Visual Studio 2015 Enterprise 脱机安装失败 [英] Visual Studio 2015 Enterprise Offline Installation Fails

问题描述

我正在尝试评估 Visual Studio 2015 Enterprise，但在安装过程中遇到了一些问题.这是我所做的:

I'm attempting to evaluate Visual Studio 2015 Enterprise, but have encountered some trouble during installation. Here's what I did:

1. 使用 /layout 开关下载完整的安装.
2. 使用 /NoWeb 开关启动安装.

1. Download the complete installation by using the /layout switch.
2. Launch the installation with the /NoWeb switch.

我为此使用了一个干净的 Windows 8.1 虚拟机，以免弄乱我的主机系统.虚拟机未连接到网络.

I am using a clean Windows 8.1 virtual machine for this purpose, so as not to mess up my host system. The virtual machine is not connected to a network.

安装失败，日志中有以下条目:

The installation fails with the following entries in the log:

MUX:  ExecuteError: Package (VSSecondaryInstaller_box) failed: Error Message Id: 1603 ErrorMessage: Visual Studio Extensibility Item Templates with Assembly References in Nuget Packages : This product did not download successfully: Unable to download 'http://go.microsoft.com/fwlink/?LinkId=558768'.  Web downloads are not allowed when the /NoWeb switch is used.
MUX:  ExecuteError: Package (VSSecondaryInstaller_box) failed: Error Message Id: 1603 ErrorMessage: GitHub Extension for Visual Studio : This product did not download successfully: Unable to download 'http://go.microsoft.com/fwlink/?LinkId=616986'.  Web downloads are not allowed when the /NoWeb switch is used.
MUX:  ExecuteError: Package (VSSecondaryInstaller_box) failed: Error Message Id: 1603 ErrorMessage: PowerShell Tools for Visual Studio : This product did not download successfully: Unable to download 'http://go.microsoft.com/fwlink/?LinkID=616995'.  Web downloads are not allowed when the /NoWeb switch is used.

我注意到这些是安装程序中仅有的 VSIX 包.当然，我可以手动安装这些软件包，但我想了解此错误的原因.

I have noticed that these are the only VSIX packages in the installer. I could, of course, install these packages manually, but I want to understand the reason for this error.

有什么想法吗?

推荐答案

Intro

好吧，一周后我想通了，我有了解决方案.请记住，这有点陈旧，如果 Microsoft 决定更新其安装程序，则可能会失败.

Intro

Well, a week later I have figured it out and I have a solution. Bear in mind that this is a bit hacky and may fail if and when Microsoft decides to update their installer.

但首先，我们必须了解问题的根源.

But first, we have to understand the source of the problem.

正如我在问题中提到的，安装日志指出由于 /noweb 开关，它无法下载 VSIX 包.在这一点上一个合理的问题是为什么安装程序首先尝试下载它们.

As I mentioned in the question, the installation log states that it failed to download the VSIX packages because of the /noweb switch. A reasonable question at this point is why was the installer trying to download them in the first place.

要回答这个问题，我们必须查看辅助安装程序日志(dd_vs_enterprise__SecondaryInstaller_UX.log，位于 %temp% 目录中).据我了解，Secondary Installer 负责安装 Visual Studio 附带的所有额外包.这个日志稍微澄清了图片.

To answer that, we have to look in the Secondary Installer log (dd_vs_enterprise_<timestamp>_SecondaryInstaller_UX.log, inside the %temp% directory). As I understand it, the Secondary Installer is responsible for installing all of the extra packages that come with Visual Studio. This log clarifies the picture a little.

DownloadManager Information: 0 : Using cached file at C:\ProgramData\Microsoft\VisualStudioSecondaryInstaller\14.0\installers\VS_Extensibility_TemplatesV1\en\0\Microsoft.Vsix.TemplatesPackage.vsix instead of downloading from http://go.microsoft.com/fwlink/?LinkId=558768
DownloadManager Error: 0 : Signature verification failed on downloaded file. URL: http://go.microsoft.com/fwlink/?LinkId=558768. File location: C:\ProgramData\Microsoft\VisualStudioSecondaryInstaller\14.0\installers\VS_Extensibility_TemplatesV1\en\0\Microsoft.Vsix.TemplatesPackage.vsix. File size: 3965 kb
DownloadManager Error: 0 : BITS download failed. Exception: System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.Web.PlatformInstaller.InstallManager.BITSDownloadInstallerFile(InstallerContext currentInstall, String& failureReason, String& failureErrorCode, Boolean& downloadNotAllowed, Boolean setFinalReturnState)
DownloadManager Warning: 0 : BITS failure: BITS download failed. BITS service may have been disabled on the machine.. Retrying download for 'Visual Studio Extensibility Item Templates with Assembly References in Nuget Packages'
DownloadManager Warning: 0 : WinInet failure: Unable to download 'http://go.microsoft.com/fwlink/?LinkId=558768'.  Web downloads are not allowed when the /NoWeb switch is used.. Retrying download for 'Visual Studio Extensibility Item Templates with Assembly References in Nuget Packages'
DownloadManager Information: 0 : WebClient downloading file 'http://go.microsoft.com/fwlink/?LinkId=558768' to: C:\Users\John Gallegos\AppData\Local\Temp\evlyeg3i.fmr
DownloadManager Error: 0 : WebClient error while downloading file 'http://go.microsoft.com/fwlink/?LinkId=558768'. Exception: System.Net.WebException: The remote name could not be resolved: 'go.microsoft.com'
   at System.Net.WebClient.OpenRead(Uri address)
   at Microsoft.Web.PlatformInstaller.InstallManager.WebClientDownloadInstallerFile(InstallerContext currentInstall, String& errorMessage, Boolean setFinalReturnState)
DownloadManager Warning: 0 : WebClient failure: The remote name could not be resolved: 'go.microsoft.com'. Retrying download for 'Visual Studio Extensibility Item Templates with Assembly References in Nuget Packages'
DownloadManager Warning: 0 : WinInet failure: Unable to download 'http://go.microsoft.com/fwlink/?LinkId=558768'.  Web downloads are not allowed when the /NoWeb switch is used.. Retrying download for 'Visual Studio Extensibility Item Templates with Assembly References in Nuget Packages'
DownloadManager Error: 0 : BITS failure: Unable to download 'http://go.microsoft.com/fwlink/?LinkId=558768'.  Web downloads are not allowed when the /NoWeb switch is used.. Download failure for Visual Studio Extensibility Item Templates with Assembly References in Nuget Packages.

那更像！现在我们知道失败的真正原因是 VSIX 上的签名验证！我们现在可以重建事件链:

That's more like it! Now we know the real reason for the failure is signature verification on the VSIXs! We can now reconstruct the chain of events:

1. 安装程序尝试验证 VSIX 上的签名，但失败了.
2. 安装程序继续从 Internet 下载 VSIX 软件包.这里的基本原理可能是签名验证失败，因为缓存的 VSIX 已损坏，因此重新下载是唯一的解决方案.
3. 当然，安装程序再次失败，因为我们禁止所有下载.

但有趣的是，在连接到 Internet 的机器上，这根本不会发生！即使指定了 /noweb 开关！

But the funny thing is that on a machine that is connected to the Internet, this does not happen at all! Even when the /noweb switch is specified!

为什么在联网机器上安装成功，即使所有下载都被禁止?当操作系统的信任验证组件无法使用本地可用的证书验证信任时，它似乎会转到 Internet.

Why does the installation succeed on a networked machine, even when all downloads are disallowed? It would appear that the trust verification component of the operating system goes to the Internet when it fails to verify trust using the certificates it has available locally.

Microsoft 有一篇关于 VS 2015 的已知问题和已修复错误的知识库文章(在此处)，这似乎支持我的理论.文章内容如下:

Microsoft has a knowledge-base article about VS 2015's known issues and fixed bugs (right here), that seems to support my theory. Here's what the article says:

如果您没有将 Windows 更新选项设置为自动更新根证书，然后您选择安装可选组件，您在结束时收到以下 Visual Studio 安装警告过程:

If you do not set the Windows Update option to automatically update the root certificates, and you choose to install optional components, you receive the following Visual Studio setup warning at the end of the process:

适用于 Visual Studio 的 PowerShell 工具:此产品未成功下载:下载文件的签名验证失败.

如果关闭自动更新，您的计算机将不会拥有最新的根证书.因此，Visual Studio 安装程序将无法将用于签署 VSIX 文件的证书识别为有效证书，不会安装组件.

If the automatic update is turned off, your computer will not have the latest root certificates. Therefore, Visual Studio setup will not recognize the certificates that are used to sign the VSIX files as valid certificates and will not install the components.

起初，我以为我找到了我要找的东西.我们所要做的就是获得正确的证书，并完成它！但是你怎么做呢?

At first, I thought I found what I was looking for. All we have to do is obtain the right certificates, and be done with it! But how do you do it?

在联网机器上成功安装 VS 2015 之前和之后安装的证书(使用 certmgr.msc)的差异提供了几个似乎是我遇到问题的证书.但是，在断开连接的机器上手动安装它们没有任何结果.你可以看到我关于这个主题的问题，但它与安装无关:当我尝试安装时发生了同样的事情在 Windows 10 上.

A diff of the installed certificates (using certmgr.msc) before and after a successful VS 2015 installation on a networked machine supplied several certificates that seemed to be responsible for my troubles. However, installing them manually on a disconnected machine yielded no results. You can see my question on the subject, however it has no bearing on the installation: the same thing happened when I tries installing on Windows 10.

也许问题更广泛?过去，Microsoft 提供了可以安装在离线机器上的根证书更新包 (rootsupd.exe).尽管即使在 Windows 8.1 上也可以安装最新的软件包，但它不包括我知道需要的证书.因此，我开始寻找在断开连接的机器上安装证书更新的替代方法.

Maybe the problem is wider? In the past, Microsoft supplied root certificate update packages (rootsupd.exe) that could be installed on offline machines. Although the latest package can be installed even on Windows 8.1, it does not include the certificates I knew were required. And so, I went looking for alternative ways of installing certificate updates on disconnected machines.

Microsoft 在这篇 TechNet 文章中介绍了推荐的执行方式.因为我没有 Windows Server 机器，我尝试手动应用所需的注册表更改，但无济于事.

Microsoft describes the recommended way of doing so, in this TechNet article. Because I do not have a Windows Server machine, I tried applying the required registry changes manually, but to no avail.

Visual Studio 论坛 也没有提供太多帮助.

The Visual Studio forums did not provide much help, either.

但是，在突然清晰的瞬间，我心想:如果我可以完全避免这个问题呢?如果不是尝试让 VSIX 上的证书进行验证，而是可以用我自己的证书替换这些证书，该怎么办?毕竟，我处于断开连接的环境中，因此信任不是问题.

But, in a moment of sudden clarity, I thought to myself: What if I can avoid the problem altogether? What if instead of trying to get the certificates on the VSIXs to validate, I could replace those certificates with my own? After all, I'm in a disconnected environment, and therefore trust is not an issue.

可以使用 vsixsigntool.exe 签署 VSIX 包，在此处.幸运的是，可以将已签名的 VSIX 提供给此实用程序，它会将嵌入的证书替换为您指定的证书.小菜一碟！

Signing VSIX packages is possible using vsixsigntool.exe, available here. Luckily, it is possible to feed an already-signed VSIX to this utility, and it will replace the embedded certificate with the one you specify. Piece o'cake!

嗯，不完全是.这种方法有两个问题:

Well, not exactly. There are two problems with this approach:

1. 证书的主题必须是 CN = Microsoft Corporation.为什么?安装程序使用一个特殊的 XML提要"来描述它可用的不同组件(查看 OfflineCache\feeds 目录).安装 VSIX 包时，它会验证嵌入证书的主题是否与 XML 源中指定的主题相匹配.XML 提要也已签名，因此到处都是乐趣.
2. 一个特殊文件 cache.bin 为安装程序提供了查找包缓存版本所需的信息(例如，请参见 OfflineCache\installers\VS_Extensibility_TemplatesV1\cache.bin).问题是，该文件包含包的 SHA256 哈希值.该文件实际上只是一个序列化的 .NET 对象，但如果不访问包含序列化对象的类及其成员的类的程序集，我们就无法对其进行反序列化.此外，真正的程序员不是这样做的！散列存储为一个简单的 ASCII 字符串，所以这只是一个搜索问题.替换.

1. The certificate's subject must be CN = Microsoft Corporation. Why? The installer uses a special XML "feed" that describes the different components it has available (look in the OfflineCache\feeds directory). When installing a VSIX package, it verifies that the embedded certificate's subject matches the subject specified in the XML feed. The XML feed is signed as well, so fun is all around.
2. A special file, cache.bin, provides the installer with the information required to find the cached version of a package (see, for instance, OfflineCache\installers\VS_Extensibility_TemplatesV1\cache.bin). Problem is, the file contains the SHA256 hash of the package. The file is really just a serialized .NET object, but we cannot deserialize it without access to the assemblies that contain the class of the serialized object, and the classes of its members. Besides, this is not how real programmers do it! The hash is stored as a simple ASCII string, so it's just a matter of search & replace.

就是这样！使用这种方法，我们可以对所有 VSIX 包重新签名，将用于受信任的根证书颁发机构存储的证书导入，而 Bob 是你的叔叔.

That's it! Using this method we can re-sign all the VSIX packages, import the certificate used to the Trusted Root Certification Authorities store, and Bob's your uncle.

我编写了一个脚本来执行我上面描述的所有操作.它在这里可用.玩得开心！

I wrote a script that performs all the operations I described above. It is available here. Have fun!

这篇关于Visual Studio 2015 Enterprise 脱机安装失败的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！