[PATCH v2] Embed an application manifest on MinGW

[PATCH v2] Embed an application manifest on MinGW

[Cesar Eduardo Barros]

On Windows Vista, not having an application manifest with a
requestedExecutionLevel can cause several kinds of confusing behavior.

The first and more obvious is Installer Detection, where sometimes
Windows decides (by looking at things like the file name and even
sequences of bytes within the executable) that an executable is an
installer and should run elevated (causing the well-known popup dialog
to appear). On git, this happens for executables with names containing
"patch" or "update".

The second and more confusing is File Virtualization. With it, writes to
some files which should fail are instead redirected to somewhere else,
and reads to files might return different contents if a previous write
was redirected. Even more confusing, not all writes are redirected; I
recall reading somewhere that for instance writes to .exe files will
fail instead of redirecting.

Needless to say, git wants none of that. Not only that, but File
Virtualization has been blamed for dramatic slowdowns in git (see for
instance http://code.google.com/p/msysgit/issues/detail?id=320).

There are two ways to turn off these annoyances. Either you embed an
application manifest within all your executables, or you add an external
manifest (a file with the same name followed by .manifest) to all your
executables. Since for git some executables are copied (or hardlinked)
with several names, it is simpler and more robust to embed an internal
manifest.

A recent enough MSVC compiler should already embed a working internal
manifest, but for mingw you have to do so by hand.

Very lightly tested on Wine, where like on Windows XP it should not make
any difference.

References:
  - New UAC Technologies for Windows Vista
    http://msdn.microsoft.com/en-us/library/bb756960.aspx
  - Create and Embed an Application Manifest (UAC)
    http://msdn.microsoft.com/en-us/library/bb756929.aspx

v2: Create GITLIBDEPS and use it instead of GITLIBS. RESOURCE_OBJS
    cannot be added directly to GITLIBS because it would add the
    manifest twice to executables which use $(filter %.o,$^) in the
    Makefile rule (since LIBS also includes GITLIBS).

Signed-off-by: Cesar Eduardo Barros <cesarb@cesarb.net>
---
 Makefile                  |   31 +++++++++++++++++++++++--------
 compat/win32/git.manifest |   11 +++++++++++
 compat/win32/resource.rc  |    1 +
 3 files changed, 35 insertions(+), 8 deletions(-)
 create mode 100644 compat/win32/git.manifest
 create mode 100644 compat/win32/resource.rc

diff --git a/Makefile b/Makefile
index b2e1759..da371c2 100644
--- a/Makefile
+++ b/Makefile
@@ -324,6 +324,7 @@ XGETTEXT = xgettext
 PTHREAD_LIBS = -lpthread
 PTHREAD_CFLAGS =
 GCOV = gcov
+WINDRES = windres
 
 export TCL_PATH TCLTK_PATH
 
@@ -344,6 +345,7 @@ BUILTIN_OBJS =
 BUILT_INS =
 COMPAT_CFLAGS =
 COMPAT_OBJS =
+RESOURCE_OBJS =
 EXTRA_CPPFLAGS =
 LIB_H =
 LIB_OBJS =
@@ -786,6 +788,8 @@ BUILTIN_OBJS += builtin/write-tree.o
 GITLIBS = $(LIB_FILE) $(XDIFF_LIB)
 EXTLIBS =
 
+GITLIBDEPS = $(RESOURCE_OBJS) $(GITLIBS)
+
 #
 # Platform specific tweaks
 #
@@ -1181,6 +1185,7 @@ ifneq (,$(findstring MINGW,$(uname_S)))
 	NO_INET_PTON = YesPlease
 	NO_INET_NTOP = YesPlease
 	NO_POSIX_GOODIES = UnfortunatelyYes
+	APPLICATION_MANIFEST = YesPlease
 	COMPAT_CFLAGS += -D__USE_MINGW_ACCESS -DNOGDI -Icompat -Icompat/win32
 	COMPAT_CFLAGS += -DSTRIP_EXTENSION=\".exe\"
 	COMPAT_OBJS += compat/mingw.o compat/winansi.o \
@@ -1575,6 +1580,11 @@ ifdef USE_NED_ALLOCATOR
        COMPAT_OBJS += compat/nedmalloc/nedmalloc.o
 endif
 
+ifdef APPLICATION_MANIFEST
+	# Cannot be in LIB_OBJS because it must always be linked in
+	RESOURCE_OBJS += compat/win32/resource.o
+endif
+
 ifdef GIT_TEST_CMP_USE_COPIED_CONTEXT
 	export GIT_TEST_CMP_USE_COPIED_CONTEXT
 endif
@@ -1610,6 +1620,7 @@ ifndef V
 	QUIET_LNCP     = @echo '   ' LN/CP $@;
 	QUIET_XGETTEXT = @echo '   ' XGETTEXT $@;
 	QUIET_GCOV     = @echo '   ' GCOV $@;
+	QUIET_WINDRES  = @echo '   ' RC $@;
 	QUIET_SP       = @echo '   ' SP $<;
 	QUIET_SUBDIR0  = +@subdir=
 	QUIET_SUBDIR1  = ;$(NO_SUBDIR) echo '   ' SUBDIR $$subdir; \
@@ -1711,9 +1722,9 @@ git.sp git.s git.o: EXTRA_CPPFLAGS = -DGIT_VERSION='"$(GIT_VERSION)"' \
 	'-DGIT_MAN_PATH="$(mandir_SQ)"' \
 	'-DGIT_INFO_PATH="$(infodir_SQ)"'
 
-git$X: git.o $(BUILTIN_OBJS) $(GITLIBS)
+git$X: git.o $(BUILTIN_OBJS) $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ git.o \
-		$(BUILTIN_OBJS) $(ALL_LDFLAGS) $(LIBS)
+		$(BUILTIN_OBJS) $(RESOURCE_OBJS) $(ALL_LDFLAGS) $(LIBS)
 
 help.sp help.o: common-cmds.h
 
@@ -2011,17 +2022,17 @@ compat/nedmalloc/nedmalloc.sp compat/nedmalloc/nedmalloc.o: EXTRA_CPPFLAGS = \
 	-DNDEBUG -DOVERRIDE_STRDUP -DREPLACE_SYSTEM_ALLOCATOR
 endif
 
-git-%$X: %.o $(GITLIBS)
+git-%$X: %.o $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) $(LIBS)
 
-git-imap-send$X: imap-send.o $(GITLIBS)
+git-imap-send$X: imap-send.o $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) \
 		$(LIBS) $(OPENSSL_LINK) $(OPENSSL_LIBSSL) $(LIB_4_CRYPTO)
 
-git-http-fetch$X: revision.o http.o http-walker.o http-fetch.o $(GITLIBS)
+git-http-fetch$X: revision.o http.o http-walker.o http-fetch.o $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) \
 		$(LIBS) $(CURL_LIBCURL)
-git-http-push$X: revision.o http.o http-push.o $(GITLIBS)
+git-http-push$X: revision.o http.o http-push.o $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) \
 		$(LIBS) $(CURL_LIBCURL) $(EXPAT_LIBEXPAT)
 
@@ -2031,10 +2042,14 @@ $(REMOTE_CURL_ALIASES): $(REMOTE_CURL_PRIMARY)
 	ln -s $< $@ 2>/dev/null || \
 	cp $< $@
 
-$(REMOTE_CURL_PRIMARY): remote-curl.o http.o http-walker.o $(GITLIBS)
+$(REMOTE_CURL_PRIMARY): remote-curl.o http.o http-walker.o $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) \
 		$(LIBS) $(CURL_LIBCURL) $(EXPAT_LIBEXPAT)
 
+%.o: %.rc
+	$(QUIET_WINDRES)$(WINDRES) $< $@
+compat/win32/resource.o: compat/win32/git.manifest
+
 $(LIB_FILE): $(LIB_OBJS)
 	$(QUIET_AR)$(RM) $@ && $(AR) rcs $@ $(LIB_OBJS)
 
@@ -2172,7 +2187,7 @@ test-svn-fe$X: vcs-svn/lib.a
 
 .PRECIOUS: $(TEST_OBJS)
 
-test-%$X: test-%.o $(GITLIBS)
+test-%$X: test-%.o $(GITLIBDEPS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) $(filter %.a,$^) $(LIBS)
 
 check-sha1:: test-sha1$X
diff --git a/compat/win32/git.manifest b/compat/win32/git.manifest
new file mode 100644
index 0000000..a82605c
--- /dev/null
+++ b/compat/win32/git.manifest
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+	<assemblyIdentity type="win32" name="Git" processorArchitecture="x86" version="0.0.0.0" />
+	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
+		<security>
+			<requestedPrivileges>
+				<requestedExecutionLevel level="asInvoker" uiAccess="false" />
+			</requestedPrivileges>
+		</security>
+	</trustInfo>
+</assembly>
diff --git a/compat/win32/resource.rc b/compat/win32/resource.rc
new file mode 100644
index 0000000..c2bf4a6
--- /dev/null
+++ b/compat/win32/resource.rc
@@ -0,0 +1 @@
+1 24 "git.manifest"
-- 
1.7.4.4

Re: [PATCH v2] Embed an application manifest on MinGW

[Johannes Schindelin]

Dear Cesar,

On Thu, 2 Jun 2011, Cesar Eduardo Barros wrote:

> v2: Create GITLIBDEPS and use it instead of GITLIBS. RESOURCE_OBJS
>     cannot be added directly to GITLIBS because it would add the
>     manifest twice to executables which use $(filter %.o,$^) in the
>     Makefile rule (since LIBS also includes GITLIBS).

This is still changing too much for my liking (and if I were to accept 
the introduction of GITLIBDEPS as an elegant solution, it would have to be 
a separate patch anyway).

I may get some time in a week to play with the issue myself,
Johannes

Re: [PATCH v2] Embed an application manifest on MinGW

[Junio C Hamano]

Does the output from $WINDRES define any external symbol the rest of the
code can refer to?  If so, you could throw resource.o into one of the .a
file and make sure that the symbol is referred to from main(); perhaps the
definition of main in compat/mingw.h can refer to it.

If you can do that, you wouldn't need any change to the Makefile other
than the rule to build compat/win32/resource.o and conditionally add that
object to LIB_OBJS, perhaps like this (obviously untested as I do not have
access to windows boxes).

 Makefile |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/Makefile b/Makefile
index cbc3fce..0a18e56 100644
--- a/Makefile
+++ b/Makefile
@@ -320,6 +320,7 @@ XGETTEXT = xgettext
 PTHREAD_LIBS = -lpthread
 PTHREAD_CFLAGS =
 GCOV = gcov
+WINDRES = windres
 
 export TCL_PATH TCLTK_PATH
 
@@ -1169,6 +1170,7 @@ ifneq (,$(findstring MINGW,$(uname_S)))
 	NO_INET_PTON = YesPlease
 	NO_INET_NTOP = YesPlease
 	NO_POSIX_GOODIES = UnfortunatelyYes
+	LIB_OBJS += compat/win32/resource.o
 	COMPAT_CFLAGS += -D__USE_MINGW_ACCESS -DNOGDI -Icompat -Icompat/win32
 	COMPAT_CFLAGS += -DSTRIP_EXTENSION=\".exe\"
 	COMPAT_OBJS += compat/mingw.o compat/winansi.o \
@@ -1580,6 +1582,7 @@ ifndef V
 	QUIET_LNCP     = @echo '   ' LN/CP $@;
 	QUIET_XGETTEXT = @echo '   ' XGETTEXT $@;
 	QUIET_GCOV     = @echo '   ' GCOV $@;
+	QUIET_WINDRES  = @echo '   ' WINDRES $@;
 	QUIET_SUBDIR0  = +@subdir=
 	QUIET_SUBDIR1  = ;$(NO_SUBDIR) echo '   ' SUBDIR $$subdir; \
 			 $(MAKE) $(PRINT_DIR) -C $$subdir
@@ -2022,6 +2025,10 @@ $(REMOTE_CURL_PRIMARY): remote-curl.o http.o http-walker.o $(GITLIBS)
 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) \
 		$(LIBS) $(CURL_LIBCURL) $(EXPAT_LIBEXPAT)
 
+%.o: %.rc
+	$(QUIET_WINDRES)$(WINDRES) $< $@
+compat/win32/resource.o: compat/win32/git.manifest
+
 $(LIB_FILE): $(LIB_OBJS)
 	$(QUIET_AR)$(RM) $@ && $(AR) rcs $@ $(LIB_OBJS)
 

Re: [PATCH v2] Embed an application manifest on MinGW

[Cesar Eduardo Barros]

Em 02-06-2011 13:27, Junio C Hamano escreveu:
> Does the output from $WINDRES define any external symbol the rest of the
> code can refer to?  If so, you could throw resource.o into one of the .a
> file and make sure that the symbol is referred to from main(); perhaps the
> definition of main in compat/mingw.h can refer to it.

Unfortunately no:

$ i686-pc-mingw32-nm compat/win32/resource.o
00000000 d .rsrc

The only thing it has is the .rsrc section.

I could perhaps create a dummy C file with a dummy variable, compile it, 
and use incremental linking (ld -r) to bolt both object files together. 
I am not sure this hack wouldn't be uglier than the Makefile changes.

Another possibility would be a linker script (like /usr/lib/libc.so on 
modern distributions). This might be the most elegant option if it 
works. I will have to take a look on how it works to see if it is a 
viable alternative.

> If you can do that, you wouldn't need any change to the Makefile other
> than the rule to build compat/win32/resource.o and conditionally add that
> object to LIB_OBJS, perhaps like this (obviously untested as I do not have
> access to windows boxes).

You do not need access to Windows boxes, you can always use Wine ;-) 
(msysgit even has a script to open a shell under Wine with everything 
set up).

-- 
Cesar Eduardo Barros
cesarb@cesarb.net
cesar.barros@gmail.com