X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/0b4125206461c1a63a971ac9cf503319bcb05798..4776737b67f1d3e04d18dc4622e7bfb120f74e11:/setup-windows-no-uac.ps1 diff --git a/setup-windows-no-uac.ps1 b/setup-windows-no-uac.ps1 index c44bb1a..b048ec3 100644 --- a/setup-windows-no-uac.ps1 +++ b/setup-windows-no-uac.ps1 @@ -23,6 +23,10 @@ half unpacks beside rsync.exe if it is there, the in-box one otherwise - Rust's stable MSVC toolchain for this host - x86_64 on x64, aarch64 on ARM64 - installed through rustup and made the default + - The Android SDK, per-user in %LOCALAPPDATA%\Android\Sdk (x64 only): the + command-line tools, platform-tools and the newest stable platform and + build-tools, SDK licences accepted, ANDROID_HOME set - and JAVA_HOME, to + Android Studio's bundled JDK, when there is none - An architecture audit: the real PE machine type of every tool this box provisions, resolved the way a shell would. Informational, never fatal. Anything running emulated without a listed reason is called out. @@ -110,6 +114,13 @@ $RustHost = switch ($HostArch) { default { $null } } +# The Android SDK: where Android Studio puts it by default, unless ANDROID_HOME +# already names one. "Latest" is read from Google's package index at run time, +# the same index sdkmanager and Android Studio's SDK Manager read. +$AndroidSdkRoot = if ($env:ANDROID_HOME) { $env:ANDROID_HOME } else { Join-Path $env:LOCALAPPDATA 'Android\Sdk' } +$AndroidRepo = 'https://dl.google.com/android/repository/' +$AndroidIndex = $AndroidRepo + 'repository2-3.xml' + function Write-Step([string]$Msg) { Write-Host "`n==> $Msg" -ForegroundColor Cyan } @@ -221,6 +232,10 @@ function Install-BinSkim { # newest at the moment of the request. Write-Step 'BinSkim' [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + # No progress bar: Windows PowerShell 5.1 redraws it per chunk, and on a + # download this size that, not the network, is the wait - see + # Install-AndroidSdk for the measurement. Local to this function. + $ProgressPreference = 'SilentlyContinue' $exe = Join-Path $BinSkimDir 'BinSkim.exe' $marker = Join-Path $BinSkimDir 'nupkg-version.txt' @@ -611,6 +626,239 @@ function Set-RustDefaultToolchain { } } +function Set-UserEnvironmentVariable([string] $Name, [string] $Value) { + # HKCU, like Add-ToUserPath, so it outlives the script; written only when it + # differs, so a re-run changes nothing. + if ([Environment]::GetEnvironmentVariable($Name, 'User') -eq $Value) { + Write-Host " $Name is already $Value" + return + } + [Environment]::SetEnvironmentVariable($Name, $Value, 'User') + Write-Host " Set $Name = $Value (restart your shell to pick it up)." +} + +function Get-AndroidRevision($Package) { + # A package's revision from the index, as a [version]: , optional + # and . [int] of a missing element is 0. + $r = $Package.revision + [version]('{0}.{1}.{2}' -f [int]$r.major, [int]$r.minor, [int]$r.micro) +} + +function ConvertTo-Revision([string] $Text) { + # "23.0" as the same three-part [version] the index gives, so the two + # compare. [version]'23.0' has no third part - it reads as -1 - and so + # counted as OLDER than 23.0.0: an installed, current copy looked stale. + $parts = @($Text.Trim() -split '\.' | Where-Object { $_ -ne '' }) + while ($parts.Count -lt 3) { $parts += '0' } + [version]($parts[0..2] -join '.') +} + +function Invoke-AndroidCli { + # The Android CLI (cmdline-tools\latest\bin\android.exe) against this SDK, + # its output shown as it comes - a first install downloads well over 100 MB + # and should not look stalled. Returns the exit code, $null if it would not + # start. EAP Continue for the call, as for the other native tools here. + # + # stdin is one empty line, so it is closed rather than the console: a + # prompt nobody expected gets "no" instead of an unattended run waiting on + # it forever. + param([string[]] $Arguments) + $cli = Join-Path $AndroidSdkRoot 'cmdline-tools\latest\bin\android.exe' + $prevEap = $ErrorActionPreference + $ErrorActionPreference = 'Continue' + try { + $global:LASTEXITCODE = $null + # Its stderr becomes error records under 2>&1 in Windows PowerShell, + # which would print as red "NativeCommandError" noise; back to plain + # lines first. The one JVM warning dropped is the bundled Java noting, + # on every call, a flag this Windows 10 does not support. + '' | & $cli "--sdk=$AndroidSdkRoot" @Arguments 2>&1 | ForEach-Object { "$_" } | + Where-Object { $_ -notmatch 'UseAllWindowsProcessorGroups flag is not supported' } | Out-Host + $LASTEXITCODE + } finally { + $ErrorActionPreference = $prevEap + } +} + +function Install-AndroidSdk { + # The Android SDK for building apps, per-user, in Android Studio's default + # location (%LOCALAPPDATA%\Android\Sdk) unless ANDROID_HOME names another: + # the command-line tools, platform-tools, and the newest stable platform and + # build-tools. That is what Android Studio's first-run wizard would set up, + # done without the wizard - on the x64 laptop Studio was installed and that + # wizard had never run, so there was no SDK at all. Gradle fetches any other + # platform or build-tools a project asks for by itself, once the licences are + # accepted, so this is the floor rather than the whole set. + # + # "Newest stable" comes from Google's package index, read here each run: + # channel-0 (stable) and no revision, the platform by API level + # (android-37.2 beats android-37.1 beats android-36), build-tools by version. + # + # THE COMMAND-LINE TOOLS ARE NOT WHAT THEY WERE. From 23.0, sdkmanager is + # deprecated and sdkmanager.bat is a shim over the new Android CLI + # (cmdline-tools\latest\bin\android.exe, `android sdk install ...`), which on + # first use installs itself into %USERPROFILE%\.android (bin\android-cli.exe, + # about 90 MB, and cli\ - a bundled Java runtime, and a metrics spool). So + # the CLI is called directly here, with its own "platforms/android-37.2" + # package paths: no deprecated shim, and no cmd parsing to split the old + # "platforms;android-37.2" at its semicolon. `sdk install` installs a + # package or, if it is there, updates it to the latest - so it is also the + # re-run path, downloading nothing when everything is current. + # + # ITS EXIT CODE IS NOT TRUSTED. CLI 1.0.16406183 finishes every `sdk` + # command and then crashes on the way out, 0xC0000409 (a fail-fast in + # ucrtbase) - on the x64 laptop's Windows 10, every time, in a console or + # not, while `--version` and `info` exit 0. So success is judged by the + # result: each package asked for must have the package.xml the CLI writes + # once a package is complete. A nonzero exit with everything present is a + # note, not a failure; anything missing is a failure, whatever the exit. + # + # The command-line tools themselves are bootstrapped from the index's own + # "cmdline-tools;latest" archive (SHA-1 from the index), and replaced only + # when the index has a newer revision than the one in source.properties. + # The CLI cannot do that for them: the archive calls itself + # cmdline-tools;23.0, a fixed version, so it would never "update" it. + # + # The SDK licences are accepted on your behalf; the plan says so before + # anything runs. The CLI does it as it installs - sdkmanager --licenses is + # now a no-op - writing licenses\android-sdk-license. Gradle needs it to + # build, and to fetch what a project asks for. + # + # The CLI brings its own Java, so the SDK needs no JDK. Gradle does: when + # there is no JAVA_HOME, the one Android Studio bundles (jbr) becomes the + # user's, so a command-line gradlew works. An existing JAVA_HOME is never + # changed. + Write-Step "Android SDK in $AndroidSdkRoot" + + [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + # No progress bar for the downloads. Windows PowerShell 5.1's + # Invoke-WebRequest redraws it per chunk, and that - not the network - is + # what a large download then waits on: measured on the x64 laptop, the + # 148 MB command-line tools took about ten minutes and five minutes of CPU + # with it on. Local to this function, so nothing else changes. + $ProgressPreference = 'SilentlyContinue' + [xml]$index = (Invoke-WebRequest -UseBasicParsing -Uri $AndroidIndex).Content + $stable = @($index.DocumentElement.remotePackage | + Where-Object { $_.channelRef.ref -eq 'channel-0' -and -not $_.revision.preview }) + + # --- the command-line tools: bootstrapped, and kept current, from the index --- + $ct = @($stable | Where-Object { $_.path -eq 'cmdline-tools;latest' })[0] + if (-not $ct) { throw "No stable cmdline-tools;latest in $AndroidIndex." } + $ctWant = Get-AndroidRevision $ct + $ctDir = Join-Path $AndroidSdkRoot 'cmdline-tools\latest' + $ctHave = $null + $props = Join-Path $ctDir 'source.properties' + if (Test-Path $props) { + $m = [regex]::Match((Get-Content $props -Raw), '(?m)^Pkg\.Revision=(\d+(\.\d+){0,2})') + if ($m.Success) { $ctHave = ConvertTo-Revision $m.Groups[1].Value } + } + if ($ctHave -and $ctHave -ge $ctWant) { + Write-Host " command-line tools $ctHave are current." + } else { + $archive = @($ct.archives.archive | Where-Object { $_.'host-os' -eq 'windows' })[0] + $sum = $archive.complete.checksum + $sha1 = if ($sum -is [string]) { $sum } else { $sum.'#text' } + $url = $AndroidRepo + $archive.complete.url + Write-Host " command-line tools $(if ($ctHave) { "$ctHave -> " })$ctWant; downloading $($archive.complete.url)." + # PATH LENGTH. The archive nests deep - a guava jar in it sits well over + # 150 characters below its top - and Windows PowerShell 5.1 is bound by + # the 260-character MAX_PATH. So the temp directory's name is 8 + # characters: %TEMP%\xxxxxxxx\cmdline-tools\... is then no deeper than + # %LOCALAPPDATA%\Android\Sdk\cmdline-tools\latest\..., and whenever the + # SDK's own path fits, unpacking it does too. (A 43-character name here + # made the unpack deeper than the SDK it was for.) + $tmp = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N').Substring(0, 8)) + New-Item -ItemType Directory -Force -Path $tmp | Out-Null + try { + $zip = Join-Path $tmp 'ct.zip' + Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $zip + $got = (Get-FileHash $zip -Algorithm SHA1).Hash.ToLower() + if ($sha1 -and $got -ne $sha1.ToLower()) { throw "SHA-1 mismatch for $url`: expected $sha1, got $got" } + Expand-Archive -Path $zip -DestinationPath $tmp -Force + # The archive holds a top-level cmdline-tools\ directory; the SDK + # layout wants it at cmdline-tools\latest. Replaced wholesale, as + # BinSkim is, so files dropped between releases do not linger - but + # the old copy is RENAMED aside first and deleted last. A rename is + # one operation whatever the depth below it; deleting walks every + # file and can trip over a path that is too long. Done this way, a + # delete that fails leaves a stray folder to report, not an SDK + # with no command-line tools in it. The aside name is six + # characters, like "latest", so the delete is no deeper either. + New-Item -ItemType Directory -Force -Path (Split-Path $ctDir) | Out-Null + $old = $null + if (Test-Path $ctDir) { + $old = Join-Path (Split-Path $ctDir) ('old' + [guid]::NewGuid().ToString('N').Substring(0, 3)) + Rename-Item -Path $ctDir -NewName (Split-Path $old -Leaf) + } + Move-Item -Path (Join-Path $tmp 'cmdline-tools') -Destination $ctDir + if ($old) { + try { Remove-Item -Recurse -Force $old } + catch { Write-Warning "The new command-line tools are in place, but the old copy could not be removed: $old ($($_.Exception.Message))" } + } + } finally { + Remove-Item -Recurse -Force $tmp -ErrorAction SilentlyContinue + } + } + + # --- the newest stable platform and build-tools, by the index --- + $platform = @($stable | ForEach-Object { + $m = [regex]::Match($_.path, '^platforms;android-(\d+)(?:\.(\d+))?$') + if ($m.Success) { + [pscustomobject]@{ Path = $_.path; Api = [version]('{0}.{1}' -f $m.Groups[1].Value, [int]$m.Groups[2].Value) } + } + } | Sort-Object Api)[-1].Path + $buildTools = @($stable | Where-Object { $_.path -match '^build-tools;\d+(\.\d+)*$' } | + Sort-Object { [version]($_.path -replace '^build-tools;', '') })[-1].path + if (-not $platform -or -not $buildTools) { throw "Could not find a stable platform and build-tools in $AndroidIndex." } + + # The index names packages "platforms;android-37.2"; the CLI, and the SDK's + # directories, use "platforms/android-37.2". + $packages = @('platform-tools', ($platform -replace ';', '/'), ($buildTools -replace ';', '/')) + Write-Host " installing or updating: $($packages -join ', ')" + $rc = Invoke-AndroidCli -Arguments (@('sdk', 'install') + $packages) + $missing = @($packages | Where-Object { -not (Test-Path (Join-Path $AndroidSdkRoot (($_ -replace '/', '\') + '\package.xml'))) }) + if ($missing) { + $why = if ($null -eq $rc) { 'it would not start' } else { "exit $rc" } + throw "android sdk install left out $($missing -join ', ') ($why)" + } + if ($null -eq $rc) { + Write-Warning 'The Android CLI would not start; the packages already installed were left as they were, not updated.' + } elseif ($rc -ne 0) { + Write-Host (" note: the Android CLI exited {0} (0x{0:X8}) after finishing - its crash on the way out, not a failed" -f $rc) -ForegroundColor DarkGray + Write-Host ' install: every package asked for is in place.' -ForegroundColor DarkGray + } + + # Report what is there now, from each package's own source.properties. + foreach ($pkg in $packages) { + $p = Join-Path $AndroidSdkRoot (($pkg -replace '/', '\') + '\source.properties') + $rev = if (Test-Path $p) { [regex]::Match((Get-Content $p -Raw), '(?m)^Pkg\.Revision=(.*)$').Groups[1].Value.Trim() } else { '?' } + Write-Host (' {0,-28} {1}' -f $pkg, $rev) + } + + Set-UserEnvironmentVariable 'ANDROID_HOME' $AndroidSdkRoot + + # JAVA_HOME, for Gradle - only when there is none, and only to Android + # Studio's bundled JDK. Without Studio this just says what is missing. + if (-not [Environment]::GetEnvironmentVariable('JAVA_HOME', 'User') -and + -not [Environment]::GetEnvironmentVariable('JAVA_HOME', 'Machine')) { + $jbr = @((Join-Path $env:ProgramFiles 'Android\Android Studio\jbr'), + (Join-Path $env:LOCALAPPDATA 'Programs\Android Studio\jbr') | + Where-Object { Test-Path (Join-Path $_ 'bin\java.exe') })[0] + if ($jbr) { + Set-UserEnvironmentVariable 'JAVA_HOME' $jbr + } else { + Write-Warning 'No JAVA_HOME, and no Android Studio JDK to point it at: a command-line gradlew will need one. Install Android Studio (the AndroidStudio step) or a JDK.' + } + } + + # The Android CLI (android), and the tools beside it (lint, d8, r8, + # apkanalyzer, the sdkmanager/avdmanager shims), in any shell. + # platform-tools is NOT added: the PlatformTools step already puts adb on the + # PATH, and two adb.exe on it would only make which one answers depend on + # the order. + Add-ToUserPath (Join-Path $ctDir 'bin') +} + function Get-PEMachine { # Architecture of a PE, read straight from the COFF header: the 2 bytes at # the e_lfanew offset + 4. Cheap, and it answers the only question that @@ -878,6 +1126,7 @@ $steps = @{ NinjaPath = { Set-NativeNinjaFirst } LlvmPath = { Add-LlvmToUserPath } RustToolchain = { Set-RustDefaultToolchain } + AndroidSdk = { Install-AndroidSdk } ArchAudit = { Invoke-ArchAudit } }