Internal change.

glazier/lib/actions/drivers.py

@@ -91,7 +91,8 @@ def _AddDriverSYS(self, mount_dir):
       execute.execute_binary(
           constants.SYS_PNPUTIL,
           ['/add-driver', f'{mount_dir}*.inf', '/subdirs'],
-          shell=True)
+          shell=False,
+      )
     except execute.Error as e:
       raise ActionError(
           f'Error adding drivers to DriverStore from {mount_dir}.') from e
@@ -117,7 +118,8 @@ def _AddDriverWinPE(self, mount_dir):
       execute.execute_binary(
           constants.WINPE_DISM,
           ['/Image:c:', '/Add-Driver', f'/Driver:{mount_dir}', '/Recurse'],
-          shell=True)
+          shell=False,
+      )
     except execute.Error as e:
       raise ActionError(
           f'Error applying drivers to image from {mount_dir}.') from e
@@ -147,11 +149,16 @@ def _ProcessWim(self, wim_file):
     # mount image
     try:
       execute.execute_binary(
-          dism_path, [
-              '/Mount-Image', f'/ImageFile:{wim_file}',
-              f'/MountDir:{mount_dir}', '/ReadOnly', '/Index:1'
+          dism_path,
+          [
+              '/Mount-Image',
+              f'/ImageFile:{wim_file}',
+              f'/MountDir:{mount_dir}',
+              '/ReadOnly',
+              '/Index:1',
           ],
-          shell=True)
+          shell=False,
+      )
     except execute.Error as e:
       raise ActionError(f'Unable to mount image {wim_file}.') from e
 
@@ -166,6 +173,7 @@ def _ProcessWim(self, wim_file):
       execute.execute_binary(
           dism_path,
           ['/Unmount-Image', f'/MountDir:{mount_dir}', '/Discard'],
-          shell=True)
+          shell=False,
+      )
     except execute.Error as e:
       raise ActionError('Error unmounting image. Unable to continue.') from e

glazier/lib/actions/drivers_test.py

@@ -60,10 +60,29 @@ def test_driver_wim(self, mock_createdirectories, mock_execute_binary,
         show_progress=True)
     mock_verifyshahash.assert_called_with(mock.ANY, local, sha_256)
     cache = drivers.constants.SYS_CACHE
-    mock_execute_binary.assert_called_with(
-        f'{drivers.constants.WINPE_SYSTEM32}/dism.exe',
-        ['/Unmount-Image', f'/MountDir:{cache}\\Drivers\\', '/Discard'],
-        shell=True)
+    mock_execute_binary.assert_has_calls([
+        mock.call(
+            drivers.constants.WINPE_DISM,
+            [
+                '/Mount-Image',
+                f'/ImageFile:{local}',
+                f'/MountDir:{cache}\\Drivers\\',
+                '/ReadOnly',
+                '/Index:1',
+            ],
+            shell=False,
+        ),
+        mock.call(
+            drivers.constants.SYS_PNPUTIL,
+            ['/add-driver', f'{cache}\\Drivers\\*.inf', '/subdirs'],
+            shell=False,
+        ),
+        mock.call(
+            drivers.constants.WINPE_DISM,
+            ['/Unmount-Image', f'/MountDir:{cache}\\Drivers\\', '/Discard'],
+            shell=False,
+        ),
+    ])
     mock_createdirectories.assert_called_with('%s\\Drivers\\' % cache)
 
     # Invalid format
@@ -90,6 +109,67 @@ def test_driver_wim(self, mock_createdirectories, mock_execute_binary,
     with self.assert_raises_with_validation(drivers.ActionError):
       dw.Run()
 
+  @mock.patch.object(drivers.winpe, 'check_winpe', autospec=True)
+  @mock.patch.object(BuildInfo, 'ReleasePath')
+  @mock.patch.object(BuildInfo, 'Branch')
+  @mock.patch('glazier.lib.download.Download.VerifyShaHash', autospec=True)
+  @mock.patch('glazier.lib.download.Download.DownloadFile', autospec=True)
+  @mock.patch.object(drivers.execute, 'execute_binary', autospec=True)
+  @mock.patch.object(drivers.file_util, 'CreateDirectories', autospec=True)
+  def test_driver_wim_winpe(
+      self,
+      mock_createdirectories,
+      mock_execute_binary,
+      mock_downloadfile,
+      mock_verifyshahash,
+      mock_branch,
+      mock_releasepath,
+      mock_check_winpe,
+  ):
+    bi = BuildInfo()
+    remote = '@Drivers/Lenovo/W54x-Win10-Storage.wim'
+    local = r'c:\W54x-Win10-Storage.wim'
+    sha_256 = 'D30F9DB0698C87901DF6824D11203BDC2D6DAAF0CE14ABD7C0A7B75974936748'
+    conf = {
+        'data': {'driver': [[remote, local, sha_256]]},
+        'path': ['/autobuild'],
+    }
+    mock_branch.return_value = 'stable'
+    mock_releasepath.return_value = '/'
+    mock_check_winpe.return_value = True
+
+    dw = drivers.DriverWIM(conf['data']['driver'], bi)
+    dw.Run()
+    cache = drivers.constants.SYS_CACHE
+    mock_execute_binary.assert_has_calls([
+        mock.call(
+            drivers.constants.WINPE_DISM,
+            [
+                '/Mount-Image',
+                f'/ImageFile:{local}',
+                f'/MountDir:{cache}\\Drivers\\',
+                '/ReadOnly',
+                '/Index:1',
+            ],
+            shell=False,
+        ),
+        mock.call(
+            drivers.constants.WINPE_DISM,
+            [
+                '/Image:c:',
+                '/Add-Driver',
+                f'/Driver:{cache}\\Drivers\\',
+                '/Recurse',
+            ],
+            shell=False,
+        ),
+        mock.call(
+            drivers.constants.WINPE_DISM,
+            ['/Unmount-Image', f'/MountDir:{cache}\\Drivers\\', '/Discard'],
+            shell=False,
+        ),
+    ])
+
   @parameterized.named_parameters(
       ('_invalid_arg_type_1', 'String', None),
       ('_invalid_arg_type_2', [[1, 2, 3]], None),

glazier/lib/actions/updates.py

@@ -94,10 +94,14 @@ def _ProcessMsu(self, msu_file):
     # Apply updates to  image
     try:
       execute.execute_binary(
-          constants.WINPE_DISM, [
-              '/image:c:\\', '/Add-Package', f'/PackagePath:{msu_file}',
-              f'/ScratchDir:{scratch_dir}'
+          constants.WINPE_DISM,
+          [
+              '/image:c:\\',
+              '/Add-Package',
+              f'/PackagePath:{msu_file}',
+              f'/ScratchDir:{scratch_dir}',
           ],
-          shell=True)
+          shell=False,
+      )
     except execute.Error as e:
       raise ActionError(f'Failed to process update {msu_file}') from e

glazier/lib/actions/updates_test.py

@@ -60,12 +60,15 @@ def test_update_msu(self, mock_createdirectories, mock_execute_binary,
     mock_verifyshahash.assert_called_with(mock.ANY, local, sha_256)
     cache = updates.constants.SYS_CACHE
     mock_execute_binary.assert_called_with(
-        f'{updates.constants.SYS_SYSTEM32}/dism.exe', [
-            '/image:c:\\', '/Add-Package',
+        updates.constants.WINPE_DISM,
+        [
+            '/image:c:\\',
+            '/Add-Package',
             '/PackagePath:c:\\KB2990941-v3-x64.msu',
-            f'/ScratchDir:{cache}\\Updates\\'
+            f'/ScratchDir:{cache}\\Updates\\',
         ],
-        shell=True)
+        shell=False,
+    )
     mock_createdirectories.assert_called_with('%s\\Updates\\' % cache)
 
     # Invalid format