Official Windows installers are not interoperable with those built locally with Tools\msi\buildrelease.bat

[adang1345]

Bug report

For some of my projects, I build my own Windows installers from source using the Tools\msi\buildrelease.bat script. For Python 3.9.7 and higher, the installers I build locally are no longer interoperable with those that are released officially. For example, if I have an official Python 3.9.13 installation, I can't upgrade it using a locally-built Python 3.9.14 installer. My locally-built installer does not recognize that there already exists a 3.9.x installation that can be upgraded, and it asks me to do a completely new installation.

I traced the cause of this to #27458, which first appeared in Python 3.9.7. In particular, in the file Tools\msi\buildrelease.bat, the line

set RELEASE_URI=http://www.python.org/{arch}

was changed to

set RELEASE_URI=https://www.python.org/{arch}

However, based on my understanding, official releases still use the value http://www.python.org/{arch}, as evidenced by the line

ReleaseUri: http://www.python.org/{arch}

in https://github.com/python/release-tools/blob/master/windows-release/stage-msi.yml
The RELEASE_URI affects the GUIDs of the installers so that installers built with different RELEASE_URI values cannot be used to upgrade each other.

For the sake of consistency, I propose that we change RELEASE_URI in Tools\msi\buildrelease.bat back to its original value of http://www.python.org/{arch}. I tried making this change locally, and that fixed my interoperability issue. I can make a pull request as well.

Your environment

• CPython versions tested on: 3.9.7 and higher
• Operating system and architecture: Windows 64-bit

(originally posted on https://discuss.python.org/t/divergence-between-official-releases-and-those-built-with-tools-msi-buildrelease-bat/18927)

[zooba]

Agreed, this one should not have changed, and should be changed back.

The use of a URI here is to allow alternative distributors to have an easy way to choose what their discriminator should be. Arguably, the motivating use case here should be using a different URI from python.org releases anyway, but provided it's for private use only I don't really have a concern.

[zooba]

Maybe when changing it back, add a comment, so that the next person to run a regex for issues knows not to change it.

[zooba]

Thanks for the fix!