Bootloader build with custom zlib version

[raghupcr]

Hi @rokm and team,

Need help on one issue.

as part of one discussion https://github.com/orgs/pyinstaller/discussions/8064, we are trying to build bootloader with custom Zlib

we are trying to build a bootloader with a custom zlib version
but after building and using the latest zlib version again in our security tool it is showing 1.2.13

Steps followed

1. Installed pyinstaller version 5.6.2 on our system using pip install
2. git cloned pyinstaller 5.6.2 code as well
3. git cloned pyinstaller 6.4 pyinstaller code
4. inside the pyinstaller code we took the zlib files which are present in the 3rd step
5. Used zlib files which we got from 4th step and replaced in the pyinstaller 5.6 code folder ( $\pyinstallertest\pyinstaller-sourcecode\pyinstaller\bootloader\zlib)
6. built the bootloader with python ./waf all
7. got run.exe , rund.exe
8. we have replaced the exe which we got from step 7 into the installed pyinstaller version folder ($user\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\bootloader\Windows-64bit)
9. Created one sample exe using the pyinstaller 5.6 again assuming that the exe will show 1.3.1 as we have replaced the run.exe.

can you please provide if something we are missing/doing in the wrong way

Thanks,
Raghavendra

[rokm]

What does your security tool show if you build a program (let's say simple print("hello world") one, or your actual program) with PyInstaller 6.4.0 - does it identify zlib as 1.3.1?

[rokm]

@rokm we have not tried the sample program with pyinstaller 6.4 . we will check and let you know.

when we installed pyinstaller 6.4 and used in our application ( actual code) then in our tool it is showing zlib 1.3.1 which fixed our issue.

OK, I just wanted to check that your tool does correctly identify zlib 1.3.1 - if it worked with build of your application made with pyinstaller 6.4, then that's enough confirmation.

Back to the original topic - replacing zlib sources and rebuilding bootloader should do the trick. As you can see from our commit history, that's what we did for 6.4.

So I suppose you could try putting bootloader executables (the run.exe and rund.exe) through your tool, and see what zlib version they were built with. And as a next step, rebuild your application with --clean (to force full rebuild) and check the build log for location where bootloader executable was taken from (there should be an INFO Bootloader: <path> line after PKG is built and before EXE is built). Is $user\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\bootloader\Windows-64bit\run.exe really used?

[saleem-khaji]

@rokm when i put bootloader executable (run.exe) in the tool, im getting proper expected results (zlib version as 1.3.1).

Use case1:
Now

1. I have placed the same run.exe (and other files) in folder *$user\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\bootloader\Windows-64bit*
2. Generated python executable using command pyinstaller --onefile main.py. This generated main.exe,
3. Tested main.exe in the tool. it reports zlib version as 1.2.13.

My python program printing zlib version 1.2.13

program as below:
import zlib
print(zlib.ZLIB_VERSION) --> this always printing zlib 1.2.13

Use case 2:

1. install pyinstaller 6.4.0
2. Generated python executable using command pyinstaller --onefile main.py. This generated main.exe
3. Test the main.exe with the tool. this resuling zlib version 1.2.13

Use case 3:

1. Uninstall pyinstaller
2. Make sure pyinstaller uninstalled successfully
3. Run python file on the command prompt --> print(zlib.ZLIB_VERSION)
4. output of the file is 1.2.13

[rokm]

program as below:

import zlib
print(zlib.ZLIB_VERSION) --> this always printing zlib 1.2.13

That's the version of zlib that python's zlib module was built with, and has nothing to do with the version that bootloader is built with.

---

As for use case 1, what does your tool report if you create a onedir build instead of onefile one?

And, have you checked the build log for the line that indicates where the bootloader file was taken from (to ensure that you are not copying the bootloader files into wrong PyInstaller installation, in case you have multiple python environments)?

[saleem-khaji]

Hi @rokm, My tool take .exe file to analyze. In case if i generate artifact using argument --onedir, it doesn't contains packages. so my tool is not reporting any packages and their versions.

In case if i build with --onefile, it contains packages also. so my tool listing down packages and their versions.

Attached the logs for --onedir output.
build-logs.txt

[rokm]

Hi @rokm, My tool take .exe file to analyze. In case if i generate artifact using argument --onedir, it doesn't contains packages. so my tool is not reporting any packages and their versions.

But if you analyze onedir .exe file, it should display the version of zlib that bootloader was built with nevertheless? Or does it not?

In case if i build with --onefile, it contains packages also. so my tool listing down packages and their versions.

So in that case, it sounds to me as if the tool is reporting zlib 1.2.13, because that's what python's zlib module was built against?

[bwoodsend]

Skip step 1, replace step 7 and 8 with running pip install . from inside pyinstallertest\pyinstaller-sourcecode\pyinstaller would be preferred but what you're doing should still work. Sure you're not just fudging Python environments?

[raghupcr]

@bwoodsend thanks for the input we will try and let you know