dotfiles: sync the Windows provisioning scripts

[dotfiles] / setup-windows.bat

diff --git a/setup-windows.bat b/setup-windows.bat
index b94922d37cd23ba8bbf053bf95d13e497602e8a1..ff77716cb46ac018e404491a95be3ea7418114f1 100644 (file)
--- a/setup-windows.bat
+++ b/setup-windows.bat
@@ -1,7 +1,7 @@
 @echo off\r
 \r
 @rem ---------------------------------------------------------------------------\r
 @echo off\r
 \r
 @rem ---------------------------------------------------------------------------\r

-@rem setup-windows.bat - provision a fresh Windows box for BlockBox development\r
+@rem setup-windows.bat - provision a fresh Windows box for native development\r

 @rem ---------------------------------------------------------------------------\r
 \r
 @rem --- Non-admin (per-user) installs + git config ---\r
 @rem ---------------------------------------------------------------------------\r
 \r
 @rem --- Non-admin (per-user) installs + git config ---\r


@@ -13,7 +13,7 @@ winget install WinMerge.WinMerge
 winget install WiXToolset.WiXCLI\r
 \r
 @rem OpenCppCoverage: native (PE) line coverage for the C++ binaries. run-coverage-occ.py drives the\r
 winget install WiXToolset.WiXCLI\r
 \r
 @rem OpenCppCoverage: native (PE) line coverage for the C++ binaries. run-coverage-occ.py drives the\r

-@rem pytest suite under it to produce an HTML report (BlockBox + the sandbox DLLs build with PDBs,\r
+@rem pytest suite under it to produce an HTML report (the binaries under test build with PDBs,\r

 @rem which it reads). The installer elevates via UAC.\r
 winget install OpenCppCoverage.OpenCppCoverage\r
 \r
 @rem which it reads). The installer elevates via UAC.\r
 winget install OpenCppCoverage.OpenCppCoverage\r
 \r


@@ -28,9 +28,22 @@ powershell -NoProfile -Command "$c = @((Join-Path $env:ProgramFiles 'WinMerge'),
 @rem Microsoft.CodeAnalysis.BinSkim NuGet package ships a self-contained win-x64\r
 @rem build, so this needs no .NET SDK/runtime: download the .nupkg (a zip), extract\r
 @rem the win-x64 tool folder to %LOCALAPPDATA%\Programs\BinSkim, and add it to the\r
 @rem Microsoft.CodeAnalysis.BinSkim NuGet package ships a self-contained win-x64\r
 @rem build, so this needs no .NET SDK/runtime: download the .nupkg (a zip), extract\r
 @rem the win-x64 tool folder to %LOCALAPPDATA%\Programs\BinSkim, and add it to the\r

-@rem user PATH. After restarting the shell:  binskim analyze path\to\BlockBox.exe\r
+@rem user PATH. After restarting the shell:  binskim analyze path\to\your.exe\r
+@rem\r
+@rem VERSION CHECK FIRST. The .nupkg is a large download (self-contained .NET), so\r
+@rem we ask NuGet what the newest stable version is BEFORE fetching anything, and\r
+@rem skip the download entirely when the installed copy already matches. The\r
+@rem installed version is recorded in nupkg-version.txt next to the tool; for a\r
+@rem copy installed before that marker existed we fall back to BinSkim.exe's own\r
+@rem ProductVersion, which costs at most one more download and then self-heals.\r
+@rem The flat-container URL pins the exact version we checked, unlike the v2\r
+@rem /package/<id> endpoint, which just redirects to whatever is newest at the\r
+@rem moment of the request.\r
+@rem\r
+@rem The user PATH is refreshed on every run, including the skip path, so a lost\r
+@rem PATH entry is repaired without re-downloading the tool to do it.\r

 @rem A failure here only warns (exit 0) so it never aborts the rest of provisioning.\r
 @rem A failure here only warns (exit 0) so it never aborts the rest of provisioning.\r

-powershell -NoProfile -Command "try { $ErrorActionPreference='Stop'; [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; $dest=Join-Path $env:LOCALAPPDATA 'Programs\BinSkim'; $tmp=Join-Path $env:TEMP ('binskim_'+[guid]::NewGuid().ToString('N')); New-Item -ItemType Directory -Force -Path $tmp | Out-Null; $zip=Join-Path $tmp 'binskim.zip'; Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.CodeAnalysis.BinSkim' -OutFile $zip; Expand-Archive -Path $zip -DestinationPath $tmp -Force; $exe=Get-ChildItem -Path $tmp -Recurse -Filter 'BinSkim.exe' | Where-Object { $_.FullName -match 'win-x64' } | Sort-Object FullName | Select-Object -Last 1; if (-not $exe) { throw 'BinSkim.exe (win-x64) not found in package.' }; if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; New-Item -ItemType Directory -Force -Path $dest | Out-Null; Copy-Item -Path (Join-Path $exe.Directory.FullName '*') -Destination $dest -Recurse -Force; Remove-Item -Recurse -Force $tmp; $u=[Environment]::GetEnvironmentVariable('Path','User'); if (-not $u) { $u='' }; if (($u -split ';') -notcontains $dest) { $new = if ($u.Trim()) { $u.TrimEnd(';')+';'+$dest } else { $dest }; [Environment]::SetEnvironmentVariable('Path',$new,'User'); Write-Host ('Added '+$dest+' to user PATH (restart your shell to pick it up).') } else { Write-Host ($dest+' already in user PATH.') }; Write-Host ('BinSkim installed to '+$dest) } catch { Write-Warning ('BinSkim install failed: '+$_.Exception.Message); exit 0 }"\r
+powershell -NoProfile -Command "try { $ErrorActionPreference='Stop'; [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; $dest=Join-Path $env:LOCALAPPDATA 'Programs\BinSkim'; $exe=Join-Path $dest 'BinSkim.exe'; $mark=Join-Path $dest 'nupkg-version.txt'; $have=$null; if (Test-Path $exe) { if (Test-Path $mark) { $have=(Get-Content $mark -Raw).Trim() } else { $pv=(Get-Item $exe).VersionInfo.ProductVersion; if ($pv) { $have=$pv.Split('+')[0].Trim() } } }; $latest=$null; try { $idx=Invoke-RestMethod -Uri 'https://api.nuget.org/v3-flatcontainer/microsoft.codeanalysis.binskim/index.json' -UseBasicParsing; $latest=$idx.versions | Where-Object { $_ -notmatch '-' } | Select-Object -Last 1 } catch { Write-Warning ('BinSkim version check failed: '+$_.Exception.Message) }; if (-not $latest) { if ($have) { Write-Host ('BinSkim '+$have+' kept (could not reach NuGet to check for a newer one).') } else { Write-Warning 'BinSkim not installed and NuGet unreachable; skipping.'; exit 0 } } elseif ($have -and ($have -eq $latest -or $have -eq ($latest+'.0'))) { Write-Host ('BinSkim '+$have+' is already the newest stable release; skipping download.') } else { if ($have) { Write-Host ('BinSkim '+$have+' -> '+$latest+'; downloading.') } else { Write-Host ('BinSkim '+$latest+'; downloading.') }; $tmp=Join-Path $env:TEMP ('binskim_'+[guid]::NewGuid().ToString('N')); New-Item -ItemType Directory -Force -Path $tmp | Out-Null; $zip=Join-Path $tmp 'binskim.zip'; Invoke-WebRequest -Uri ('https://api.nuget.org/v3-flatcontainer/microsoft.codeanalysis.binskim/'+$latest+'/microsoft.codeanalysis.binskim.'+$latest+'.nupkg') -OutFile $zip -UseBasicParsing; Expand-Archive -Path $zip -DestinationPath $tmp -Force; $src=Get-ChildItem -Path $tmp -Recurse -Filter 'BinSkim.exe' | Where-Object { $_.FullName -match 'win-x64' } | Sort-Object FullName | Select-Object -Last 1; if (-not $src) { throw 'BinSkim.exe (win-x64) not found in package.' }; if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; New-Item -ItemType Directory -Force -Path $dest | Out-Null; Copy-Item -Path (Join-Path $src.Directory.FullName '*') -Destination $dest -Recurse -Force; Remove-Item -Recurse -Force $tmp; Set-Content -Path $mark -Value $latest -Encoding ascii; Write-Host ('BinSkim '+$latest+' installed to '+$dest) }; $u=[Environment]::GetEnvironmentVariable('Path','User'); if (-not $u) { $u='' }; if (($u -split ';') -notcontains $dest) { $new = if ($u.Trim()) { $u.TrimEnd(';')+';'+$dest } else { $dest }; [Environment]::SetEnvironmentVariable('Path',$new,'User'); Write-Host ('Added '+$dest+' to user PATH (restart your shell to pick it up).') } else { Write-Host ($dest+' already in user PATH.') } } catch { Write-Warning ('BinSkim install failed: '+$_.Exception.Message); exit 0 }"\r

 \r
 @rem --- Global git identity: EDIT THESE BEFORE RUNNING ---\r
 @rem Replace the placeholders with your own name and email, or comment the two\r
 \r
 @rem --- Global git identity: EDIT THESE BEFORE RUNNING ---\r
 @rem Replace the placeholders with your own name and email, or comment the two\r