[RESOLVED] Uppate_package functionality

[Kevin-LH76]

Hello,

We are currently implementing the WAPT 2.6 Enterprise solution and I have a few questions about certain functions, so I can't find the answers in the documentation.

Regarding the `update_package` function, where and how does it run? Is it possible to schedule it?

If I understand correctly, this function is only a check and necessarily requires human intervention to deploy the update?

Is there a way to automate updates for certain packages, particularly those in your store?

I understand the risk associated with a deployment without human oversight, but for software where updates are very frequent and regularly fix vulnerabilities, waiting for human intervention can itself be a vulnerability.

Thank you in advance for your feedback.

[sfonteneau]

We are currently implementing the WAPT 2.6 Enterprise solution and I have a few questions about certain functions, so I can't find the answer in the documentation.

Regarding the update_package function, where and how does it run? Is it possible to schedule it?

The function is executed within the session of the person who launched it, so very often an administrator

If I understand correctly, this function is only a check and necessarily requires human intervention to deploy the update?

She connects to the publisher's website to download a new version if available.

Also available via command line:

wapt-get update-package-sources c:\waptdev\tis-firefox

Is there a way to automate updates for certain packages, especially those in your store?

I understand the risk associated with deployment without human oversight, but for software where updates are very frequent and regularly fix vulnerabilities, waiting for human intervention can itself be a vulnerability.

We do not offer it by default intentionally to avoid a "minor security update" like the "crowdstrike" which would automatically crash an entire park with a blue screen, for example.

If you really want to do it, create a script on a Windows machine:

Code: Select all

wapt-get update-package-sources c:\waptdev\tis-firefox
wapt-get wapt-get -i build-upload  c:\waptdev\tis-firefox -w C:\pwd-waptdev.txt --wapt-server-passwd=password --wapt-server-user=admin

[Kevin-LH76]

Can this script run on a Linux machine?

We were thinking of running it on the WAPT server, at least for the Defender package, as it receives updates very regularly.

[sfonteneau]

Can this script run on a Linux machine?

Yes and no

Actually, it depends on the package code.

If, for example, the code calls get_msi_properties, then no, because this function is not available under Linux.

The reverse is also true if the code was designed to run only under Linux

[Fred-LH76]

Hello,

the idea would be to run the update-package Python script on the server at regular intervals to keep the package as up-to-date as possible (Windows Defender, to be precise). This works through the WAPT interface, but Microsoft updates it regularly.

Regards

[florentR2]

If you really want to do it, create a script on a Windows machine:

Code: Select all

wapt-get update-package-sources c:\waptdev\tis-firefox
wapt-get wapt-get -i build-upload  c:\waptdev\tis-firefox -w C:\pwd-waptdev.txt --wapt-server-passwd=password --wapt-server-user=admin

Good morning,
Does the proposed code perform the upload regardless of the result, or only if there is indeed an update?

[sfonteneau]

This test:

Code: Select all

from waptpackage import PackageEntry
from setuphelpers import *

folder_wapt = r'c:\waptdev\tis-test_0_PROD-wapt'

f = PackageEntry(waptfile=folder_wapt)
old_version = f.version

run('wapt-get update-package-sources "%s" --no-ide' % folder_wapt)

n = PackageEntry(waptfile=folder_wapt)
if old_version != n.version:
    run('wapt-get wapt-get -i build-upload  c:\waptdev\tis-firefox -w C:\pwd-waptdev.txt --wapt-server-passwd=password --wapt-server-user=admin -c c:\Users\username\AppData\Local\waptconsole\waptconsole.ini')

[Kevin-LH76]

Is your code meant to be placed in an audit function of a scheduled package (audit_schedule)?

In your code, there's `password=password`; is it possible to avoid putting the password in plain text?

[sfonteneau]

Not to be included in an audit package

Put this in a .py file and run it with Python, for example:

Code: Select all

wapt-get script.py

That's all


For the password, you can modify the code for the password in a file, for example

[Kevin-LH76]

So the agent needs to be installed on the machine running the script?

In all cases, is the password hardcoded into a file?

Can we run it directly on our WAPT server, which is running Red Hat?