Component's GUID Across Updates

[hollowaykeanho]

Given A <Component>'s Guid field which requested unique UUID for each of them, between 2 different MSI version upgrades (e.g. Product v.1.0.0 vs v.1.2.0), should they be unique like Product GUID or stay the same like Product's upgrade code?

Context:

I'm currently developing a multi packagers CI automation tool. Wix4 requested to make each component to have unique Guid but did not specify whether it's persistent across upgrade versions. On automation tool side, it can be either cryptographically generate the GUID each time or prepare some kind of config file to house those GUIDs.

References:

[1] - Component Specs - https://wixtoolset.org/docs/schema/wxs/component/
[2] - CI failure - https://github.com/corygalyna/AutomataCI/actions/runs/7040752780/job/19162212043 (Windows - Package failure)

[chrpai]

Generally they should be the same versions. Especially if you intend to support minor upgrades or patching. Major Upgrades can give you a lot more flexibility if you schedule remove existing products really early on.

Have you considered authoring the wxs without guids and ids? I maintain a FOSS project called IsWiX and in v4 I don't author these unless I have to. See:

https://github.com/iswix-llc/iswix/blob/main/Installer/IsWiX/IsWiXLib.wxs

For a higher level view of what IsWiX is see https://github.com/iswix-llc/iswix-tutorials

[hollowaykeanho]

Thanks for the fast support, @chrpai. =)

Have you considered authoring the wxs without guids and ids?

Yeap but the tool I'm building supports cross-platform so it's outside of Visual Studio (besides, folks using VS should be taken good care by MSFT already). I'm on the wix build side at the moment generating the wxs file.

[chrpai]

@hollowaykeanho wix v4 isn't limited to Visual Studio.

[hollowaykeanho]

a moment... I thought the github you shared was the .wixproj direction? (Ref: IsWiX.wixproj) I mean, somewhere in the docs mentioned that Wix4 is heavily integrated into Visual Studio's .Net library compilation.

Please correct me if I'm wrong. I'm not quite familiar with MSI packager. Been stuck for 5 weeks R&D =.="

wix v4 isn't limited to Visual Studio.

Yeah.. fortunately. Am happy they moved to .Net. Hopefully they can make it available for non-Windows' environment (linux and darwin OSes) for UI.

[hollowaykeanho]

Also, isn't the Wix4 document specifically mentions that the Component must have unique (and now persistent) GUID to avoid a security vulnerability (Ref (Guid sub-section): https://wixtoolset.org/docs/schema/wxs/component/)? Am I missing something out?

If you ask for my personal opinion, I obviously do not want to keep too many GUID confusing everyone. ID is okay. Like, I'm curious what's the protection benefits at component level when Product GUID and Upgrade Code is already made available. The scariest part is Component is user (developer) customizable so the probable combination is close to infinite possibilities.