Skip to content

Avoid shell for Windows CodeDeploy MSI install#10368

Open
dfgvaetyj3456356-hash wants to merge 2 commits into
aws:developfrom
dfgvaetyj3456356-hash:security/codedeploy-msi-shell
Open

Avoid shell for Windows CodeDeploy MSI install#10368
dfgvaetyj3456356-hash wants to merge 2 commits into
aws:developfrom
dfgvaetyj3456356-hash:security/codedeploy-msi-shell

Conversation

@dfgvaetyj3456356-hash
Copy link
Copy Markdown

Description

The Windows CodeDeploy on-premises installer currently invokes the downloaded MSI by passing the relative installer path to subprocess.check_call(..., shell=True). This change runs the MSI through msiexec.exe /i and removes shell invocation from that install step.

This keeps the existing quiet install and log arguments, while avoiding shell parsing for custom installer filenames supplied through --agent-installer.

Tests

  • python -m pytest tests\unit\customizations\codedeploy\test_systems.py tests\unit\customizations\codedeploy\test_install.py -q
  • git diff --check

@dfgvaetyj3456356-hash dfgvaetyj3456356-hash requested a review from a team as a code owner May 31, 2026 23:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant