6 replies to this topic

[Matthias1967]

Hello,

I am writing some custom actions that do change the system (modify files already present).
In order to ensure that rollback is possible, my code looks basically like this (I am using InstallScript, but the issue is language-independent):

[Zweitze]

The solution is easy. You may have noticed that Rollback CAs are scheduled just like normal Deferred CAs, between InstallInitialize and InstallFinalize. In other words, there is no decidated sequence for all Rollback activities.

Well: The Rollback CA will be called, when an error occurs in an actions AFTER the Rollback CA. It will NOT be called when an error occurs in an action BEFORE the Rollback CA.

So, in your project MyCA should be a Deferred CA, and you sequence should look like:

InstallInitialize
[...]
MyCA_Deferred
MyCA_Rollback
[...]
MyCA_Commit
[...]
InstallFinalize

Regardless of that, it wouldn't hurt to be paranoid and program defensively in the Rollback. After all, something went wrong (out of memory? out of disk?) and the situation is tense. When you did that, consider to put MyCA_Rollback just before MyCA_Deferred. In that case, the rollback is also called when the error occurs during MyCA_Deferred.

[Matthias1967]

Hello Zweitze,

My sequence looks similar to your example, except that I have scheduled MyCA_Rollback before MyCA_Deferred. Indeed, MyCA is a deferred CA, and I am aware about the how rollback proceeds.

I put MyCA_Rollback before MyCA in order to call it if an error occurs in MyCA.
So in a sequence with 3 coded CAs (plus 3 setters), I may get the problem I asked about, namely that backup (part of MyCA) fails and then the rollback CA corrupts the system.

Regards,

Matthias

[Zweitze]

There's no problem scheduling MyCA_Rollback before MyCA_Deferred, except for one reason: Now the rollback CA will also be called when MyCA_Deferred fails. Which means that your backup may not be complete, therefore the Rollback must be able to detect whether the backup is valid and should be used.

You have two alternatives.
First, consider putting the modifications in MyCA_Commit. MyCA_Rollback should then only remove the backup. This alternative is only valid when you are sure that the modification will succeed - MyCA_Commit cannot fail. The last moment for that test is MyCA_Deferred, so that CA should create a backup and verify that the modifications will be valid.
The second alternative is along your opening post. When you are not able do validate a backup, you should split MyCA_Deferred into a backup CA and modification CA, and MyCA_Rollback into a Restore CA and a Cleanup CA.

[Stefan Krueger]

[VBScab]

[Zweitze]