Ensure omnibus on windows can be rebuilt multiple times

.github/workflows/verify.yml

@@ -19,7 +19,7 @@ permissions:
 on:
   push:
     branches:
-      - '*'
+      - 'master'
   pull_request:
     branches:
       - '*'
@@ -97,6 +97,8 @@ jobs:
         with:
           repository: rapid7/metasploit-framework
           path: metasploit-framework
+          # If testing a custom branch is required
+          # ref: 'update-bundler-version'
 
       - name: Run omnibus
         run: |
@@ -126,6 +128,17 @@ jobs:
           docker rm -v $id
           docker rmi ${TEMP_DOCKER_IMAGE}
 
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: metasploit-${{ matrix.docker.name }}-installers
+          path: |
+            metasploit-omnibus/pkg/*.pkg
+            metasploit-omnibus/pkg/*.rpm
+            metasploit-omnibus/pkg/*.msi
+            metasploit-omnibus/pkg/*.deb
+          retention-days: 1
+
   docker_intel:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 180
@@ -215,6 +228,17 @@ jobs:
         env:
           LINUX32: ${{ matrix.docker.linux32 }}
 
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: metasploit-${{ matrix.docker.name }}-installers
+          path: |
+            metasploit-omnibus/pkg/*.pkg
+            metasploit-omnibus/pkg/*.rpm
+            metasploit-omnibus/pkg/*.msi
+            metasploit-omnibus/pkg/*.deb
+          retention-days: 1
+
   osx:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 180
@@ -255,6 +279,17 @@ jobs:
           cd metasploit-omnibus
           make
 
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: metasploit-osx-installers
+          path: |
+            metasploit-omnibus/pkg/*.pkg
+            metasploit-omnibus/pkg/*.rpm
+            metasploit-omnibus/pkg/*.msi
+            metasploit-omnibus/pkg/*.deb
+          retention-days: 1
+
   windows:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 180
@@ -338,6 +373,17 @@ jobs:
           cd metasploit-omnibus
           make dependencies
 
-          rem Don't run the main build itslef under `make`, as the process will be spawned under msys2
+          rem Don't run the main build itself under `make`, as the process will be spawned under msys2
           rem and the ridk.cmd Ruby installer will forcibly kill the msys2 process before attempting to install ruby
           ruby bin/omnibus build metasploit-framework
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: metasploit-windows-installers
+          path: |
+            metasploit-omnibus/pkg/*.pkg
+            metasploit-omnibus/pkg/*.rpm
+            metasploit-omnibus/pkg/*.msi
+            metasploit-omnibus/pkg/*.deb
+          retention-days: 1

config/projects/metasploit-framework.rb

@@ -4,6 +4,7 @@
 
 install_dir "#{default_root}/metasploit-framework"
 
+# Version is extracted from the latest Git tag found in the local Git repository
 build_version Omnibus::BuildVersion.semver + "-1rapid7"
 build_iteration 1
 

config/software/metasploit-framework.rb

@@ -1,8 +1,17 @@
 name "metasploit-framework"
+
+# Detect a local checkout of metasploit-framework at '../metasploit-framework' - i.e. for the scenario of:
+# - c:/temp/metasploit-omnibus
+# - c:/temp/metasploit-framework (A local checkout of framework to use during the build process)
+# but try and use 'C:/metasploit-framework' - as that's the metasploit-omnibus artifacts output directory
+def has_windows_metasploit_framework_repo?
+  windows? && File.exist?('../metasploit-framework') && File.expand_path(File.join(Dir.pwd, "..", "metasploit-framework")) != "c:/metasploit-framework"
+end
+
 if linux? && File.exist?("/metasploit-framework")
   # supply current version of metasploit-framework at root of filesystem
   source path: "/metasploit-framework"
-elsif windows? && File.exist?('../metasploit-framework')
+elsif has_windows_metasploit_framework_repo?
   # supply current version of metasploit-framework relative to the current directory
   source path: "../metasploit-framework"
 else
@@ -79,12 +88,20 @@
         vars: { install_dir: install_dir }
   end
 
+  bundle "version", env: env
   bundle "config set force_ruby_platform true", env: env
   bundle_env = with_standard_compiler_flags(with_embedded_path)
   bundle_env['MAKE'] = 'make -j4'
   bundle "install --jobs=4", env: bundle_env
 
   if windows?
+    # Ensure we additionally copy out 'libssp-0.dll', which is required for multiple gems:
+    #   > dumpbin /dependents  C:/metasploit-framework/embedded/lib/ruby/gems/3.1.0/gems/msgpack-1.6.1/lib/msgpack/msgpack.so
+    #       ...
+    #       libssp-0.dll
+    #       ...
+    copy "#{install_dir}/embedded/msys64/ucrt64/bin/libssp-0.dll", "#{install_dir}/embedded/bin/libssp-0.dll"
+
     delete "#{install_dir}/embedded/msys64"
   end
   copy "#{project_dir}/Gemfile.lock", "#{install_dir}/embedded/framework/Gemfile.lock"
@@ -154,4 +171,12 @@
       end
     end
   end
+
+  # Workaround for a Windows bug with chef r7_9.0.23_custom that allows the `.git` folders through
+  # into the final build result, leading to the .exe being an extra 1gb in size
+  block do
+    self.project.exclusions.each do |exclusion|
+      Pathname(install_dir).glob(exclusion).each(&:rmtree)
+    end
+  end
 end

config/software/ruby-windows.rb

@@ -15,7 +15,7 @@
 #
 
 name "ruby-windows"
-default_version "3.1.4-1"
+default_version "3.1.5-1"
 
 if windows_arch_i386?
   relative_path "rubyinstaller-#{version}-x86"
@@ -58,6 +58,10 @@
     source sha256: "6701088607ea4b587a31af76d75cb3fe9f7bcd75fc175cffcca22369ebb6331d"
   end
 
+  version "3.1.5-1" do
+    source sha256: "f31eece5b5c64563829117d41c09ed87572c595e5d64a525d49c1dd9c50dccca"
+  end
+
   source url: "https://github.com/oneclick/rubyinstaller2/releases/download/rubyinstaller-#{version}/rubyinstaller-#{version}-x64.7z"
 end
 

config/software/ruby.rb

@@ -26,7 +26,7 @@
 # the default versions should always be the latest release of ruby
 # if you consume this definition it is your responsibility to pin
 # to the desired version of ruby. don't count on this not changing.
-default_version "3.1.4"
+default_version "3.1.5"
 
 dependency "zlib"
 dependency "openssl"
@@ -45,6 +45,7 @@
 version("3.2.2")      { source sha256: "96c57558871a6748de5bc9f274e93f4b5aad06cd8f37befa0e8d94e7b8a423bc" }
 version("3.2.0")      { source sha256: "daaa78e1360b2783f98deeceb677ad900f3a36c0ffa6e2b6b19090be77abc272" }
 version("3.1.4")      { source sha256: "a3d55879a0dfab1d7141fdf10d22a07dbf8e5cdc4415da1bde06127d5cc3c7b6" }
+version("3.1.5")      { source sha256: "3685c51eeee1352c31ea039706d71976f53d00ab6d77312de6aa1abaf5cda2c5" }
 version("3.1.3")      { source sha256: "5ea498a35f4cd15875200a52dde42b6eb179e1264e17d78732c3a57cd1c6ab9e" }
 version("3.1.2")      { source sha256: "61843112389f02b735428b53bb64cf988ad9fb81858b8248e22e57336f24a83e" }
 version("3.1.1")      { source sha256: "fe6e4782de97443978ddba8ba4be38d222aa24dc3e3f02a6a8e7701c0eeb619d" }

config/software/rubygems.rb

@@ -28,7 +28,7 @@
   dependency "ruby"
 end
 
-default_version "3.2.22"
+default_version "3.5.10"
 
 if version && !source
   # NOTE: 2.1.11 is the last version of rubygems before the 2.2.x change to native gem install location
@@ -40,7 +40,9 @@
   # we pin the previously known tarballs.
   known_tarballs = {
     "3.1.4" => "d117187a8f016cbe8f52011ae02e858b",
-    "3.2.22"=> "b128d5493da2ec7a1da49a7189c04b35",
+    "3.2.22" => "b128d5493da2ec7a1da49a7189c04b35",
+    "3.3.26" => "ba171c52fd9beda6dac7194413601795",
+    "3.5.10" => "70f46c096b4e11c42b0190cc3e3375e2"
   }
   known_tarballs.each do |vsn, md5|
     version vsn do