dotfiles: install the rsync release's ssh.exe beside rsync.exe

[dotfiles] / README.md

diff --git a/README.md b/README.md
index e10d872a599b87930611d76d599e4a8fb69e255b..063056a142c969531ac610b8bad1eea65caee9c6 100644 (file)
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ throwaway VM reachable from a Linux host.
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then the non-elevated script, then launches the elevated half and prints its log. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |
-| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs and starts OpenSSH Server, installs `rsync.exe` to the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
+| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
 
 ## Usage
 
@@ -83,6 +83,26 @@ throwaway VM reachable from a Linux host.
   a profile. Key auth needs `~/.ssh/authorized_keys` ACL'd to just you and
   `SYSTEM`; accounts in the Administrators group use
   `C:\ProgramData\ssh\administrators_authorized_keys` instead.
+- **rsync brings its own `ssh.exe`.** That release ships as one zip per
+  architecture — `rsync-windows-x64.zip` / `rsync-windows-x86.zip`, each holding
+  `rsync.exe`, an `ssh.exe`, `COPYING.txt` and `NOTICE-ssh.txt` — and the
+  elevated half picks the zip for the OS bitness, verifies it against the
+  published `.sha256`, and unpacks the pair together. Together is the point:
+  `rsync.exe` prefers an `ssh.exe` sitting in its own directory, and the release
+  builds one because the client Windows ships reads its stdin 3 KB at a time,
+  which holds a transfer *from* the box at ~17 MB/s however fast the link is.
+  Nothing else about it differs — same `~/.ssh`, same `ssh-agent`, same
+  `known_hosts` — and a bare `ssh` still resolves to the in-box client, which
+  sits ahead of `C:\Tools\rsync` on the `PATH`. It links against the
+  `libcrypto.dll` the **OpenSSH Client** capability puts in `System32` (Windows'
+  own LibreSSL, which uses AES-NI) and ships no copy of its own, so the elevated
+  half installs that capability first and falls back to `rsync.exe` alone,
+  warning, on an image that will not offer it.
+- The `rsync` download follows the `releases/latest/download/` redirect rather
+  than the GitHub API: unauthenticated API calls are rate-limited to 60/hour per
+  IP, which a provisioning run behind a shared NAT can genuinely exhaust. To hold
+  a box on a known build, pin the tag in `$RsyncUrl`
+  (`.../releases/download/<tag>/<asset>`) instead.
 - Visual Studio is installed in three labelled passes (base workload, Clang/LLVM,
   XP toolset) so a failure identifies which component group is responsible.
 - The scripts were extracted from a native Windows project, so the component