Bug 690143

Summary: "setupgs.exe" inside "gs863w32.exe" writes Registry values that are not removed upon uninstall
Product: Ghostscript Reporter: Jacob Schäffer <js>
Component: Config/InstallAssignee: Henry Stiles <henry.stiles>
Status: RESOLVED WORKSFORME    
Severity: normal CC: gsview, sphinx.pinastri
Priority: P4    
Version: 8.63   
Hardware: PC   
OS: Windows XP   
Customer: Word Size: ---
Attachments: CSV formatted tracelog

Description Jacob Schäffer 2008-10-29 06:08:51 UTC 
In an attempt to write a custom MSI installer for GS 8.63 I've just run a 
tracelog of the registry actions performed by the default GS installer.

To my surprise the tracelog (from sysinternals Process Monitor) indicates that 
the Operation RegSetValue is triggered 8 times on the following item:

HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Why does that happen?

Best regards / Med venlig hilsen
Jacob Schäffer  |  Chief Developer
Paradis Allé 22, Ramløse
DK-3200 Helsinge, Denmark
Phone: +45 4439 4400
Email: js@grafikhuset.dk
Web: www.grafikhuset.net
Comment 1 Jacob Schäffer 2008-10-29 06:10:22 UTC 
Created attachment 4556 [details]
CSV formatted tracelog
Comment 2 Hin-Tak Leung 2010-06-08 22:51:36 UTC 
The new NSIS-based installer (bug 691363) does remove registry entries it adds, AFAIK.

It is true that the current winzipse-based installer does not remove registry entries on uninstall, I believe.
Comment 3 Hin-Tak Leung 2010-06-08 23:08:27 UTC 
setupgs.exe requires privilege escalation to gain admin privilege to write to "C:\Program Files\gs", at least under Vista and win 7
(See also Bug 691302 and http://bugs.ghostscript.com/show_bug.cgi?id=691363#c4).
That likely involves invoking windows's crypto API, and therefore need to manipulate Crypto RNG Seed.

Two things you can try is (1) see if the NSIS-installer (which also tries to gain admin privilege to write to %PROGRAMFILES%) behaves the same way, (2) comment out the two "mt.exe" commands in psi/*.mak while building setupgs.exe, uninstallgs.exe to strip the privilege escalation, to see if the result still access those keys.
Comment 4 Peter Cherepanov 2021-01-01 19:37:05 UTC 
Windows 7 and 10 no longer have this key, but Ghostscript installs just fine. According to the net, this key was used to collect entropy. It was updated by most ordinary applications, such as notepad.exe .