dotfiles: add iperf3 and nasm to the per-user winget installs

[dotfiles] / setup-windows-with-uac.ps1

#Requires -RunAsAdministrator\r
<#\r
  setup-windows-with-uac.ps1\r
  Elevated portion of the Windows provisioning. Invoked by setup-windows.bat\r
  via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
\r
  What this installs / configures:\r
    - OpenSSH Client capability (the ssh.exe rsync shells out to, and the\r
      System32 libcrypto.dll the release's own ssh.exe links against)\r
    - ssh-agent set to automatic + started\r
    - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22\r
    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine\r
      PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this\r
      architecture\r
    - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
      Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
    - Windows Driver Kit 10.0.26100\r
    - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer\r
      (wpa.exe) - on the machine PATH\r
    - Performance Log Users membership for one ordinary account, so it can run\r
      user-mode ETW sessions (xperf -start ... -on <provider>) without elevation.\r
      Kernel traces are NOT covered - the NT Kernel Logger is admin-only; see the\r
      step for what was measured.\r
\r
  Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
    Professional : https://aka.ms/vs/17/release/vs_professional.exe\r
    Enterprise   : https://aka.ms/vs/17/release/vs_enterprise.exe\r
#>\r
\r
param(\r
    # Account to put in Performance Log Users (see the "ETW session control"\r
    # step, which runs first). Defaults to the interactive console user, but\r
    # setup-windows.bat passes it explicitly: with over-the-shoulder elevation\r
    # THIS script runs as the administrator whose credentials went into the UAC\r
    # prompt, not as the user who started the batch file, so $env:USERNAME here\r
    # is the wrong answer.\r
    #\r
    # Pass an empty string to skip it; adding an account later is one\r
    # `net localgroup` away.\r
    [string] $TraceUser = '',\r
\r
    # Do the ETW step and nothing else. It is a group membership and no\r
    # downloads, where a full run is dominated by the three Visual Studio\r
    # passes, which take minutes even when they have nothing to do. It is why\r
    # that step runs FIRST: -EtwRightsOnly is then just an early exit rather\r
    # than a set of guards down the rest of the script.\r
    [switch] $EtwRightsOnly\r
)\r
\r
$ErrorActionPreference = 'Stop'\r
\r
function Write-Step([string]$Msg) {\r
    Write-Host "`n==> $Msg" -ForegroundColor Cyan\r
}\r
\r
function Assert-ExitCode([int]$Code, [string]$Step) {\r
    # 0 = success, 3010 = success + reboot required\r
    if ($Code -notin @(0, 3010)) {\r
        throw "$Step failed with exit code $Code"\r
    }\r
    if ($Code -eq 3010) {\r
        Write-Host "    [reboot required after $Step]" -ForegroundColor Yellow\r
    }\r
}\r
\r
function Show-VsSetupLogs {\r
    # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
    # this script runs elevated, that %TEMP% belongs to the elevated user and is\r
    # readable here even when it is NOT readable by the non-elevated caller. Fold\r
    # only the NEWEST installer + bootstrapper log into the transcript (the setup\r
    # engine log is where per-component / product errors actually appear) and\r
    # keep it short so the transcript stays readable.\r
    Write-Host "`n==> Collecting VS Installer logs from $env:TEMP" -ForegroundColor Cyan\r
    $recent = Get-ChildItem $env:TEMP -Filter 'dd_*.log' -ErrorAction SilentlyContinue |\r
              Where-Object { $_.LastWriteTime -gt (Get-Date).AddMinutes(-15) }\r
    $picks = @()\r
    $picks += $recent | Where-Object { $_.Name -like 'dd_installer_*'    } | Sort-Object LastWriteTime | Select-Object -Last 1\r
    $picks += $recent | Where-Object { $_.Name -like 'dd_bootstrapper_*' } | Sort-Object LastWriteTime | Select-Object -Last 1\r
    $picks = $picks | Where-Object { $_ }\r
    if (-not $picks) {\r
        Write-Host '    (no VS Installer logs modified in the last 15 minutes)' -ForegroundColor Yellow\r
        return\r
    }\r
    foreach ($l in $picks) {\r
        Write-Host "`n----- $($l.Name) (tail) -----" -ForegroundColor Yellow\r
        Get-Content $l.FullName -Tail 40\r
    }\r
}\r
\r
function Invoke-VsModify {\r
    # Run one VS install/modify pass for a named group of components. Splitting\r
    # the install into separate passes makes it obvious WHICH group fails: each\r
    # call prints its label and exit code before Assert-ExitCode throws.\r
    param(\r
        [string]   $Label,\r
        [string[]] $Ids\r
    )\r
    Write-Step "VS2022: $Label"\r
    $addStr = ($Ids | ForEach-Object { "--add $_" }) -join ' '\r
    # --installPath must be quoted: it contains spaces ("C:\Program Files\...").\r
    # Windows PowerShell 5.1's Start-Process does not quote array elements, so we\r
    # hand-build a single string. Component IDs / flags have no spaces.\r
    $common = '--includeRecommended --quiet --norestart --wait'\r
    if ($script:InstallPath) {\r
        $argString = "modify --installPath `"$script:InstallPath`" $addStr $common --force"\r
    } else {\r
        # No existing install yet -> this first pass performs the base install.\r
        $argString = "$addStr $common"\r
    }\r
    Write-Host "    > $script:VsBootstrapper $argString" -ForegroundColor DarkGray\r
    $p = Start-Process -FilePath $script:VsBootstrapper -ArgumentList $argString -Wait -PassThru -NoNewWindow\r
    Write-Host "    exit code: $($p.ExitCode)"\r
    Assert-ExitCode $p.ExitCode "VS2022 ($Label)"\r
\r
    # After the first (fresh) install, re-detect the install path so subsequent\r
    # passes use `modify`.\r
    if (-not $script:InstallPath -and (Test-Path $script:VsWhere)) {\r
        $script:InstallPath = & $script:VsWhere -products '*' -property installationPath -format value |\r
                              Select-Object -First 1\r
    }\r
}\r
\r
# ---------------------------------------------------------------------------\r
# This runs in a separate elevated window that closes the moment it exits, so\r
# the non-elevated caller (setup-windows.bat) can't see what happened. Mirror\r
# all output to a log next to the script and exit with a real code so the\r
# caller can detect success/failure and show the log.\r
# ---------------------------------------------------------------------------\r
$LogFile  = Join-Path $PSScriptRoot 'setup-windows-uac.log'\r
$ExitCode = 0\r
try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {}\r
\r
try {\r
\r
# ---------------------------------------------------------------------------\r
# ETW session control for an ordinary account\r
#\r
# Creating or controlling an event tracing session - even a user-mode one naming\r
# a single provider - is checked against the security descriptor ETW keeps per\r
# provider GUID under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The\r
# default grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM,\r
# Administrators, the service accounts and BUILTIN\Performance Log Users, and to\r
# nobody else. Its own description says members "may ... enable trace providers,\r
# and collect event traces", and that is what membership buys:\r
#\r
#     xperf -start MySession -on Microsoft-Windows-Kernel-Process -f trace.etl\r
#     xperf -stop MySession\r
#\r
# runs unelevated for a member and is "Access is denied. (0x5)" for everyone\r
# else. Enough to trace your own application's providers without a UAC prompt.\r
#\r
# Membership is read into the access token at LOGON, so the account has to sign\r
# out and back in. Any NEW logon does it - an ssh login into this box is one,\r
# which is the quick way to check without dropping the desktop.\r
#\r
# WHAT THIS DOES NOT BUY: system-wide kernel traces. `xperf -on base` and\r
# `wpr -start` drive the NT Kernel Logger, which is reserved for Administrators\r
# and LocalSystem - Microsoft documents Performance Log Users access as\r
# explicitly NOT extending to it. Measured here, so that nobody repeats it: with\r
# the account in the group, SeSystemProfilePrivilege ("Profile system\r
# performance") granted to that group, and an explicit ACE giving the group\r
# TRACELOG_ACCESS_KERNEL_LOGGER on SystemTraceControlGuid - all three in place,\r
# across a reboot - xperf still answered\r
#\r
#     xperf: error: NT Kernel Logger: Access is denied. (0x5).\r
#\r
# It is not a check an ACE overrides. Those two grants were dropped again rather\r
# than left on the box earning nothing, and CPU sampling and whole-system traces\r
# are elevated work: run xperf, wpr or VTune from an Administrator prompt.\r
#\r
# Analysis needs none of this either way - wpa.exe opens an existing .etl as a\r
# plain user.\r
# ---------------------------------------------------------------------------\r
Write-Step 'ETW session control (non-elevated user-mode tracing)'\r
$PerfLogUsersSid = 'S-1-5-32-559'   # BUILTIN\Performance Log Users\r
try {\r
    # Fall back to the console user when the caller did not name one: with\r
    # over-the-shoulder elevation that is the person who started\r
    # setup-windows.bat, which is who wants to trace.\r
    $target = $TraceUser\r
    if (-not $target) {\r
        $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
        if ($target) { Write-Host "    No -TraceUser given; using the console user $target" }\r
    }\r
\r
    if (-not $target) {\r
        Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
        Write-Warning 'To do it later:'\r
        Write-Warning '    net localgroup "Performance Log Users" DOMAIN\user /add'\r
    } else {\r
        # Resolve to a SID first: it validates the name, and it is what the\r
        # membership check compares, so a member spelled ".\claude" in one place\r
        # and "LATISLAB\claude" in another is still recognised as the same account.\r
        $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
                        [System.Security.Principal.SecurityIdentifier])\r
\r
        # By SID, never by name: "Performance Log Users" is localised, and\r
        # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
        $group = Get-LocalGroup -SID $PerfLogUsersSid\r
\r
        # Get-LocalGroupMember throws on a group holding a SID that no longer\r
        # resolves (a known Windows 10 bug), so a failure to READ the membership\r
        # must not stop us from writing it - fall through and let the add report.\r
        $already = $false\r
        try {\r
            $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
                         Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
        } catch {\r
            Write-Host "    (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
        }\r
\r
        if ($already) {\r
            Write-Host "    OK: $target is already in $($group.Name)"\r
        } else {\r
            try {\r
                Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
            } catch {\r
                # "already a member" is only reachable when the enumeration above\r
                # failed, and is not an error. Matched on the type NAME rather\r
                # than in a typed catch clause: catch types are resolved when the\r
                # script is PARSED, before the LocalAccounts module has been\r
                # autoloaded, so naming the type there is a parse error that\r
                # would take the whole script down.\r
                if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
            }\r
            Write-Host "    Added $target to $($group.Name)"\r
        }\r
\r
        Write-Host ''\r
        Write-Host "    $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
        Write-Host '    Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
        Write-Host '        xperf -start T -on Microsoft-Windows-Kernel-Process -f trace.etl' -ForegroundColor Yellow\r
        Write-Host '        xperf -stop T' -ForegroundColor Yellow\r
    }\r
} catch {\r
    Write-Warning "Performance Log Users membership failed: $($_.Exception.Message)"\r
    Write-Warning 'Do it by hand with:'\r
    Write-Warning '    net localgroup "Performance Log Users" <user> /add'\r
}\r
\r
if ($EtwRightsOnly) {\r
    # `exit` inside the try still runs the finally below, so the transcript is\r
    # stopped and the log is left readable by the non-elevated caller.\r
    Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green\r
    exit 0\r
}\r
\r
\r
# ---------------------------------------------------------------------------\r
# Base tools via winget\r
# ---------------------------------------------------------------------------\r
\r
# ---------------------------------------------------------------------------\r
# OpenSSH Client\r
#\r
# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent\r
# from some Server images. Two things below want it: rsync does not speak ssh\r
# itself, it execs an ssh binary, and the release's own ssh.exe links against the\r
# libcrypto.dll this capability puts in System32. It also owns the ssh-agent\r
# service configured next, so a missing client is why that step would fail.\r
#\r
# Non-fatal, like the server half below: a box that cannot have it should still\r
# finish provisioning.\r
# ---------------------------------------------------------------------------\r
Write-Step 'OpenSSH Client'\r
try {\r
    $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |\r
            Select-Object -First 1\r
    if (-not $sshc) {\r
        Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'\r
    } elseif ($sshc.State -eq 'Installed') {\r
        Write-Host "    OK: $($sshc.Name) already installed"\r
    } else {\r
        Write-Host "    Installing $($sshc.Name) ..."\r
        $r = Add-WindowsCapability -Online -Name $sshc.Name\r
        if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Client]' -ForegroundColor Yellow }\r
    }\r
} catch {\r
    Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"\r
}\r
\r
# ---------------------------------------------------------------------------\r
# SSH agent\r
# ---------------------------------------------------------------------------\r
Write-Step 'Enabling ssh-agent'\r
Set-Service -Name ssh-agent -StartupType Automatic\r
if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent }\r
\r
# ---------------------------------------------------------------------------\r
# OpenSSH Server (sshd)\r
#\r
# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the\r
# transport rsync rides on when seeding test data in. Ships with Windows 10\r
# 1809+ / Windows 11 as an on-demand capability, so no third-party install.\r
#\r
# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall\r
# rule; we verify and create it if missing (it is absent on some images).\r
#\r
# Non-fatal: a box that can't run sshd should still finish provisioning.\r
# ---------------------------------------------------------------------------\r
Write-Step 'OpenSSH Server (sshd)'\r
try {\r
    $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' |\r
            Select-Object -First 1\r
    if (-not $sshd) {\r
        Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.'\r
    } else {\r
        if ($sshd.State -ne 'Installed') {\r
            Write-Host "    Installing $($sshd.Name) ..."\r
            $r = Add-WindowsCapability -Online -Name $sshd.Name\r
            if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Server]' -ForegroundColor Yellow }\r
        } else {\r
            Write-Host "    OK: $($sshd.Name) already installed"\r
        }\r
\r
        Set-Service -Name sshd -StartupType Automatic\r
        if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd }\r
        Write-Host '    sshd: Automatic + running'\r
\r
        # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and\r
        # bridged adapters are frequently classified Public, and the capability's\r
        # own rule is Private-only on some images, which is what leaves a plainly\r
        # running sshd plainly unreachable.\r
        #\r
        # OpenSSH-Server-In-TCP is the name the capability itself uses, so this\r
        # WIDENS that rule rather than adding a second one next to it. Creating\r
        # our own under a different name would leave the narrow rule in place and\r
        # the box still unreachable on a Public-classified adapter; creating one\r
        # under the same name would collide. Adopt it if present, create it if not.\r
        $ruleName = 'OpenSSH-Server-In-TCP'\r
        if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) {\r
            Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any\r
            Write-Host "    Widened firewall rule $ruleName to all profiles"\r
        } else {\r
            New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' `\r
                -Enabled True -Direction Inbound -Protocol TCP -Action Allow `\r
                -LocalPort 22 -Profile Any | Out-Null\r
            Write-Host "    Added firewall rule $ruleName (TCP 22, all profiles)"\r
        }\r
    }\r
} catch {\r
    Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)"\r
}\r
\r
# ---------------------------------------------------------------------------\r
# rsync for Windows (github.com/nuket/rsync-windows)\r
#\r
# Windows' OpenSSH ships the transport only - no rsync - so pushing test data\r
# from a Linux box needs an rsync.exe on the Windows side.\r
#\r
# The release is one zip per architecture - rsync-windows-x64.zip and\r
# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the\r
# licence texts under exactly those names. Both exes are installed, together:\r
# rsync.exe prefers an ssh.exe in its own directory, and the release's build is\r
# what makes a push FROM this box run at line rate. The ssh.exe Windows ships\r
# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the\r
# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same\r
# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits\r
# ahead of C:\Tools\rsync on the machine PATH.\r
#\r
# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability\r
# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses\r
# AES-NI. No copy of it ships in the zip, so where the capability is missing we\r
# unpack rsync alone rather than an ssh.exe that will not start.\r
#\r
# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is\r
# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes\r
# the client-side --rsync-path escape hatch painful to quote. Added to the\r
# MACHINE PATH so it resolves for every account, including the non-interactive\r
# sshd session, which builds its environment from the machine + user registry\r
# PATH rather than from a login shell.\r
#\r
# Non-fatal: a download failure only warns.\r
# ---------------------------------------------------------------------------\r
Write-Step 'rsync for Windows'\r
$RsyncRepo  = 'nuket/rsync-windows'\r
$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }\r
# The /releases/latest/download/ redirect rather than the API: unauthenticated\r
# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a\r
# shared NAT can genuinely exhaust, and the redirect costs none of that budget.\r
# To hold a box on a known build, pin the tag instead:\r
#     .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset\r
$RsyncUrl   = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"\r
$RsyncDir   = 'C:\Tools\rsync'\r
try {\r
    New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null\r
    $RsyncExe = Join-Path $RsyncDir 'rsync.exe'\r
\r
    # Does the release's ssh.exe have the libcrypto it needs? Decided before the\r
    # download so the answer can also gate what comes out of the zip.\r
    $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'\r
    $WantSsh   = Test-Path $SysCrypto\r
    if (-not $WantSsh) {\r
        Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."\r
    } else {\r
        $v = (Get-Item $SysCrypto).VersionInfo.FileVersion\r
        if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {\r
            Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."\r
        }\r
    }\r
\r
    # Download and unpack beside the targets, not over them, so an interrupted\r
    # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch\r
    # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive\r
    # refuses any other extension outright ("*.download is not a supported\r
    # archive file format"), where PowerShell 7 just reads the file.\r
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\r
    $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"\r
    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing\r
    Write-Host "    Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"\r
\r
    # Verify against the .sha256 published beside it. Same origin, so this is an\r
    # integrity check on the transfer rather than a defence against a hostile\r
    # release - but a truncated or proxy-mangled download is the failure that\r
    # actually happens, and it fails here instead of mid-transfer later.\r
    #\r
    # -OutFile, not .Content: GitHub serves the .sha256 as\r
    # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather\r
    # than a string for any non-text content type, so .Content would compare the\r
    # first BYTE against the hash and fail on every correct download.\r
    $tmpSha = "$tmpZip.sha256"\r
    Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing\r
    $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()\r
    Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue\r
    $got  = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()\r
    if ($want -and $want -ne $got) {\r
        Remove-Item $tmpZip -Force\r
        throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"\r
    }\r
    Write-Host "    SHA-256 verified: $got"\r
\r
    # Unpack to a scratch directory and move out the files we asked for, rather\r
    # than expanding straight over the install directory: the zip is the unit\r
    # that was checksummed, and this way a future release adding something to it\r
    # cannot quietly drop that something onto the machine PATH.\r
    $unpack = Join-Path $RsyncDir '.unpack'\r
    if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }\r
    Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force\r
    Remove-Item $tmpZip -Force\r
    foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {\r
        $src = Join-Path $unpack $f\r
        if (-not (Test-Path $src)) { continue }\r
        if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }\r
        Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force\r
    }\r
    Remove-Item -Recurse -Force $unpack\r
    Write-Host "    Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"\r
\r
    # Machine PATH (HKLM environment). Idempotent: only appends if absent.\r
    $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
    if (-not $m) { $m = '' }\r
    if (($m -split ';') -notcontains $RsyncDir) {\r
        $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir }\r
        [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')\r
        Write-Host "    Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)."\r
        # sshd caches the environment it was started with, so an already-running\r
        # service would not see the new PATH until restarted.\r
        if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') {\r
            Restart-Service sshd\r
            Write-Host '    Restarted sshd so it inherits the updated machine PATH.'\r
        }\r
    } else {\r
        Write-Host "    OK: $RsyncDir already in the machine PATH"\r
    }\r
\r
    & $RsyncExe --version | Select-Object -First 1\r
} catch {\r
    Write-Warning "rsync install failed: $($_.Exception.Message)"\r
    Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"\r
    Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."\r
}\r
\r
# ---------------------------------------------------------------------------\r
# Visual Studio 2022 Community\r
# ---------------------------------------------------------------------------\r
$TempDir = Join-Path $env:TEMP 'dev_install'\r
New-Item -ItemType Directory -Force -Path $TempDir | Out-Null\r
\r
# Component IDs split into independent groups so each can be installed in its\r
# own pass. The base group is the known-good set; Clang and the Windows XP\r
# toolset are layered on afterwards so a failure clearly identifies the culprit.\r
# Component reference: https://learn.microsoft.com/visualstudio/install/workload-component-id-vs-community\r
$BaseComponents = @(\r
    # Core C++ desktop workload\r
    'Microsoft.VisualStudio.Workload.NativeDesktop'\r
\r
    # Spectre-mitigated MSVC runtime libs\r
    'Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre'\r
    'Microsoft.VisualStudio.Component.VC.Runtimes.ARM64.Spectre'\r
\r
    # Spectre-mitigated ATL (needed for many driver/COM projects)\r
    'Microsoft.VisualStudio.Component.VC.ATL.Spectre'\r
\r
    # Windows 11 SDK — build number must match the WDK below\r
    'Microsoft.VisualStudio.Component.Windows11SDK.26100'\r
\r
    # WDK Visual Studio extension (VSIX). The silent wdksetup.exe /quiet does NOT\r
    # install this (it only prompts interactively), so it must be added here.\r
    'Component.Microsoft.Windows.DriverKit'\r
)\r
\r
# Clang/LLVM toolset (ClangCL, used in CMakePresets.json). Two parts: the Clang\r
# compiler itself, plus the MSBuild integration providing the "ClangCL" toolset.\r
$ClangComponents = @(\r
    'Microsoft.VisualStudio.Component.VC.Llvm.Clang'\r
    'Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset'\r
)\r
\r
# Windows XP targeting (v141_xp toolset, used in CMakePresets.json). The v141\r
# (VS2017) build tools provide the 14.16 compiler that the XP toolset wraps;\r
# WinXP layers the XP-compatible CRT/SDK on top of it.\r
$XpComponents = @(\r
    'Microsoft.VisualStudio.Component.VC.v141.x86.x64'\r
    'Microsoft.VisualStudio.Component.WinXP'\r
)\r
\r
# Detect an existing VS install via vswhere (ships with the VS Installer).\r
# These are referenced by Invoke-VsModify via $script: scope.\r
$VsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'\r
$InstallPath = $null\r
if (Test-Path $VsWhere) {\r
    $InstallPath = & $VsWhere -products '*' -property installationPath -format value |\r
                   Select-Object -First 1\r
}\r
\r
Write-Step 'Downloading VS2022 Community bootstrapper'\r
$VsInstallerUrl = 'https://aka.ms/vs/17/release/vs_community.exe'\r
$VsBootstrapper = Join-Path $TempDir 'vs_community.exe'\r
Invoke-WebRequest -Uri $VsInstallerUrl -OutFile $VsBootstrapper -UseBasicParsing\r
\r
# Install in three sequential passes. The base set is installed first (this is\r
# the configuration that previously worked); Clang and the XP toolset are added\r
# afterwards. If one fails, its label pinpoints which group is responsible.\r
Invoke-VsModify -Label 'base toolset + workload' -Ids $BaseComponents\r
Invoke-VsModify -Label 'Clang / LLVM'            -Ids $ClangComponents\r
Invoke-VsModify -Label 'Windows XP (v141 + WinXP)' -Ids $XpComponents\r
\r
# ---------------------------------------------------------------------------\r
# Verify the v141 / XP toolset actually landed. Earlier runs silently skipped\r
# it and the failure only surfaced at build time, so check on disk and fail\r
# loudly here instead.\r
# ---------------------------------------------------------------------------\r
Write-Step 'Verifying v141 / XP toolset'\r
$InstallPath = & $VsWhere -products '*' -property installationPath -format value |\r
               Select-Object -First 1\r
$V141 = if ($InstallPath) {\r
    Get-ChildItem (Join-Path $InstallPath 'VC\Tools\MSVC') -Directory -ErrorAction SilentlyContinue |\r
        Where-Object { $_.Name -like '14.16.*' } | Select-Object -First 1\r
}\r
if ($V141) {\r
    Write-Host "    OK: v141 toolset present ($($V141.Name))" -ForegroundColor Green\r
} else {\r
    Write-Warning 'v141 (14.16.x) toolset NOT found - the XP build presets will fail.'\r
    Write-Warning 'Add it via Visual Studio Installer > Modify > Individual components:'\r
    Write-Warning '  - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)'\r
    Write-Warning '  - C++ Windows XP Support for VS 2017 (v141) tools'\r
}\r
\r
# ---------------------------------------------------------------------------\r
# Windows Driver Kit (WDK 10.0.26100)\r
# Build 26100 matches the Windows 11 SDK installed above.\r
# Provides IddCx (iddcx.h / iddcx.lib) and UMDF 2.x for Indirect Display Drivers.\r
# linkid=2335869 -> WDK 26100.6584 (per Microsoft "Other WDK Downloads").\r
# ---------------------------------------------------------------------------\r
$WdkVersion = '10.0.26100'\r
$WdkInstalledRoot = (Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots' `\r
                        -ErrorAction SilentlyContinue).WdkBinRootVersioned\r
\r
if ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion)) {\r
    # Re-running wdksetup.exe for an already-present version returns exit code\r
    # 2008 (maintenance mode / nothing to do), which is not a real failure.\r
    Write-Step "WDK $WdkVersion already installed - skipping ($WdkInstalledRoot)"\r
} else {\r
    Write-Step 'Downloading WDK installer'\r
    $WdkUrl       = 'https://go.microsoft.com/fwlink/?linkid=2335869'\r
    $WdkInstaller = Join-Path $TempDir 'wdksetup.exe'\r
    Invoke-WebRequest -Uri $WdkUrl -OutFile $WdkInstaller -UseBasicParsing\r
\r
    Write-Step 'Installing WDK'\r
    $proc = Start-Process -FilePath $WdkInstaller -ArgumentList '/quiet /norestart' -Wait -PassThru -NoNewWindow\r
    Write-Host "    WDK installer exit code: $($proc.ExitCode)"\r
    if ($proc.ExitCode -eq 2008) {\r
        # 2008 = the WDK is already present; the installer has nothing to do.\r
        Write-Host '    [WDK already installed (exit 2008) - treating as success]' -ForegroundColor Yellow\r
    } else {\r
        Assert-ExitCode $proc.ExitCode 'WDK'\r
    }\r
}\r
\r
# ---------------------------------------------------------------------------\r
# Windows Performance Toolkit: xperf, wpr, and Windows Performance Analyzer\r
# (wpa.exe) -- ETW CPU + loader profiling and the GUI that reads the traces.\r
#\r
# WPA is NOT a Visual Studio component and has no relationship to VS's own\r
# Performance Profiler (a separate, .diagsession-based tool that cannot open an\r
# .etl). It ships in exactly two places: as an optional FEATURE of the Windows\r
# SDK ("Windows Performance Toolkit", OptionId.WindowsPerformanceToolkit), and\r
# in the Windows ADK, which bundles the same toolkit. Whether the SDK install\r
# that Visual Studio performs happens to select that feature varies with the VS\r
# and SDK version - when it does, WPT lands in\r
# %ProgramFiles(x86)%\Windows Kits\10\Windows Performance Toolkit and the SDK\r
# puts that directory on the machine PATH itself - so this step DETECTS first\r
# and only falls back to installing the ADK (winget owns the versioned download\r
# URL, which makes it the reliable source) when nothing is there. That fallback\r
# is a large download; to install just the toolkit instead, run the standalone\r
# SDK setup with\r
#     winsdksetup.exe /features OptionId.WindowsPerformanceToolkit /q\r
#\r
# There is also a newer WPA in the Microsoft Store (`winget install --id\r
# 9N0W1B2BXGNZ --source msstore`), which updates independently of the SDK. It is\r
# not installed here: the Store package needs an interactive, signed-in session,\r
# which is exactly what this elevated, unattended half does not have.\r
#\r
# Idempotent and non-fatal - it never aborts provisioning.\r
# ---------------------------------------------------------------------------\r
Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)'\r
$WptDirs = @(\r
    (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'),\r
    (Join-Path $env:ProgramFiles        'Windows Kits\10\Windows Performance Toolkit'),\r
    (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit')\r
)\r
function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 }\r
\r
$WptDir = Find-WptDir\r
if ($WptDir) {\r
    Write-Host "    OK: WPT already present ($WptDir)" -ForegroundColor Green\r
} else {\r
    try {\r
        winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity `\r
            --accept-source-agreements --accept-package-agreements\r
        Write-Host '    Windows ADK (includes Windows Performance Toolkit) installed.'\r
        $WptDir = Find-WptDir\r
    } catch {\r
        Write-Warning "WPT install failed: $($_.Exception.Message)"\r
        Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the'\r
        Write-Warning 'Windows SDK "Windows Performance Toolkit" optional feature.'\r
    }\r
}\r
\r
if ($WptDir) {\r
    # Report what actually landed. wpa.exe is the piece people come looking for\r
    # and it is the one that is absent if a trimmed toolkit ever shows up.\r
    foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') {\r
        $p = Join-Path $WptDir $tool\r
        if (Test-Path $p) {\r
            Write-Host "    $tool $((Get-Item $p).VersionInfo.ProductVersion)"\r
        } else {\r
            Write-Warning "$tool is missing from $WptDir"\r
        }\r
    }\r
\r
    # The WPT installer normally adds this to the machine PATH itself (and the\r
    # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for\r
    # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user\r
    # one so it also resolves for the non-interactive sshd sessions this box is\r
    # driven through, which build their environment from the registry PATH.\r
    # Compared trailing-backslash-insensitively - the installer's own entry has\r
    # one, and adding a second spelling of the same directory is just noise.\r
    $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
    if (-not $m) { $m = '' }\r
    $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') }\r
    if ($have) {\r
        Write-Host "    OK: $WptDir already in the machine PATH"\r
    } else {\r
        $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir }\r
        [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')\r
        Write-Host "    Added $WptDir to the machine PATH (restart shells to pick it up)."\r
    }\r
}\r
\r
\r
# ---------------------------------------------------------------------------\r
# Intel VTune Profiler - reported, not installed\r
#\r
# Deliberately NOT automated, unlike everything above. The offline installer is\r
# a ~750 MB download from a URL carrying a per-release GUID\r
# (registrationcenter-download.intel.com/akdlm/IRC_NAS/<guid>/intel-vtune-<ver>_offline.exe)\r
# with no "latest" redirect behind it, so every new build means editing a\r
# hard-coded link in here - and it is only worth having on Intel silicon, since\r
# hardware event-based sampling reads Intel PMU counters. Not a good trade for a\r
# script that has to keep working unattended on any box.\r
#\r
# So this step only reports. To install it, take the Windows offline installer\r
# from\r
#     https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html\r
# and run it elevated; it installs unattended with\r
#     intel-vtune-<version>_offline.exe -a --silent --cli --eula accept\r
# ---------------------------------------------------------------------------\r
Write-Step 'Intel VTune Profiler (status only)'\r
$UninstallKeys = @(\r
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
)\r
$vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue |\r
         Where-Object { $_.DisplayName -match 'VTune' } |\r
         Select-Object -First 1\r
if ($vtune) {\r
    Write-Host "    Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green\r
    # The oneAPI layout keeps a `latest` junction beside the versioned directory,\r
    # so this path stays right across upgrades.\r
    $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe'\r
    if (Test-Path $VTuneCli) { Write-Host "    CLI: $VTuneCli" }\r
} else {\r
    Write-Host '    Not installed.' -ForegroundColor Yellow\r
    Write-Host '    https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow\r
    $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer\r
    if ($cpu -and $cpu -notmatch 'Intel') {\r
        Write-Host "    (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow\r
    }\r
}\r
\r
# ---------------------------------------------------------------------------\r
Write-Host "`nAll done." -ForegroundColor Green\r
Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'\r
\r
}\r
catch {\r
    $ExitCode = 1\r
    Write-Host "`n==> SETUP FAILED: $($_.Exception.Message)" -ForegroundColor Red\r
    if ($_.ScriptStackTrace) { Write-Host $_.ScriptStackTrace -ForegroundColor DarkGray }\r
    # Only fold in the VS Installer logs when a VS step actually failed; for other\r
    # steps (e.g. WDK) those logs are stale and misleading, so the message above\r
    # is what matters.\r
    if ($_.Exception.Message -match 'VS2022') {\r
        try { Show-VsSetupLogs } catch {}\r
    }\r
}\r
finally {\r
    try { Stop-Transcript | Out-Null } catch {}\r
\r
    # This log was created by the elevated (admin) process, so by default the\r
    # non-elevated caller can't delete it (their token has Administrators marked\r
    # deny-only). Grant BUILTIN\Users Modify rights so the user account that runs\r
    # setup-windows.bat can remove the log later. S-1-5-32-545 is the well-known\r
    # Users SID, used here so this is locale-independent.\r
    try {\r
        if (Test-Path $LogFile) {\r
            $usersSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-545')\r
            $acl  = Get-Acl -Path $LogFile\r
            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(\r
                        $usersSid, 'Modify', 'Allow')\r
            $acl.AddAccessRule($rule)\r
            Set-Acl -Path $LogFile -AclObject $acl\r
        }\r
    } catch {\r
        Write-Host "    [warning] could not relax ACL on $LogFile : $($_.Exception.Message)" -ForegroundColor Yellow\r
    }\r
}\r
\r
exit $ExitCode\r