v7.00.21

thanks to Ross for suggesting.

.github/workflows/build.yml

@@ -17,7 +17,7 @@ defaults:
     working-directory: src
 
 env:
-  SCRATCH_COUNTER: 2
+  SCRATCH_COUNTER: 3
   OPENSSL_CONFIG_OPTS: no-fips --api=3.0.0
   OPENSSL_INSTALL_PATH: ${{ github.workspace }}/bin/ssl
   OPENSSL_SOURCE_PATH: ${{ github.workspace }}/src/openssl
@@ -36,58 +36,63 @@ jobs:
             goal: build
             arch: x86_64
             openssl_archs: linux-x86_64
-          - os: [self-hosted, linux, arm64]
+          - os: ubuntu-24.04
             jid: 2
             goal: build
+            arch: x86_64
+            openssl_archs: linux-x86_64
+          - os: [self-hosted, linux, arm64]
+            jid: 3
+            goal: build
             arch: aarch64
             openssl_archs: linux-aarch64
           - os: ubuntu-22.04
-            jid: 3
+            jid: 4
             goal: build
             arch: x86_64
             openssl_archs: linux-x86_64
             staticx: yes
           - os: [self-hosted, linux, arm64]
-            jid: 4
+            jid: 5
             goal: build
             arch: aarch64
             openssl_archs: linux-aarch64
             staticx: yes
           - os: macos-13
-            jid: 5
+            jid: 6
             goal: build
             arch: x86_64
             openssl_archs: darwin64-x86_64
           - os: macos-14
-            jid: 6
+            jid: 7
             goal: build
             arch: aarch64
             openssl_archs: darwin64-arm64
           - os: windows-2022
-            jid: 7
+            jid: 8
             goal: build
             arch: Win64
             openssl_archs: VC-WIN64A
           - os: ubuntu-24.04
             goal: test
             python: "3.9"
-            jid: 8
-            arch: x86_64
-          - os: ubuntu-24.04
-            goal: test
-            python: "3.10"
             jid: 9
             arch: x86_64
           - os: ubuntu-24.04
             goal: test
-            python: "3.11"
+            python: "3.10"
             jid: 10
             arch: x86_64
           - os: ubuntu-24.04
             goal: test
-            python: "3.12"
+            python: "3.11"
             jid: 11
             arch: x86_64
+          - os: ubuntu-24.04
+            goal: test
+            python: "3.12"
+            jid: 12
+            arch: x86_64
 
     steps:
 
@@ -110,7 +115,7 @@ jobs:
         with:
           path: |
             cache.tar.xz
-          key: gam-${{ matrix.jid }}-20241008
+          key: gam-${{ matrix.jid }}-20241014
 
       - name: Untar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'
@@ -181,7 +186,7 @@ jobs:
         run: |
           echo "RUNNING: apt update..."
           sudo apt-get -qq --yes update
-          sudo apt-get -qq --yes install swig libpcsclite-dev libxslt1-dev
+          sudo apt-get -qq --yes install swig libpcsclite-dev libxslt1-dev libsqlite3-dev
 
       - name: MacOS install tools
         if: runner.os == 'macOS'
@@ -697,6 +702,7 @@ jobs:
           export MSI_FILENAME="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-windows-${GAM_ARCHIVE_ARCH}.msi"
           # auto-generate a lib.wxs based on the files PyInstaller created for the lib/ directory
           /c/Program\ Files\ \(x86\)/WiX\ Toolset\ v3.14/bin/heat.exe dir "${gampath}/lib" -ke -srd -cg Lib -gg -dr lib -directoryid lib -out lib.wxs
+          $PYTHON tools/gen-wix-xml-filelist.py lib.wxs
           echo "-- begin lib.wxs --"
           cat lib.wxs
           echo "-- end lib.wxs --"

docs/Context-Aware-Access-Levels.md

@@ -8,6 +8,7 @@
 - [Parameters for Basic Levels](#parameters-for-basic-levels)
 - [Create an Access Level](#create-an-access-level)
 - [Update an Access Level](#update-an-access-level)
+- [Update Access Levels with JSON](#update-access-levels-with-json)
 - [Delete an Access Level](#delete-an-access-level)
 - [Display all Access Levels](#display-all-access-levels)
 - [CAA Region Codes](#caa-region-codes)
@@ -177,6 +178,27 @@ This example adds UK to the allowed regions for CORP_COUNTRIES
 gam update caalevel CORP_COUNTRIES basic condition regions US,CA,UK endcondition
 ```
 
+## Update Access Levels with JSON
+Update existing CAA levels via their JSON data; create a CSV file of CAA levels.
+```
+gam redirect csv ./CAAlevels.csv print caalevels formatjson quotechar "'"
+```
+Edit the JSON column for the desired CAA level(s) in CAAlevels.csv.
+Update the desired CAA level by selecting the row by it's title; repeat for each title to update.
+```
+gam config csv_input_row_filter "title:text='Example Title'" csv CAAlevels.csv quotechar "'" gam update caalevel "~name" json "~JSON"
+```
+
+## Example
+Edit CAAlevels.csv and add UK to the allowed regions for CORP_COUNTRIES
+```
+{"regions": ["US", "CA", "UK"]}
+```
+Do the update.
+```
+gam config csv_input_row_filter "title:text='CORP_COUNTRIES'" csv CAAlevels.csv quotechar "'" gam update caalevel "~name" json "~JSON"
+```
+
 ## Delete an Access Level
 Deletes the specified access level.
 ```

docs/GamUpdates.md

@@ -10,6 +10,24 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.00.21
+
+uprev version to test MSI installs
+
+### 7.00.20
+
+Fix Windows MSI installer issues on version upgrade. If you are having issues upgrading from a version older than 7.00.20 to this version or newer you may need to do a one time uninstall of GAM7 and then reinstall the new version. No configuration files will be lost during the uninstall / reinstall.
+
+### 7.00.19
+
+Updated `gam update shareddrive <SharedDriveEntity> ou <OrgUnitItem>` to handle the following error
+that occurs when an invalid `<SharedDriveEntity>` is specified.
+```
+ERROR: 400: invalidArgument - Invalid org membership name 0AJ3b2FTPakToUk9PVAxx.~
+```
+
+Updated `gam print browsers` to properly format the time field `deviceIdentifiersHistory.records.0.firstRecordTime`.
+
 ### 7.00.18
 
 Updated `gam create project` to use a default project name of `gam-project-a1b2c` (`a1b2c` is a random string of 5 characters)

docs/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -251,7 +251,7 @@ writes the credentials into the file oauth2.txt.
 admin@server:/Users/admin$ rm -f /Users/admin/GAMConfig/oauth2.txt
 admin@server:/Users/admin$ gam version
 WARNING: Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /Users/admin/GAMConfig/oauth2.txt, Not Found
-GAM 7.00.18 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.00.19 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.0 64-bit final
 MacOS Sonoma 14.5 x86_64
@@ -923,7 +923,7 @@ writes the credentials into the file oauth2.txt.
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
 WARNING: Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: C:\GAMConfig\oauth2.txt, Not Found
-GAM7 7.00.18 - https://github.com/GAM-team/GAM - pythonsource
+GAM7 7.00.19 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.0 64-bit final
 Windows-10-10.0.17134 AMD64

docs/Shared-Drives.md

@@ -427,6 +427,15 @@ gam info ou <OrgUnitPath> nousers
 gam show teamdrives query "orgUnitId='03ph8a2z21rexy'" fields id,name,orgunit,createdtime
 gam print teamdrives query "orgUnitId='03ph8a2z21rexy'" fields id,name,orgunit,createdtime
 ```
+Alternative method; `<OrgUnitPath>` defaults to `/`.
+```
+gam show oushareddrives
+        [ou|org|orgunit <OrgUnitPath>]
+        [formatjson]
+gam print oushareddrives [todrive <ToDriveAttribute>*]
+        [ou|org|orgunit <OrgUnitPath>]
+        [formatjson [quotechar <Character>]]
+```
 
 ## Manage Shared Drive access
 These commands are used to manage the ACLs on Shared Drives themselves, not the files/folders on the Shared Drives.

docs/Users.md

@@ -37,7 +37,7 @@
 - [Print user domain counts](#print-user-domain-counts)
     - [Print domain counts for users in a specific domain and/or selected by a query](#print-domain-counts-for-users-in-a-specific-domain-and-or-selected-by-a-query)
     - [Print domain counts for users specified by `<UserTypeEntity>`](#print-domain-counts-for-users-specified-by-usertypeentity)
-- [Print user counts by OrgUnit](print-user-counts-by-orgunit)
+- [Print user counts by OrgUnit](#print-user-counts-by-orgunit)
 - [Print user list](#print-user-list)
 - [Display user counts](#display-user-counts)
 - [Verify domain membership]($verify-domain-membership)

docs/Version-and-Help.md

@@ -3,7 +3,7 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.00.18 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.00.19 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.0 64-bit final
 MacOS Sonoma 14.5 x86_64
@@ -15,7 +15,7 @@ Time: 2023-06-02T21:10:00-07:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.00.18 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.00.19 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.0 64-bit final
 MacOS Sonoma 14.5 x86_64
@@ -27,7 +27,7 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.00.18 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.00.19 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.0 64-bit final
 MacOS Sonoma 14.5 x86_64
@@ -64,7 +64,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/Admin/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.00.18
+   Latest: 7.00.19
 echo $?
 1
 ```
@@ -72,7 +72,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.00.18
+7.00.19
 ```
 In Linux/MacOS you can do:
 ```
@@ -82,7 +82,7 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.00.18 - https://github.com/GAM-team/GAM
+GAM 7.00.19 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.0 64-bit final
 MacOS Sonoma 14.5 x86_64

src/GamUpdate.txt

@@ -1,3 +1,21 @@
+7.00.21
+
+uprev version to test MSI installs
+
+7.00.20
+
+Fix Windows MSI installer issues on version upgrade. If you are having issues upgrading from a version older than 7.00.20 to this version or newer you may need to do a one time uninstall of GAM7 and then reinstall the new version. No configuration files will be lost during the uninstall / reinstall.
+
+7.00.19
+
+Updated `gam update shareddrive <SharedDriveEntity> ou <OrgUnitItem>` to handle the following error
+that occurs when an invalid `<SharedDriveEntity>` is specified.
+```
+ERROR: 400: invalidArgument - Invalid org membership name 0AJ3b2FTPakToUk9PVAxx.~
+```
+
+Updated `gam print browsers` to properly format the time field `deviceIdentifiersHistory.records.0.firstRecordTime`.
+
 7.00.18
 
 Updated `gam create project` to use a default project name of `gam-project-a1b2c` (`a1b2c` is a random string of 5 characters)

src/gam-install.sh

@@ -30,8 +30,6 @@ upgrade_only=false
 gamversion="latest"
 adminuser=""
 regularuser=""
-gam_x86_64_glibc_vers="2.35"
-gam_arm64_glibc_vers="2.35"
 strip_gam="--strip-components 0"
 
 while getopts "hd:a:o:b:lp:u:r:v:s" OPTION
@@ -90,7 +88,6 @@ version_gt()
 # MacOS < 10.13 doesn't support sort -V
 echo "" | sort -V > /dev/null 2>&1
 vsort_failed=$?
-echo "Check:${2}"
 if [ "${1}" = "${2}" ]; then
   true
 elif (( $vsort_failed != 0 )); then
@@ -100,81 +97,6 @@ else
 fi
 }
 
-case $gamos in
-  [lL]inux)
-    gamos="linux"
-    if [ "$osversion" == "" ]; then
-      this_glibc_ver=$(ldd --version | awk '/ldd/{print $NF}')
-    else
-      this_glibc_ver=$osversion
-    fi
-    echo "This Linux distribution uses glibc $this_glibc_ver"
-    case $gamarch in
-      x86_64)
-        useglibc="legacy"
-        for gam_glibc_ver in $gam_x86_64_glibc_vers; do
-          if version_gt $this_glibc_ver $gam_glibc_ver; then
-            useglibc="glibc$gam_glibc_ver"
-            echo_green "Using GAM compiled against $useglibc"
-            break
-          fi
-        done
-        gamfile="linux-x86_64-$useglibc.tar.xz";;
-      arm|arm64|aarch64)
-        useglibc=""
-        for gam_glibc_ver in $gam_arm64_glibc_vers; do
-          if version_gt $this_glibc_ver $gam_glibc_ver; then
-            useglibc="glibc$gam_glibc_ver"
-            echo_green "Using GAM compiled against $useglibc"
-            break
-          fi
-        done
-        if [ "$useglibc" == "" ]; then
-          echo_red "Sorry, you need to be running at least glibc $useglibc to run GAM"
-          exit
-        fi
-        gamfile="linux-aarch64-$useglibc.tar.xz";;
-      *)
-        echo_red "ERROR: this installer currently only supports x86_64 and arm64 Linux. Looks like you're running on $gamarch. Exiting."
-        exit
-    esac
-    ;;
-  [Mm]ac[Oo][sS]|[Dd]arwin)
-    gamos="macos"
-    fullversion=$(sw_vers -productVersion)
-    osversion=${fullversion:0:2}
-    case $gamarch in
-      x86_64)
-        gamfile="macos-x86_64.tar.xz"
-	minimum_version=13
-        ;;
-      arm|arm64|aarch64)
-        gamfile="macos-aarch64.tar.xz"
-	minimum_version=14
-        ;;
-      *)
-        echo_red "ERROR: this installer currently only supports x86_64 and arm64 MacOS. Looks like you're running on $gamarch. Exiting."
-        exit
-	;;
-    esac
-    if [[ "$osversion" -ge "$minimum_version" ]]; then
-      echo_green "You are running MacOS ${fullversion}, good. Using GAM with ${gamfile}."
-    else
-      echo_red "Sorry, you are running MacOS ${fullversion} but GAM on ${gamarch} requires MacOS ${minimum_version}. Exiting."
-      exit
-    fi
-    ;;
-  MINGW64_NT*)
-    gamos="windows"
-    echo "You are running Windows"
-    gamfile="-windows-x86_64.zip"
-    ;;
-  *)
-    echo_red "Sorry, this installer currently only supports Linux and MacOS. Looks like you're running on $gamos. Exiting."
-    exit
-    ;;
-esac
-
 if [ "$gamversion" == "latest" ]; then
   release_url="https://api.github.com/repos/GAM-team/GAM/releases/latest"
 elif [ "$gamversion" == "prerelease" -o "$gamversion" == "draft" ]; then
@@ -185,13 +107,19 @@ fi
 
 if [ -z ${GHCLIENT+x} ]; then
   check_type="unauthenticated"
-  echo_yellow "Checking GitHub URL $release_url for $gamversion GAM release ($check_type)..."
-  release_json=$(curl -s "$release_url" 2>&1 /dev/null)
+  curl_opts=( )
 else
   check_type="authenticated"
-  echo_yellow "Checking GitHub URL $release_url for $gamversion GAM release ($check_type)..."
-  release_json=$(curl -s "$GHCLIENT" "$release_url" 2>&1 /dev/null)
+  curl_opts=( "$GHCLIENT" )
 fi
+echo_yellow "Checking GitHub URL $release_url for $gamversion GAM release ($check_type)..."
+release_json=$(curl \
+	--silent \
+	"${curl_opts[@]}" \
+	-H "Accept: application/vnd.github+json" \
+	-H "X-GitHub-Api-Version: 2022-11-28" \
+	"$release_url" \
+	2>&1 /dev/null)
 
 echo_yellow "Getting file and download URL..."
 # Python is sadly the nearest to universal way to safely handle JSON with Bash
@@ -215,11 +143,9 @@ if type(release) is list:
     break
 try:
   for asset in release['assets']:
-    if asset[attrib].endswith('$gamfile'):
-      print(asset[attrib])
-      break
-  else:
-    print('ERROR: Attribute: {0} for $gamfile version {1} not found'.format(attrib, gamversion))
+    print(asset[attrib])
+  #else:
+  #  print('ERROR: Attribute: {0} for version {1} not found'.format(attrib, gamversion))
 except KeyError:
   print('ERROR: assets value not found in JSON value of:\n\n%s' % release)"
 
@@ -245,41 +171,119 @@ if (( $rc != 0 )); then
   echo_red "ERROR: No version of python installed."
   exit
 fi
+download_urls=$(echo "$release_json" | $pycmd -c "$pycode" browser_download_url "$gamversion")
+if [[ ${download_urls:0:5} = "ERROR" ]]; then
+  echo_red "${download_urls}"
+  exit
+fi
+
+case $gamos in
+  [lL]inux)
+    gamos="linux"
+    download_urls=$(echo -e "$download_urls" | grep "\-linux-")
+    if [ "$osversion" == "" ]; then
+      this_glibc_ver=$(ldd --version | awk '/ldd/{print $NF}')
+    else
+      this_glibc_ver=$osversion
+    fi
+    echo "This Linux distribution uses glibc $this_glibc_ver"
+    case $gamarch in
+      x86_64)
+	download_urls=$(echo -e "$download_urls" | grep "\-x86_64-")
+	gam_x86_64_glibc_vers=$(echo -e "$download_urls" | \
+		grep --only-matching 'glibc[0-9\.]*\.tar\.xz$' \
+	        | cut -c 6-9 )
+	useglibc="legacy"
+        for gam_glibc_ver in $gam_x86_64_glibc_vers; do
+          if version_gt $this_glibc_ver $gam_glibc_ver; then
+            useglibc="glibc$gam_glibc_ver"
+            echo_green "Using GAM compiled against $useglibc"
+            break
+          fi
+        done
+        download_url=$(echo -e "$download_urls" | grep "$useglibc")
+	;;
+      arm|arm64|aarch64)
+        download_urls=$(echo -e "$download_urls" | grep "\-aarch64-")
+        gam_arm64_glibc_vers=$(echo -e "$download_urls" | \
+                grep --only-matching 'glibc[0-9\.]*\.tar\.xz$' \
+                | cut -c 6-9 )
+        useglibc="legacy"
+        for gam_glibc_ver in $gam_arm64_glibc_vers; do
+          if version_gt $this_glibc_ver $gam_glibc_ver; then
+            useglibc="glibc$gam_glibc_ver"
+            echo_green "Using GAM compiled against $useglibc"
+            break
+          fi
+        done
+        download_url=$(echo -e "$download_urls" | grep "$useglibc")
+	;;
+      *)
+        echo_red "ERROR: this installer currently only supports x86_64 and arm64 Linux. Looks like you're running on $gamarch. Exiting."
+        exit
+    esac
+    ;;
+  [Mm]ac[Oo][sS]|[Dd]arwin)
+    gamos="macos"
+    fullversion=$(sw_vers -productVersion)
+    # override osversion only if it wasn't set by cli arguments
+    osversion=${osversion:-${fullversion:0:2}}
+    download_urls=$(echo -e "$download_urls" | grep "\-macos-")
+    case $gamarch in
+      x86_64)
+        download_url=$(echo -e "$download_urls" | grep "\-x86_64")
+	minimum_version=13
+        ;;
+      arm|arm64|aarch64)
+        download_url=$(echo -e "$download_urls" | grep "\-aarch64")
+	minimum_version=14
+        ;;
+      *)
+        echo_red "ERROR: this installer currently only supports x86_64 and arm64 MacOS. Looks like you're running on ${gamarch}. Exiting."
+        exit
+	;;
+    esac
+    if [[ "$osversion" -ge "$minimum_version" ]]; then
+      echo_green "You are running MacOS ${fullversion}, good. Using GAM with ${download_url}."
+    else
+      echo_red "Sorry, you are running MacOS ${fullversion} but GAM on ${gamarch} requires MacOS ${minimum_version}. Exiting."
+      exit
+    fi
+    ;;
+  MINGW64_NT*)
+    gamos="windows"
+    echo "You are running Windows"
+    download_url=$(echo -e "$download_urls" | grep "\-windows-" | grep ".zip")
+    ;;
+  *)
+    echo_red "Sorry, this installer currently only supports Linux and MacOS. Looks like you're running on ${gamos}. Exiting."
+    exit
+    ;;
+esac
 
-browser_download_url=$(echo "$release_json" | $pycmd -c "$pycode" browser_download_url "$gamversion")
-if [[ ${browser_download_url:0:5} = "ERROR" ]]; then
-  echo_red "${browser_download_url}"
-  exit
-fi
-name=$(echo "$release_json" | $pycmd -c "$pycode" name "$gamversion")
-if [[ ${name:0:5} = "ERROR" ]]; then
-  echo_red "${name}"
-  exit
-fi
 # Temp dir for archive
-#temp_archive_dir=$(mktemp -d)
 temp_archive_dir=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
 
 # Clean up after ourselves even if we are killed with CTRL-C
 trap "rm -rf $temp_archive_dir" EXIT
 
-echo_yellow "Downloading file $name from $browser_download_url to $temp_archive_dir ($check_type)..."
+# hack to grab the end of the URL which should be the filename.
+name=$(echo -e "$download_url" | rev | cut -f1 -d "/" | rev)
+
+echo_yellow "Downloading ${download_url} to $temp_archive_dir ($check_type)..."
 # Save archive to temp w/o losing our path
-if [ -z ${GHCLIENT+x} ]; then
-  (cd "$temp_archive_dir" && curl -O -L $browser_download_url)
-else
-  (cd "$temp_archive_dir" && curl -O -L $GHCLIENT $browser_download_url)
-fi
+(cd "$temp_archive_dir" && curl -O -L -s "${curl_opts[@]}" "$download_url")
 
 mkdir -p "$target_dir"
 
 echo_yellow "Extracting archive to $target_dir"
-if [[ "${name}" == *.tar.xz ]]; then
-  tar $strip_gam -xf "$temp_archive_dir"/"$name" -C "$target_dir"
-elif [[ "${name}" == *.tar ]]; then
+if [[ "$name" =~ tar.xz|tar.gz|tar ]]; then
   tar $strip_gam -xf "$temp_archive_dir"/"$name" -C "$target_dir"
+elif [[ "$name" == *.zip ]]; then
+  unzip -o "${temp_archive_dir}/${name}" -d "${target_dir}"
 else
-  unzip "${temp_archive_dir}/${name}" -d "${target_dir}"
+  echo "I don't know what to do with files like ${name}. Giving up."
+  exit 1
 fi
 rc=$?
 if (( $rc != 0 )); then

src/gam/__init__.py

@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """
 
 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.00.18'
+__version__ = '7.00.21'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'
 
 #pylint: disable=wrong-import-position
@@ -24993,7 +24993,7 @@ def doDeleteBrowsers():
   except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
     checkEntityAFDNEorAccessErrorExit(None, Ent.CHROME_BROWSER, deviceId)
 
-BROWSER_TIME_OBJECTS = {'lastActivityTime', 'lastPolicyFetchTime', 'lastRegistrationTime', 'lastStatusReportTime', 'safeBrowsingWarningsResetTime'}
+BROWSER_TIME_OBJECTS = {'firstRecordTime', 'lastActivityTime', 'lastPolicyFetchTime', 'lastRegistrationTime', 'lastStatusReportTime', 'safeBrowsingWarningsResetTime'}
 
 def _showBrowser(browser, FJQC, i=0, count=0):
   if FJQC.formatJSON:
@@ -64285,13 +64285,15 @@ def _moveSharedDriveToOU(orgUnit, orgUnitId, driveId, user, i, count, ci, return
             'destinationOrgUnit': f'orgUnits/{orgUnitId[3:]}'}
   try:
     callGAPI(ci.orgUnits().memberships(), 'move',
-             throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.ABORTED],
+             throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND, GAPI.FORBIDDEN,
+                                                         GAPI.INVALID_ARGUMENT, GAPI.ABORTED],
              name=name, body=cibody)
     if not returnIdOnly:
       Act.Set(Act.MOVE)
-      entityModifierNewValueActionPerformed([Ent.SHAREDDRIVE, driveId], Act.MODIFIER_TO, f'{Ent.Singular(Ent.ORGANIZATIONAL_UNIT)}: {orgUnit}', i, count)
+      entityModifierNewValueActionPerformed([Ent.USER, user, Ent.SHAREDDRIVE, driveId], Act.MODIFIER_TO,
+                                            f'{Ent.Singular(Ent.ORGANIZATIONAL_UNIT)}: {orgUnit}', i, count)
   except (GAPI.notFound, GAPI.forbidden, GAPI.aborted, GAPI.badRequest, GAPI.internalError,
-          GAPI.noManageTeamDriveAdministratorPrivilege) as e:
+          GAPI.noManageTeamDriveAdministratorPrivilege, GAPI.invalidArgument) as e:
     entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, driveId], str(e), i, count)
   except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
     userSvcNotApplicableOrDriveDisabled(user, str(e), i, count)

src/new-gam-install-script.sh

@@ -1,441 +0,0 @@
-#!/usr/bin/env bash
-
-usage()
-{
-cat << EOF
-GAM installation script.
-
-OPTIONS:
-   -h      show help.
-   -d      Directory where gam folder will be installed. Default is \$HOME/bin/
-   -a      Architecture to install (i386, x86_64, x86_64_legacy, arm, arm64). Default is to detect your arch with "uname -m".
-   -o      OS we are running (linux, macos). Default is to detect your OS with "uname -s".
-   -b      OS version. Default is to detect on MacOS and Linux.
-   -l      Just upgrade GAM to latest version. Skips project creation and auth.
-   -p      Profile update (true, false). Should script add gam command to environment. Default is true.
-   -u      Admin user email address to use with GAM. Default is to prompt.
-   -r      Regular user email address. Used to test service account access to user data. Default is to prompt.
-   -v      Version to install (latest, prerelease, draft, 3.8, etc). Default is latest.
-   -s      Strip gam component from extracted files, files will be downloaded directly to $target_dir
-EOF
-}
-
-target_dir="$HOME/bin"
-target_gam="gam7/gam"
-gamarch=$(uname -m)
-gamos=$(uname -s)
-osversion=""
-update_profile=true
-upgrade_only=false
-gamversion="latest"
-adminuser=""
-regularuser=""
-strip_gam="--strip-components 0"
-
-while getopts "hd:a:o:b:lp:u:r:v:s" OPTION
-do
-     case $OPTION in
-         h) usage; exit;;
-         d) target_dir="$OPTARG";;
-         a) gamarch="$OPTARG";;
-         o) gamos="$OPTARG";;
-         b) osversion="$OPTARG";;
-         l) upgrade_only=true;;
-         p) update_profile="$OPTARG";;
-         u) adminuser="$OPTARG";;
-         r) regularuser="$OPTARG";;
-         v) gamversion="$OPTARG";;
-         s) strip_gam="--strip-components 1"; target_gam="gam";;
-         ?) usage; exit;;
-     esac
-done
-
-# remove possible / from end of target_dir
-target_dir=${target_dir%/}
-
-update_profile() {
-        [ "$2" -eq 1 ] || [ -f "$1" ] || return 1
-
-        grep -F "$alias_line" "$1" > /dev/null 2>&1
-        if [ $? -ne 0 ]; then
-                echo_yellow "Adding gam alias to profile file $1."
-                echo -e "\n$alias_line" >> "$1"
-        else
-          echo_yellow "gam alias already exists in profile file $1. Skipping add."
-        fi
-}
-
-echo_red()
-{
-echo -e "\x1B[1;31m$1"
-echo -e '\x1B[0m'
-}
-
-echo_green()
-{
-echo -e "\x1B[1;32m$1"
-echo -e '\x1B[0m'
-}
-
-echo_yellow()
-{
-echo -e "\x1B[1;33m$1"
-echo -e '\x1B[0m'
-}
-
-version_gt()
-{
-# MacOS < 10.13 doesn't support sort -V
-echo "" | sort -V > /dev/null 2>&1
-vsort_failed=$?
-if [ "${1}" = "${2}" ]; then
-  true
-elif (( $vsort_failed != 0 )); then
-  false
-else
-  test "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1"
-fi
-}
-
-if [ "$gamversion" == "latest" ]; then
-  release_url="https://api.github.com/repos/GAM-team/GAM/releases/latest"
-elif [ "$gamversion" == "prerelease" -o "$gamversion" == "draft" ]; then
-  release_url="https://api.github.com/repos/GAM-team/GAM/releases"
-else
-  release_url="https://api.github.com/repos/GAM-team/GAM/releases/tags/v$gamversion"
-fi
-
-if [ -z ${GHCLIENT+x} ]; then
-  check_type="unauthenticated"
-  curl_opts=( )
-else
-  check_type="authenticated"
-  curl_opts=( "$GHCLIENT" )
-fi
-echo_yellow "Checking GitHub URL $release_url for $gamversion GAM release ($check_type)..."
-release_json=$(curl \
-	--silent \
-	"${curl_opts[@]}" \
-	-H "Accept: application/vnd.github+json" \
-	-H "X-GitHub-Api-Version: 2022-11-28" \
-	"$release_url" \
-	2>&1 /dev/null)
-
-echo_yellow "Getting file and download URL..."
-# Python is sadly the nearest to universal way to safely handle JSON with Bash
-# At least this code should be compatible with just about any Python version ever
-# unlike GAM itself. If some users don't have Python we can try grep / sed / etc
-# but that gets really ugly
-pycode="import json
-import sys
-
-attrib = sys.argv[1]
-gamversion = sys.argv[2]
-
-release = json.load(sys.stdin)
-if type(release) is list:
-  for a_release in release:
-    if a_release['prerelease'] and gamversion != 'prerelease':
-      continue
-    elif a_release['draft'] and gamversion != 'draft':
-      continue
-    release = a_release
-    break
-try:
-  for asset in release['assets']:
-    print(asset[attrib])
-  #else:
-  #  print('ERROR: Attribute: {0} for version {1} not found'.format(attrib, gamversion))
-except KeyError:
-  print('ERROR: assets value not found in JSON value of:\n\n%s' % release)"
-
-pycmd="python3"
-$pycmd -V >/dev/null 2>&1
-rc=$?
-if (( $rc != 0 )); then
-  pycmd="python"
-fi
-$pycmd -V >/dev/null 2>&1
-rc=$?
-if (( $rc != 0 )); then
-  pycmd="/usr/bin/python3"
-fi
-$pycmd -V >/dev/null 2>&1
-rc=$?
-if (( $rc != 0 )); then
-  pycmd="python2"
-fi
-$pycmd -V >/dev/null 2>&1
-rc=$?
-if (( $rc != 0 )); then
-  echo_red "ERROR: No version of python installed."
-  exit
-fi
-download_urls=$(echo "$release_json" | $pycmd -c "$pycode" browser_download_url "$gamversion")
-if [[ ${download_urls:0:5} = "ERROR" ]]; then
-  echo_red "${download_urls}"
-  exit
-fi
-
-case $gamos in
-  [lL]inux)
-    gamos="linux"
-    download_urls=$(echo -e "$download_urls" | grep "\-linux-")
-    if [ "$osversion" == "" ]; then
-      this_glibc_ver=$(ldd --version | awk '/ldd/{print $NF}')
-    else
-      this_glibc_ver=$osversion
-    fi
-    echo "This Linux distribution uses glibc $this_glibc_ver"
-    case $gamarch in
-      x86_64)
-	download_urls=$(echo -e "$download_urls" | grep "\-x86_64-")
-	gam_x86_64_glibc_vers=$(echo -e "$download_urls" | \
-		grep --only-matching 'glibc[0-9\.]*\.tar\.xz$' \
-	        | cut -c 6-9 )
-	useglibc="legacy"
-        for gam_glibc_ver in $gam_x86_64_glibc_vers; do
-          if version_gt $this_glibc_ver $gam_glibc_ver; then
-            useglibc="glibc$gam_glibc_ver"
-            echo_green "Using GAM compiled against $useglibc"
-            break
-          fi
-        done
-        download_url=$(echo -e "$download_urls" | grep "$useglibc")
-	;;
-      arm|arm64|aarch64)
-        download_urls=$(echo -e "$download_urls" | grep "\-aarch64-")
-        gam_arm64_glibc_vers=$(echo -e "$download_urls" | \
-                grep --only-matching 'glibc[0-9\.]*\.tar\.xz$' \
-                | cut -c 6-9 )
-        useglibc="legacy"
-        for gam_glibc_ver in $gam_arm64_glibc_vers; do
-          if version_gt $this_glibc_ver $gam_glibc_ver; then
-            useglibc="glibc$gam_glibc_ver"
-            echo_green "Using GAM compiled against $useglibc"
-            break
-          fi
-        done
-        download_url=$(echo -e "$download_urls" | grep "$useglibc")
-	;;
-      *)
-        echo_red "ERROR: this installer currently only supports x86_64 and arm64 Linux. Looks like you're running on $gamarch. Exiting."
-        exit
-    esac
-    ;;
-  [Mm]ac[Oo][sS]|[Dd]arwin)
-    gamos="macos"
-    fullversion=$(sw_vers -productVersion)
-    # override osversion only if it wasn't set by cli arguments
-    osversion=${osversion:-${fullversion:0:2}}
-    download_urls=$(echo -e "$download_urls" | grep "\-macos-")
-    case $gamarch in
-      x86_64)
-        download_url=$(echo -e "$download_urls" | grep "\-x86_64")
-	minimum_version=13
-        ;;
-      arm|arm64|aarch64)
-        download_url=$(echo -e "$download_urls" | grep "\-aarch64")
-	minimum_version=14
-        ;;
-      *)
-        echo_red "ERROR: this installer currently only supports x86_64 and arm64 MacOS. Looks like you're running on ${gamarch}. Exiting."
-        exit
-	;;
-    esac
-    if [[ "$osversion" -ge "$minimum_version" ]]; then
-      echo_green "You are running MacOS ${fullversion}, good. Using GAM with ${download_url}."
-    else
-      echo_red "Sorry, you are running MacOS ${fullversion} but GAM on ${gamarch} requires MacOS ${minimum_version}. Exiting."
-      exit
-    fi
-    ;;
-  MINGW64_NT*)
-    gamos="windows"
-    echo "You are running Windows"
-    download_url=$(echo -e "$download_urls" | grep "\-windows-" | grep ".zip")
-    ;;
-  *)
-    echo_red "Sorry, this installer currently only supports Linux and MacOS. Looks like you're running on ${gamos}. Exiting."
-    exit
-    ;;
-esac
-
-# Temp dir for archive
-temp_archive_dir=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
-
-# Clean up after ourselves even if we are killed with CTRL-C
-trap "rm -rf $temp_archive_dir" EXIT
-
-# hack to grab the end of the URL which should be the filename.
-name=$(echo -e "$download_url" | rev | cut -f1 -d "/" | rev)
-
-echo_yellow "Downloading ${download_url} to $temp_archive_dir ($check_type)..."
-# Save archive to temp w/o losing our path
-(cd "$temp_archive_dir" && curl -O -L -s "${curl_opts[@]}" "$download_url")
-
-mkdir -p "$target_dir"
-
-echo_yellow "Extracting archive to $target_dir"
-if [[ "$name" =~ tar.xz|tar.gz|tar ]]; then
-  tar $strip_gam -xf "$temp_archive_dir"/"$name" -C "$target_dir"
-elif [[ "$name" == *.zip ]]; then
-  unzip -o "${temp_archive_dir}/${name}" -d "${target_dir}"
-else
-  echo "I don't know what to do with files like ${name}. Giving up."
-  exit 1
-fi
-rc=$?
-if (( $rc != 0 )); then
-  echo_red "ERROR: extracting the GAM archive with tar failed with error $rc. Exiting."
-  exit
-else
-  echo_green "Finished extracting GAM archive."
-fi
-
-# Update profile to add gam command
-if [ "$update_profile" = true ]; then
-  alias_line="alias gam=\"${target_dir// /\\ }/$target_gam\""
-  if [ "$gamos" == "linux" ]; then
-    update_profile "$HOME/.bash_aliases" 0 || update_profile "$HOME/.bash_profile" 0 || update_profile "$HOME/.bashrc" 0
-    update_profile "$HOME/.zshrc" 0
-  elif [ "$gamos" == "macos" ]; then
-    update_profile "$HOME/.bash_aliases" 0 || update_profile "$HOME/.bash_profile" 0 || update_profile "$HOME/.bashrc" 0 || update_profile "$HOME/.profile" 1
-    update_profile "$HOME/.zshrc" 1
-  fi
-else
-  echo_yellow "skipping profile update."
-fi
-
-if [ "$upgrade_only" = true ]; then
-  echo_green "Here's information about your GAM upgrade:"
-  "$target_dir/$target_gam" version extended
-  rc=$?
-  if (( $rc != 0 )); then
-    echo_red "ERROR: Failed running GAM for the first time with return code $rc. Please report this error to GAM mailing list. Exiting."
-    exit
-  fi
-
-  echo_green "GAM upgrade complete!"
-  exit
-fi
-
-# Set config command
-#config_cmd="config no_browser false"
-
-while true; do
-  read -p "Can you run a full browser on this machine? (usually Y for MacOS, N for Linux if you SSH into this machine) " yn
-  case $yn in
-    [Yy]*)
-      break
-      ;;
-    [Nn]*)
-#      config_cmd="config no_browser true"
-      touch "$target_dir/gam/nobrowser.txt" > /dev/null 2>&1
-      break
-      ;;
-    *)
-      echo_red "Please answer yes or no."
-      ;;
-  esac
-done
-echo
-
-project_created=false
-while true; do
-  read -p "GAM is now installed. Are you ready to set up a Google API project for GAM? (yes or no) " yn
-  case $yn in
-    [Yy]*)
-      if [ "$adminuser" == "" ]; then
-        read -p "Please enter your Google Workspace admin email address: " adminuser
-      fi
-#      "$target_dir/$target_gam" $config_cmd create project $adminuser
-      "$target_dir/$target_gam" create project $adminuser
-      rc=$?
-      if (( $rc == 0 )); then
-        echo_green "Project creation complete."
-        project_created=true
-        break
-      else
-        echo_red "Project creation failed. Trying again. Say N to skip project creation."
-      fi
-      ;;
-    [Nn]*)
-      echo -e "\nYou can create an API project later by running:\n\ngam create project\n"
-      break
-      ;;
-    *)
-      echo_red "Please answer yes or no."
-      ;;
-  esac
-done
-
-admin_authorized=false
-while $project_created; do
-  read -p "Are you ready to authorize GAM to perform Google Workspace management operations as your admin account? (yes or no) " yn
-  case $yn in
-    [Yy]*)
-#      "$target_dir/$target_gam" $config_cmd oauth create $adminuser
-      "$target_dir/$target_gam" oauth create $adminuser
-      rc=$?
-      if (( $rc == 0 )); then
-        echo_green "Admin authorization complete."
-        admin_authorized=true
-        break
-      else
-        echo_red "Admin authorization failed. Trying again. Say N to skip admin authorization."
-      fi
-      ;;
-     [Nn]*)
-       echo -e "\nYou can authorize an admin later by running:\n\ngam oauth create\n"
-       break
-       ;;
-     *)
-       echo_red "Please answer yes or no."
-       ;;
-  esac
-done
-
-service_account_authorized=false
-while $admin_authorized; do
-  read -p "Are you ready to authorize GAM to manage Google Workspace user data and settings? (yes or no) " yn
-  case $yn in
-    [Yy]*)
-      if [ "$regularuser" == "" ]; then
-        read -p "Please enter the email address of a regular Google Workspace user: " regularuser
-      fi
-      echo_yellow "Great! Checking service account scopes.This will fail the first time. Follow the steps to authorize and retry. It can take a few minutes for scopes to PASS after they've been authorized in the admin console."
-#      "$target_dir/$target_gam" $config_cmd user $regularuser check serviceaccount
-      "$target_dir/$target_gam" user $regularuser check serviceaccount
-      rc=$?
-      if (( $rc == 0 )); then
-        echo_green "Service account authorization complete."
-        service_account_authorized=true
-        break
-      else
-        echo_red "Service account authorization failed. Confirm you entered the scopes correctly in the admin console. It can take a few minutes for scopes to PASS after they are entered in the admin console so if you're sure you entered them correctly, go grab a coffee and then hit Y to try again. Say N to skip admin authorization."
-      fi
-      ;;
-     [Nn]*)
-       echo -e "\nYou can authorize a service account later by running:\n\ngam user $adminuser check serviceaccount\n"
-       break
-       ;;
-     *)
-       echo_red "Please answer yes or no."
-       ;;
-  esac
-done
-
-echo_green "Here's information about your new GAM installation:"
-#"$target_dir/$target_gam" $config_cmd save version extended
-"$target_dir/$target_gam" version extended
-rc=$?
-if (( $rc != 0 )); then
-  echo_red "ERROR: Failed running GAM for the first time with $rc. Please report this error to GAM mailing list. Exiting."
-  exit
-fi
-
-echo_green "GAM installation and setup complete!"
-if [ "$update_profile" = true ]; then
-  echo_green "Please restart your terminal shell or to get started right away run:\n\n$alias_line"
-fi

src/tools/gen-wix-xml-filelist.py

@@ -1,58 +1,23 @@
-import os
-import sys
 import uuid
+from lxml import etree
+import sys
 
-source_dir = sys.argv[1]
-template_file = sys.argv[2]
-target_file = sys.argv[3]
+# Hacky solution to create a Guid for all files
+# so Wix is happy and Guid is stable every time.
+# uuid5 is used for the Guid and the input is the
+# source filename so the Guid will be the same
+# every time as long as the source file name is
+# the same.
 
-existing_components = {
-    'gam.exe': '''      <Component Id="gam_exe" Guid="d046ea24-c9f8-40ca-84db-70b0119933ff">
-        <File Name="gam.exe" KeyPath="yes" />
-        <Environment Id="PATH" Name="PATH" Value="[INSTALLFOLDER]" Permanent="yes" Part="last" Action="set" System="yes" />
-      </Component>
-''',
-    'LICENSE': '''      <Component Id="license" Guid="c76864c5-d005-44d5-bb7c-a27e5923792d">
-        <File Name="LICENSE" KeyPath="yes" />
-      </Component>
-''',
-    'gam-setup.bat': '''      <Component Id="gam_setup_bat" Guid="5e6bbacb-d86f-4d80-a10b-89b81ee63fcb">
-        <File Name="gam-setup.bat" KeyPath="yes" />
-      </Component>
-''',
-    'GamCommands.txt': '''      <Component Id="GamCommands_txt" Guid="a2dca862-b222-469e-a637-95ea2a1c53e7">
-        <File Name="GamCommands.txt" KeyPath="yes" />
-      </Component>
-''',
-    'GamUpdate.txt': '''      <Component Id="GamUpdate_txt" Guid="1b7cdd48-0fff-4943-a219-102fcd14c755">
-        <File Name="GamUpdate.txt" KeyPath="yes" />
-      </Component>
-''',
-    'cacerts.pem': '''      <Component Id="cacerts_pem" Guid="61fe2b2d-1646-4bed-b844-193965e97727">
-        <File Name="cacerts.pem" KeyPath="yes" />
-      </Component>
-''',
-}
-
-component_xml = ''
-all_files = []
-for root, dirs, files in os.walk(source_dir):
-    for filename in files:
-        relpath = os.path.relpath(root, source_dir)
-        if relpath == '.':
-            all_files.append(filename)
-        else:
-            all_files.append(os.path.join(relpath, filename))
-all_files.sort()
-for filename in all_files:
-    component_xml += existing_components.get(filename,
-                                             f'      <Component>\n        <File Name="{filename}" KeyPath="yes"/>\n      </Component>\n')
-
-with open(template_file, 'r') as f:
-    template = f.read()
-
-full_xml = template.replace('REPLACE_ME_WITH_FILE_COMPONENTS', component_xml)
-
-with open(target_file, 'w') as f:
-    f.write(full_xml)
+rewrite_file = sys.argv[1]
 
+with open(rewrite_file, 'rb') as f:
+    input_xml = f.read()
+root = etree.fromstring(input_xml)
+for elem in root.getiterator():
+    if 'Guid' in elem.attrib:
+        source = elem.getchildren()[0].attrib['Source']
+        stable_uuid = str(uuid.uuid5(uuid.NAMESPACE_URL, source))
+        elem.attrib['Guid'] = stable_uuid
+with open(rewrite_file, 'w') as f:
+  f.write(etree.tostring(root).decode())