Changes to Embedded Servicing

It's been a while since I've made a post - ten months, actually.  So this one will be big, and hopefully address a number of issues.

I've handled a lot of questions over the past couple of weeks concerning the November set of Embedded security updates, the format of the updates on the OEM Secure Site, and some other things.  I want to get as much info out to as many people as possible and hopefully answer all the questions you may have.

First, let me apologize for the randomization some actions taken over the past few months have caused - it's not my habit to cause confusion or spread FUD (Fear, Uncertainty, and Doubt).  The changes were made to improve the overall servicing story, or to ensure we were delivering the proper updates, and in some cases, the changes were done before we could get advance communication about the changes out to you.  As you can tell, this is the first broad communication explaining what's happening and why, and it's not through official OEM communication channels - that's still waiting...

So what are some of the changes seen over the past few months?  Well, the biggest one was the change to the IMG format for all updates.  When we moved the servicing duties from the Embedded team to Windows Serviceability (WinSE), the primary goal was to integrate the servicing work we were doing into the existing process WinSE was using.  WinSE releases everything for the OEM channels on CD, so in order to use the existing release process, we had to have a CD as well.  Once the CD was being built, it made sense to release the CD directly rather than pull all the data off the CD and push it all out separately.

So what is an IMG file?  It's just an ISO, renamed as IMG (actually, I think it's more complicated than that, but for practical purposes, that's accurate).  If you download the IMG file, and then rename it with an ISO extension, you can manipulate it like any other ISO file with any software that can read and process ISO's.  Personally, I use ISORecorder from Alex Feinman, and Virtual CD Control Panel (unsupported) from Microsoft, to work with ISO's on my development machine...

OK, so why is there only one IMG file being released?  There are four flavors of updates, after all - XPE SP1 and XPE SP2 versions of both componentized updates and updates for use with the Desktop QFE Installer (DQI).  And if you go to the OEM Secure Site, each link in each place links to the same CD image.  Well, that's almost too easy to answer - everything's on one CD.  But now I hear you ask: Why did you do that?  The DQI usable updates always used to be separate.

OK, here's the problem I had to solve - Windows XP SP1 hit it's end of life (EOL) date in October 2006.  Windows XP Embedded SP1, however, doesn't hit its EOL until April 2007 (check out the Lifecycle page for that info).  What this means is that WinSE is no longer releasing XP SP1 updates, but we have to continue making XPE SP1 updates available.  Since no one is releasing updates for XP SP1 anymore, I needed to handle the release myself.  Rather than go back 12 months and start doing my own out of band releases, I decided the easiest way to go was to put the updates on the Embedded CD.  I already had the packages, since I use them to build the componentized updates - it was a simple matter of creating a new folder on the CD, listing them in a new manifest spreadsheet, and releasing them like normal.

This also helps to explain the most recent question I've gotten - why were there no new componentized releases on the November CD?  The rollup packages are still from October.  This one is a bit more process oriented - there is a non-zero non-trivial amount of work to be done to create the componentized updates, most of it involving testing.  Because of this, and because we need some time to do tools and other maintenance work, we're sticking to a bi-monthly release schedule for the componentized rollup packages - this happens on the even numbered months (February, April, June, August, October, and December).  However, there is the occasional update or two that gets released for XP Pro in the odd-numbered months - we componentize those in the next bi-monthly update (for example, the December rollup will contain the updates releases in November as well as December).  However, in order to make sure that devices in the field can be as secure as desktop machines, we release the DQI usable versions every month.  The first month to happened was November, and what you saw was a CD with October Embedded packages, but October and November DQI updates.

The only remaining issue with releasing XPE SP1 updates is that there are no longer any security bulletins nor KB articles that reference XP SP1.  I'm trying to find any documentation I can, but I'm not hopeful anything specific to SP1 will be available.

And now for something completely different... Well, not completely different, but different.  Starting next year, the United States and a bunch of other countries are changing the way they handle Daylight Savings Time.  What this means is that Windows XP has to know about the changes so it can change the PC clock correctly.  The available of an update for XP Pro has been well documented - there will be an Embedded version.