Skip to content

[v18] Connect: dual installer mode on Windows, updates config in system registry, privileged updater service, no downgrade policy#65173

Open
gzdunek wants to merge 11 commits intobranch/v18from
gzdunek/backport-connect-windows-installer/v18
Open

[v18] Connect: dual installer mode on Windows, updates config in system registry, privileged updater service, no downgrade policy#65173
gzdunek wants to merge 11 commits intobranch/v18from
gzdunek/backport-connect-windows-installer/v18

Conversation

@gzdunek
Copy link
Copy Markdown
Contributor

@gzdunek gzdunek commented Mar 30, 2026 •
edited by ravicious
Loading

Backport #63132, #62910, #63281, #63187, #63572, #63573, #64438, #64754, #64905 (partially), #65170, #65267 (partially) to branch/v18

(separate changelog entries since multiline changelogs are not allowed)

changelog: Added support for both per-machine and per-user installations in Teleport Connect on Windows (Note: VNet is unavailable in per-user mode)
changelog: Enabled silent automatic updates for Teleport Connect per-machine installations on Windows; elevated privileges are now only required during the initial setup
changelog: Deprecated the TELEPORT_CDN_BASE_URL and TELEPORT_TOOLS_VERSION environment variables for configuring Teleport Connect Windows updates. These must now be managed via system policy registry keys under HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\SOFTWARE\Policies\Teleport\TeleportConnect. The environment variables are still read for compatibility, but per-machine updates may require UAC prompts until configuration is migrated to registry policy keys
changelog: Automatic updates in Teleport Connect no longer allow app version downgrades (applies to all platforms)

I was initially planning to merge it to v17 too but it would require backporting other PRs, like the one that switches VNet Service logs to Windows Event Viewer. It's probably not worth the effort, also because v17 goes EoL in ~ 4 months.

Manual Test Plan

Test Environment

A Windows computer, a dev build from this branch (18.7.0-dev.gzdunek.1).

Test Cases

  • Installed Teleport Connect 18.6.8, set automatic updates in the cluster to the tag build version, and TELEPORT_CDN_BASE_URL to the dev CDN. The app requests UAC and successfully updates to the new per-machine version.
  • Set automatic updates in the cluster to 19.0.0-prealpha.2. Verified that 18.7.0-dev.gzdunek.1 silently updated to the that version.
    • Verified for both per-machine and per-user installations.
    • Verified the update is applied on both 'Restart' click and closing the app.
    • Verified if updating to the production build (18.7.3) works.
  • The app reads the deprecated env var config and informs that installing an update will require admin credentials (in case of per-machine installation).
  • The per-user installation reads policies in HKCU and HKLM.
  • The per-machine installation reads policies only in HKLM.
  • VNet is available only in the per-machine version.
  • If the version of the VNet service doesn't match the version of the app, the app gracefully displays an error message.

gzdunek and others added 10 commits March 30, 2026 14:46
@gzdunek
Make Windows Service setup reusable (#63132)
afc529b 
* Extract reusable function for service installation

* Move `install_service_windows.go` to `lib/windowsservice`

* Reintroduce `vnet/install_service_windows.go`

* Make service runner reusable

* Add missing service description and returns on error

* Log service name when installing/uninstalling

* Rename files

* Put `err` first

(cherry picked from commit 845caf9)
@gzdunek
Connect: switch Windows installer to dual mode (#62910)
df413a5 
* Switch installer to dual-mode

* Customize NSIS updater to disallow attempts to update per-machine installations if update is triggered from per-user instance

* Make `assertTshInProgramFiles` more strict

Reading Program Files path should be done using Windows API instead of env var that can be overridden.

* Add RPC to check if VNet service is installed

* Show warning and disable auto-start if there is no VNet service

* `GetWindowsSystemService` -> `CheckPreRunRequirements`

* `CheckPreRunRequirements` -> `CheckInstallTimeRequirements`

* Customize `forAll` option with VNet message

* Check for per-machine installation in system registry

* Fix vars with PreRun in the name

* Link to source file from the electron-builder repo, add commit hash

* Read per-machine location from Go instead of via PowerShell

* `IsPerMachineInstallResponse` -> `GetInstallationMetadataResponse`

* Define `GetInstallationMetadata` handler in separate file

* Fix tests failing on "updates not wrapped into act"

(cherry picked from commit 336379e)
@gzdunek
Connect: read automatic updates configuration from Windows registry (#…
20db6f1 
…63281)

* Replace `GetDownloadBaseUrl` RPC with `GetConfig`

* Implement reading ToolsVersion and CdnBaseUrl from system registry

* Read values from `getConfig()` instead of `getDownloadBaseUrl` and `process.env`

* Use UAC updater when app is configured with env vars

* Fix typos

* Handle tools version being 'off'

* Safely read values from `GetConfigResponse`

* Fix ordering in proto

* Non-official -> Unofficial

* Add TODO about docs

* Use switch-case instead of if-else

* Bring back if-else

(cherry picked from commit 34c0795)
@gzdunek
Connect: allow only version upgrades in automatic updates (#63187)
762175c 
* Disallow downgrades

* Improve "update-not-available" state

* Fix title casing

* Add test for downgrades

* Ensure app version is greater than update version in test

* Bring back `UpdateInfo` interface to avoid unnecessary conflicts with other PRs

(cherry picked from commit 6b70cbf)
@gzdunek
Connect: add privileged updater service (#63572)
38dfacd 
* Add privileged updater service

* Add integration tests for updater

* Review fixes

* Move privileged updater to its own module

* Fix comments

* Interpolate registry pathnames, switch errors to AccessDenied

* Improve error handling in `waitForSingleClient`

* Use stricter DACL for named pipe

* Close `conn` on context cancellation

* Move reading update meta to separate function

* `trace.LimitExceeded` -> `trace.Errorf`

* Fix test

* Ensure updater only allows HTTPS

* Use TLS server in tests

* Fix tests

(cherry picked from commit ad36d4e)
@gzdunek
Connect: install updates via privileged service, add signature verifi…
aa885cc 
…cation (#63573)

* Add service commands to tsh

* Install updater service and run updates through it

* Add signature verification

* Disable CTMU for `tsh.exe connect-updater-install-update`

* Force install mode when migrating from one-click to assisted multi-user

* Spawn `tsh.exe connect-updater-install-update` synchronously and catch errors

* Use single parent command, remove args from `service.Start`

* Do not ignore error from closing handle

* Grammar fixes

* Use single command in installer.nsh too

* Use `svc.IsWindowsService()` instead of `isWindowsService`

* Switch from `CertCompareCertificateName` to comparing subject properties

* Log certs if they don't match

* Improve comment

(cherry picked from commit b3adaff)
@gzdunek
Connect: gracefully handle VNet service and app version mismatch (#64438
6c24b95 
)

* Add `VERSION_MISMATCH` status to `WindowsServiceStatus`

* Show error in UI

* Verify service compatibility with client

* Fix outdated comment

* Remove unnecessary stories

* Move `VerifyServiceInstalledAndMatchesClient` to separate file

(cherry picked from commit 030e483)
@gzdunek
Connect: verify signature in privileged updater against hardcoded Win…
9276e27 
…dows signing cert (#64754)

* Make `verifySignature` compare subject against fixed cert

* Adjust tests

* Update README.md

(cherry picked from commit c0a66f3)
@gzdunek
Backport docs link from #64905
3b127f3
@gzdunek
Connect: fix failing fresh silent NSIS installs (#65170)
4171040 
* Fix failing fresh silent NSIS installs

* Ensure DACL is non-empty

(cherry picked from commit 3c7d18d)
@github-actions github-actions Bot added backport size/xl tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ui labels Mar 30, 2026
@github-actions github-actions Bot requested review from nklaassen and ravicious March 30, 2026 13:24
@gzdunek gzdunek mentioned this pull request Mar 31, 2026
Open
@gzdunek
Connect: Improve docs about dual-mode installations (#65267)
dcd675b 
* Connect: Improve docs about dual-mode installations

* Fix path

* Clarify app uninstalling

(cherry picked from commit 328db2c)
@public-teleport-github-review-bot
Copy link
Copy Markdown

public-teleport-github-review-bot Bot commented Apr 17, 2026

@gzdunek - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

1 similar comment
@public-teleport-github-review-bot
Copy link
Copy Markdown

public-teleport-github-review-bot Bot commented Apr 17, 2026

@gzdunek - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

@gzdunek gzdunek requested a review from zmb3 April 17, 2026 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ravicious ravicious ravicious approved these changes

@zmb3 zmb3 zmb3 approved these changes

@nklaassen nklaassen nklaassen approved these changes

Assignees

No one assigned

Labels

backport hold-for-18.8 size/xl tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ui

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@gzdunek @ravicious @zmb3 @nklaassen