FIX] wapt-get: using new global var GssLib_Custom for gssapi
[FIX] wapt-get: wapt-get install/remove/audit –service with multiple packages
[FIX] wapt-get: server password utf8 encoding when types from windows command line. * regression: password not sent to server
[UPD] wapt-get: never ask waptservice username * like before
[UPD] wapt-get: don’t ask user if service auth is in ‘nopassword’ mode.
[SEC] wapt-get: allow to authenticate using kerberos (like waptself) * zerofill password after use.
[SEC] wapt-get: sanitize system PATH on windows before loading python engine
[FIX] wapt-get: wapt-get ping asking for auth * introduce GetLoginLocalServiceToken with encrypted file tokens * ask password if not nopassword service_auth_type
[UPD] wapt-get: propose default current user for auth on local service.
[REF] wapt-get: terminate with Terminate+Exit instead of Halt
[FIX] wapt-get: wapt-get as python substitute stdout not redirected * when invoked from vscode for example. * or invoked like “python ascript.py > out.txt”
[IMP] wapt-get: wapt-get: when invoke as python.exe, switch to interactive prompt if not py filename argument provided
[FIX] wapt-get: typo in print
[NEW] wapt-get: add –peercache swicth to wapt-get launcher for waptservice
[UPD] wapt-get: peercache: add some settings. * peercache_enable, peercache_interface, peercache_server_enable peercache_port peercache_secret peercache_broadcast_timeout_ms * add –peercache wapt-get command line switch to start peercache process (for waptservice daemon) * add wapt-get download action in service mode
[FIX] wapt-get: don’t fail in GetWorkgroupName if smb.conf does not exists
[IMP] wapt-get: provide a waptmemcache.WaptMemcacheClient python interface for client connection to a http waptmemcache local server
[FIX] wapt-get: fix return value for wapt_sources_edit
[IMP] wapt-get: initialize logger level and output for wapt-get –shell * add keypassword arg to waptserver_login
[FIX] wapt-get: set-uuid: removed fallback on private db * set ‘uuid’ param in public db
[FIX] wapt-get: remove private db access on session-setup * migrate ‘uuid’ ‘hostname’ ‘hardware_uuid’ params into public db
[FIX] wapt-get: init python sys.path
[FIX] wapt-get: take in account private_dir for get WaptDBPath. * use “:memory:” if waptdb path does not exists * fix. wapt-get action must not be converted to lowercase as it can be a python source code. * takes in account wapt_base_dir key in [global] section of inifile
[FIX] wapt-get: session-setup: use only waptpublicdb.sqlite ans session DBs
[SEC] wapt-get: use wapt-get.exe as python launcher for waptservice to force system Environment.
[FIX] wapt-get: wapt-get.exe as python runner: strip first sys.argv argument since we expect python script to be first argument and not wapt-get.exe
[UPD] wapt-get: vscode package edit: use <wapt>python.exe as python interpreter
[IMP] wapt-get: allow wapt-get.exe to be used as python.exe * if no argument, run an interactive shell * if wapt-get.exe is named waptpython.exe or python.exe, insert first argument in sys.path at position 0
[IMP] waptwua: removed debug print * fix wapt-get waptwua-xxx tasks report
[FIX] waptwua: refactor waptwua to improve install callback. * avoid potential AV at install if intsall progress callback is defined * specific loglevel for waptwua with loglevel_waptwua
[IMP] waptwua: use early binding on COM object rather than late binding using TLB to avoid issues where Microsoft breaks its own COM API (Patch Status: No Data (Error Code: 0x8002802B and 0x80070422))
[FIX] waptwua: iso date for installs history
[IMP] waptwua: pywaptwua: add update_history to get history of windows updates installs
[FIX] waptwua: download_updates parameters
[FIX] waptwua: Missing host certificate usage resulting in 401 errors
[FIX] waptwua: Could not convert variant of type (Null) into type (Date) in WMI case
[FIX] waptconsole: translation for vispackagewizard
[IMP] waptconsole: displays updates date in localized local time
[IMP] waptconsole: waptserverconnection: imporve reconnection on session expiration
[IMP] waptconsole: auditdata html view: add history and selected rows context data
[IMP] waptconsole: html viewer: when duplicating template, use first filename in TemplateFilenames list. * create template directory if possible. * fallback on user roaming directory. * audit data: allow http link to be opened by double click * html: add proxy for images download
[IMP] waptconsole: update host_audit_debian_upgrades.html
[FIX] waptconsole: fix editing host packages when double click in host’s packages grid * or when downloading package to show embedded files.
[NEW] waptconsole: in Embedded HTML templates: add mustache helpers * {{ Join dictorlist[,”,”] }} -> str join dict keys or list values * {{ JoinValues dictorlist, “key”, “sep” }} -> str join dict[key] values. * {{ Get dict,”key”,DefaultValue }} -> get a the value for a key if exists, else defaultvalue * {{ Count dict }}
[FIX] waptconsole: fix regression in html audit data view : “Invalid Variant type cast” * when built with current fpc compiler. * does not occur when compiled with more recent “3.2 fixes” fpc…
[IMP] waptconsole packages dev grid: order by udpate date desc by default. Folder name fixed on left
[NEW] waptconsole: html audit view: add _host context dict with data from focused host for html template.
[FIX] waptconsole: fix uvisupdatepackagesource position saving
[IMP] waptconsole: add a checbox to ignore signer’s certificate validity dates when re-signing packages * check host package signature and section when re-signing a host package. but ignore certificate validity dates.
[FIX] waptconsole: waptserverconnection: recreate connection in case of local client error (666)
[IMP] waptconsole: try to fix audit history panels splitters
[FIX] waptconsole: when editing a package, wrong message “invalid package”
[IMP] waptconsole: allow RustDesk connection even if no password available (it will ask the final user for allowing current connection)
[NEW] waptconsole login: add shortcuts on translated labels * allow –user= in command line * keep supplied user and password when retrying if login failure
[UPD] waptconsole: don’t ask for personal certificate and predifx if not needed * when no right to sign packages or actions in console, no need to ask prefix or user certificate * when for example console is used only as reporting tool.
[NEW] waptconsole: connect via TeamViewer if available
[NEW] waptconsole: connect via RustDesk if available
[NEW] waptconsole: showing encrypted data in host inventory
[FIX] waptconsole: dynamic configurations with peercache
[SEC] waptconsole: CSPN TOE. disable peercache config in cspn_toe mode
[IMP] waptconsole: package edit: allow on_connect, on_disconnect and a list of schedules in audit_schedule control check * add completion. * moved connect/disconnect events handling in the on_xxx of socketio namespace
[GUI] waptconsole : Using a button instead of a label for opening a cert file when asking for trusted cert
[FIX] waptconsole: rules can’t be named wapt
[IMP] waptconsole: reporting: delay in displaying huge data in grid
[NEW] waptconsole: add reachable column in HostsForSoftware panel * allow to trigger actions on connected hosts
[IMP] waptconsole: Wapt python in waptconsole: use :memory: for publicdbpath
[FIX] waptconsole: Package wizard, adding arm/arm64 arch, debian/redhat based and ubuntu target os
[REF] waptconsole: djoin: little refactoring of GUI
[FIX] waptconsole: ACL for Delete unused KB action
[FIX] waptconsole: missing translation for host description change
[NEW] waptconsole: reporting: F4 shortcut to execute the selected query
[NEW] waptconsole: allowing user to skip update
[IMP] waptconsole: fix cyberwatch template
[FIX] waptconsole: enable make package template action
[NEW] waptconsole: dynamic configuration allowing drop certificates on grid
[GUI] waptconsole: showing full windows version and pretty name when available in host WUA tab
[IMP] waptconsole: error message when building a host package
[UPD] waptconsole: enable autosearch on audit tree view filter
[REF] waptconsole: viswuagroup using now DMWaptConsole.StatusImages16
[UPD] waptconsole: enabling check files menu in secondary repositories if reachable
[NEW] waptconsole: include last_audit_status in per-host packages status overview
[IMP] waptconsole: use default tisgrid Ctrl+Del for row deleteion in wads and dev grids
[IMP] waptconsole: sync log memo content depending on packages status grid column
[IMP] waptconsole: be sure to clean temp auth certificates on relogin
[FIX] waptconsole: regression on using a personal private key with password for login * be sure to have safe return values for some getter on waptserverconnection
[IMP] waptconsole: speed deletion on hosts os deploy
[IMP] waptconsole: update-package: save last used settings
[NEW] waptconsole: host packages actions using Don’t Ask Again option
[FIX] waptconsole: small improvements for multi server handling * try to keep last selected server
[FIX] waptconsole: partial fix for waptconsole multiserver: try to keep last used server when starting. * store a “enabled” property in each section of waptconsole.ini * locate server by server_name instead of server_uuid (which wiuld require an initial ping) * TODO: still a race condition issue when loading private key.
[UPD] waptconsole: allow arbitrary maturities when importing packages
[IMP] waptconsole: sorted products and classifications filters on WUA
[FIX] waptconsole: wapconsole acl form: minor fonts typo in grids
[FIX] waptconsole: validate rules grid after saving
[IMP] waptconsole: enhanced rules editing: allow inline grid editing of rules. * todo: restrict columns which can be edited * todo: factorize rules arguments checks in modal form to apply them on inline edit too.
[FIX] waptconsole: SelectWinRe only for windows
[IMP] waptconsole: update_package: inject certificate and private client key to internal WAPT instance * TODO: ask user to confirm as there are security issues with that “feature”. * better provide a WaptServer api with preconfigured auth.
[IMP] waptserver: introduce pymemcache client to share socket sid between process
[SEC] waptserver session lifetime: be sure to reject expired server side session.
[IMP] waptserver : connection: when login, use a temporary server connection with same paramaters as current in memory server connection * don’t read inifile, use LoadFromServer
[FIX] waptserver: set openssl MinProtocol = TLSv1.2 set nginx ssl_protocols TLSv1.2 TLSv1.3;
[NEW] waptserver: add TOTP 2FA support
[FIX] waptserver: Revert “Use TLS1.3 only for nginx on linux”
[FIX] waptserver: secondary repo: missing hostname and main ip
[IMP] waptserver linux: move waptserver-uwsgi logs to a /var/log/waptserver directory
[REF] waptserver: unused endpoints cleanup
[UPD] waptserver index page auth: use conf[‘login_auth_methods’] param instead of hardcoded list
[UPD] waptserver: remote repo wapthttpserver: listening on two port like Nginx
[IMP] waptserver: add logorotate for waptserver-uwsgi
[SEC] waptserver: add a random response time for auth to mitigate account enumeration
[NEW] waptserver: remote repo : introducing wapthttpserver in WAPT based on mORMot2 THttpProxyServer
[NEW] waptserver: waptservice local http: restrict threads and max clients * add gc debug info
[FIX] waptserver wapt user sudoers: override umask for environments where default umak is not 0022
[IMP] waptserver: add memcached recommends for debian. * add pymemcache python module * useful if server side session in uwsgi (to share sessions between processes)
[IMP] waptserver: on linux: add optional server side session with memcached * need manual tweaking after install: - pip install pymemcached - install memcached debian packages.html - define for example session_memcached=127.0.0.1:11211 in waptserver.ini
[IMP] waptserver: be keen on licences.son access issue
[FIX] waptserver: disable server side session if uwsgi mode * because we don’t have yet a shared storage for server side session data
[FIX] waptserver: run waptserver and wapttasks on windows using wapt-get.exe
[SEC] waptserver: server side sessions: setup a filesystem storage in /opt/wapt/conf/sessions
[FIX] waptserver: configure waptserver on windows using wapt-get.exe instead of waptpython
[IMP] waptserver: use server side session with flask-session for waptserver sessions. * production storage still to be decided
[FIX] waptserver: agent server connection: reassign client certificate and key when recreateconnection requested. * we try to not close the socket and recreate full client instance, unless * in case client auth is changed, we need to eventually take them in account so close tls socket and assign new pathes * fixed a memory leak in client certificate check * set default server connection http keepalive to 60s * set redirectmax to 1
[IMP] waptself: removed DoubleBuffered for the waptself flowpanel * better scrolling fluidity on win7 at least
[FIX] waptself: improve behavior when service is not responding
[FIX] waptself: operation not allowed on sorted list when changing language
[GUI] waptself: improving settings behavior
[FIX] waptself: start to check events after checkupgrades has finished
[FIX] waptself: trigger update after authentication * revert icons cache location to public <wapt>cacheicons * avoid loading too often the icons * add a callback when authenticated * add TimeOutMS parameter for TtriggerWaptserviceAction * wapttray: checkupgrades on cancel
[IMP] waptself: don’t free the poll threads on close, to avoid waiting for opened sockets
[FIX] waptself: memory leak in streamed image
[FIX] waptself: translation package details viewer
[IMP] waptself: fix regression and add downgrade action * use package_uuid for packages install/remove * hangle package_uuid for local package action authorization
[IMP] waptself: improve icons download time
[SEC] waptself: zerofill password memory location.
[FIX] waptself: improve authentication for domain users
[IMP] wads: naming properly config file to wapt-get.ini
[NEW] wads: wads & wgetwads: using now config file parameter
[FIX] wads: deployment with login
[FIX] wads: making change_host_wads_status function safer at server side
[IMP] wads: taking care of function failure
[NEW] wads: setting TimeZone and DateTime
[FIX] wads: double set of RequireDerivedFormResource
[NEW] wads: winpe: now loading configuration from dynamic default configuration if available
[IMP] wads: wads import from wapt inventory: use main uuid
[NEW] wads: listing of format scripts to enable its use again
[IMP] wads: letting the user retrying login/password 3 times to avoid restarting the device
[FIX] wads: secondary repos: sort rules by sequence number in GetSecondaryRepo
[FIX] wads: fix wads registration dmi informations
[FIX] wads: handle fallback and reachability tests for secondary repos rules. * still to be tested
[NEW] wads: use WinRE file when making the personalized WinPE, if exists
[IMP] setuphelpers: macos: mount_dmg, install_dmg with new powerful params
[IMP] setuphelpers: introduce check_msi_signature helper in waptlicences module
[IMP] setuphelpers: install_exe_if_needed & install_msi_if_needed timeout 600seconds
[FIX] setuphelpers: fix setuphelpers service_list on linux
[FIX] setuphelpers: incorrect version number return with get_file_properties
[FIX] setuphelpers: PinToTaskbar methods compatible with windows 7
[NEW] setuphelpers: add get_battery_infos() helper
[IMP] setuphelpers: _netfirewallrule() improvements for more accurate prints and adds remote_addresses option
[SEC] setuphelpers: absolute path to msiexec.exe in install_msi_if_needed
[NEW] setuphelpers: Introduce new reg_delete_subkeys in waptutils.py and recursive parameter in registry_deletekey
[SEC] setuphelpers: add absolute path for some windows setuphelpers
[FIX] setuphelpers: detect_file_encoding() was not initialized from setuphelpers
[SEC] setuphelpers: calling absolute path for all run commands
[SEC] setuphelpers: calling absolute path for all run or run_notfatal commands
[IMP] setuphelpers: add run_powershell_script to windows setuphelpers
[IMP] waptsetup: debian waptsetup-gui package: removed xdg-utils, desktop-file-utils depends
[NEW] waptsetup: agent configration and setup: add a checkbox for peercache enable.
[IMP] waptsetup: create waptsetup: check url before trying to ping
[REM] waptsetup: removed German language deletion (translation was not maintained)
[UPD] waptsetup: removed check of wapt-get.exe in old c:wapt

WAPT-2.5 Serie¶

For WAPT 2.5 and before, please refer to archives