fleet/ee/maintained-apps/outputs/python-3.14/windows.json

{
  "versions": [
    {
      "version": "3.14.6",
      "queries": {
        "exists": "SELECT 1 FROM programs WHERE name LIKE 'Python 3.14.% (64-bit)' AND publisher = 'Python Software Foundation';",
        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Python 3.14.% (64-bit)' AND publisher = 'Python Software Foundation' AND version_compare(version, '3.14.6150.0') < 0);"
      },
      "installer_url": "https://www.python.org/ftp/python/3.14.6/python-3.14.6-amd64.exe",
      "install_script_ref": "8272e48d",
      "uninstall_script_ref": "476a79be",
      "sha256": "14b3e9a710a3fcf0bd9b55ab6b60412bd91227563f813fc49040cabc0209e0bd",
      "default_categories": [
        "Developer tools"
      ]
    }
  ],
  "refs": {
    "476a79be": "# python.org's Windows installer is a WiX \"Burn\" bundle. A Python 3.14 install\n# registers many visible uninstall entries:\n#   * the bundle:    \"Python 3.14.<patch> (64-bit)\" -> a cached Burn EXE\n#   * components:    \"Python 3.14.<patch> Core Interpreter (64-bit)\",\n#                    \"...Standard Library (64-bit)\", \"...Executables (64-bit)\",\n#                    etc. -> individual MSIs\n#\n# The component MSIs must be removed in DEPENDENCY ORDER: the feature components\n# (Standard Library, Tcl/Tk, pip, docs, etc.) run uninstall custom actions that\n# invoke python.exe, so the \"Executables\" and \"Core Interpreter\" components that\n# provide python.exe must be removed LAST. Removing them first makes the rest\n# fail with exit code 1603. This ordering + \"REBOOT=ReallySuppress /qn\" mirrors\n# the documented silentinstallhq.com Python uninstall.\n#\n# We match on the DisplayName (anchored for the bundle) rather than the Publisher\n# string, and scan every hive osquery's \"programs\" table reads (HKLM +\n# Wow6432Node + all HKU) so this works for per-machine (SYSTEM) and per-user\n# installs alike.\n\n$pythonNameLike    = \"Python 3.14.* (64-bit)\"\n$bundleNamePattern = '^Python 3\\.14\\.\\d+ \\(64-bit\\)$'\n\n# 0 = success, 1605 = not installed, 1614 = already uninstalled, 1641 = reboot\n# initiated, 3010 = reboot required.\n$ExpectedExitCodes = @(0, 1605, 1614, 1641, 3010)\n$exitCode = 0\n\nfunction Get-UninstallRoots {\n    $roots = [System.Collections.Generic.List[string]]::new()\n    $roots.Add('HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall')\n    $roots.Add('HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall')\n    foreach ($hive in (Get-ChildItem 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue)) {\n        if ($hive.Name -match '_Classes$') { continue }\n        $roots.Add(\"Registry::$($hive.Name)\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\")\n        $roots.Add(\"Registry::$($hive.Name)\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\")\n    }\n    return $roots\n}\n\nfunction Get-PythonEntries {\n    param([string[]]$Roots)\n    $list = @()\n    foreach ($root in $Roots) {\n        foreach ($sub in (Get-ChildItem -Path $root -ErrorAction SilentlyContinue)) {\n            $key = Get-ItemProperty $sub.PSPath -ErrorAction SilentlyContinue\n            if (-not $key.DisplayName) { continue }\n            if ($key.DisplayName -notlike $pythonNameLike) { continue }\n            $list += [PSCustomObject]@{\n                DisplayName    = $key.DisplayName\n                KeyPath        = $sub.PSPath\n                KeyName        = $sub.PSChildName\n                Uninstall      = $key.UninstallString\n                QuietUninstall = $key.QuietUninstallString\n            }\n        }\n    }\n    return $list\n}\n\n# Returns an MSI product code ({GUID}) for an entry, or $null if it isn't an MSI.\nfunction Get-MsiProductCode {\n    param($Entry)\n    if ($Entry.Uninstall -match \"(?i)MsiExec\\.exe\\s+/[IX]\\s*(\\{[0-9A-F-]+\\})\") { return $Matches[1] }\n    if ($Entry.KeyName -match \"(?i)^\\{[0-9A-F-]+\\}$\") { return $Entry.KeyName }\n    return $null\n}\n\n# Dependency removal order: feature components first (0), then Executables (1),\n# then Core Interpreter LAST (2).\nfunction Get-RemovalPriority {\n    param([string]$Name)\n    if ($Name -match '(?i)Core Interpreter') { return 2 }\n    if ($Name -match '(?i)Executables')      { return 1 }\n    return 0\n}\n\nfunction Get-ExePath {\n    param([string]$Command)\n    if ($Command -match '^\\s*\"([^\"]+)\"') { return $Matches[1] }\n    if ($Command -match '(?i)^\\s*(.+?\\.exe)(\\s|$)') { return $Matches[1] }\n    return $null\n}\n\ntry {\n\n    $roots = Get-UninstallRoots\n    $entries = Get-PythonEntries -Roots $roots\n    if ($entries.Count -eq 0) {\n        Write-Host \"No Python 3.14 (64-bit) entries found (already removed).\"\n        Exit 0\n    }\n\n    # Stop only running interpreters that belong to THIS Python install so the\n    # component MSIs aren't locked. We scope the kill to processes whose image\n    # lives under the version-specific \"Python314\" directory; matching by image\n    # base name alone (python.exe/pythonw.exe/...) would also terminate a\n    # side-by-side 3.12/3.13, Microsoft Store, or Anaconda interpreter -- a\n    # 3.14 uninstall running as SYSTEM could kill an unrelated long-running\n    # workload mid-write. The shared \"py\"/\"pyw\" launcher lives in C:\\Windows and\n    # is version-agnostic, so it is intentionally left running.\n    $installDirPattern = '*\\Python314\\*'\n    foreach ($proc in @(\"python\", \"pythonw\", \"py\", \"pyw\")) {\n        Get-Process -Name $proc -ErrorAction SilentlyContinue |\n            Where-Object { $_.Path -like $installDirPattern } |\n            Stop-Process -Force -ErrorAction SilentlyContinue\n    }\n\n    # --- Remove component MSIs in dependency order (Core Interpreter last). ---\n    $components = $entries |\n        Where-Object { $_.DisplayName -notmatch $bundleNamePattern } |\n        Sort-Object @{ Expression = { Get-RemovalPriority $_.DisplayName } }\n\n    foreach ($e in $components) {\n        $code = Get-MsiProductCode $e\n        if (-not $code) { Write-Host \"Skipping non-MSI component: '$($e.DisplayName)'\"; continue }\n\n        Write-Host \"Removing component: '$($e.DisplayName)' ($code)\"\n        $p = Start-Process -FilePath \"msiexec.exe\" `\n            -ArgumentList \"/x $code REBOOT=ReallySuppress /qn /norestart\" -PassThru -Wait\n        Write-Host \"  Exit code: $($p.ExitCode)\"\n        if (($ExpectedExitCodes -notcontains $p.ExitCode) -and ($exitCode -eq 0)) { $exitCode = $p.ExitCode }\n    }\n\n    # --- Remove the bundle. With its components gone its own uninstall is quick;\n    # if a registration lingers, delete the orphaned key so detection clears. ---\n    foreach ($e in (Get-PythonEntries -Roots $roots | Where-Object { $_.DisplayName -match $bundleNamePattern })) {\n        $command = if ($e.QuietUninstall) { $e.QuietUninstall } else { $e.Uninstall }\n        $exe = if ($command) { Get-ExePath $command } else { $null }\n        if ($exe -and (Test-Path -LiteralPath $exe)) {\n            Write-Host \"Uninstalling bundle: '$($e.DisplayName)' via $exe\"\n            $p = Start-Process -FilePath $exe -ArgumentList \"/uninstall /quiet /norestart\" -PassThru -Wait\n            Write-Host \"  Exit code: $($p.ExitCode)\"\n            if (($ExpectedExitCodes -notcontains $p.ExitCode) -and ($exitCode -eq 0)) { $exitCode = $p.ExitCode }\n        }\n        $still = Get-ItemProperty $e.KeyPath -ErrorAction SilentlyContinue\n        if ($still -and $still.DisplayName) {\n            Write-Host \"Removing leftover bundle registration: '$($e.DisplayName)'\"\n            Remove-Item -Path $e.KeyPath -Recurse -Force -ErrorAction SilentlyContinue\n        }\n    }\n\n    # --- Verify nothing remains in the programs table. ---\n    $remaining = Get-PythonEntries -Roots $roots\n    if ($remaining.Count -gt 0) {\n        Write-Host \"WARNING: $($remaining.Count) Python 3.14 entry(ies) still present after uninstall:\"\n        $remaining | ForEach-Object { Write-Host \"  - $($_.DisplayName) [$($_.KeyPath)]\" }\n        if ($exitCode -eq 0) { $exitCode = 1 }\n    } else {\n        Write-Host \"All Python 3.14 (64-bit) entries removed.\"\n    }\n\n} catch {\n    Write-Host \"Error: $_\"\n    $exitCode = 1\n}\n\nif ($ExpectedExitCodes -contains $exitCode) { Exit 0 } else { Exit $exitCode }\n",
    "8272e48d": "# Learn more about .exe install scripts:\n# http://fleetdm.com/learn-more-about/exe-install-scripts\n#\n# python.org's Windows installer is a WiX \"Burn\" bundle. \"/quiet /norestart\"\n# runs it silently. Fleet installs run as SYSTEM (elevated), so InstallAllUsers=1\n# yields a per-machine install (under a non-elevated context the bundle falls\n# back to a per-user install). PrependPath=1 adds Python to PATH.\n\n$exeFilePath = \"${env:INSTALLER_PATH}\"\n# 0 = success, 3010 = success (reboot required), 1641 = success (reboot initiated).\n$ExpectedExitCodes = @(0, 3010, 1641)\n\ntry {\n\n$processOptions = @{\n  FilePath = \"$exeFilePath\"\n  ArgumentList = \"/quiet /norestart InstallAllUsers=1 PrependPath=1\"\n  PassThru = $true\n  Wait = $true\n}\n\n$process = Start-Process @processOptions\n$exitCode = $process.ExitCode\n\nWrite-Host \"Install exit code: $exitCode\"\nif ($ExpectedExitCodes -contains $exitCode) { Exit 0 }\nExit $exitCode\n\n} catch {\n  Write-Host \"Error: $_\"\n  Exit 1\n}\n"
  }
}