X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/2e281421e8cccce19bc1b43bb5bdd7d877870b4e..refs/heads/master:/setup-windows-no-uac.ps1

diff --git a/setup-windows-no-uac.ps1 b/setup-windows-no-uac.ps1
index e1d5beb..1197300 100644
--- a/setup-windows-no-uac.ps1
+++ b/setup-windows-no-uac.ps1
@@ -12,10 +12,15 @@
 
   What this installs / configures:
     - WinMerge on the user PATH
+    - vswhere.exe on the user PATH: the Visual Studio installer puts it in
+      %ProgramFiles(x86)%\Microsoft Visual Studio\Installer, which nothing adds
+      to the PATH, so build scripts (and VsDevCmd.bat itself) complain that
+      'vswhere.exe' is not recognized
     - BinSkim (binary hardening analyzer) in %LOCALAPPDATA%\Programs\BinSkim,
       on the user PATH
-    - Global git identity, and core.sshCommand pointed at the Windows OpenSSH
-      client so git shares the Windows ssh-agent
+    - Global git identity, and core.sshCommand pointed at a Win32-OpenSSH
+      client so git shares the Windows ssh-agent: the fast ssh.exe the elevated
+      half unpacks beside rsync.exe if it is there, the in-box one otherwise
 
   FILL IN $GitUserName / $GitUserEmail below before the first run.
 
@@ -30,7 +35,7 @@ param(
     # for several, dot-call the script or use -Command:
     #     .\setup-windows-no-uac.ps1 -Skip BinSkim,GitConfig
     #     powershell -File .\setup-windows-no-uac.ps1 -Skip BinSkim
-    [ValidateSet('WinMerge', 'BinSkim', 'GitConfig')]
+    [ValidateSet('WinMerge', 'VsWhere', 'BinSkim', 'GitConfig')]
     [string[]] $Skip = @()
 )
 
@@ -48,6 +53,11 @@ $GitUserEmail = ''   # e.g. 'ada@example.com'
 $BinSkimPackage = 'microsoft.codeanalysis.binskim'
 $BinSkimDir     = Join-Path $env:LOCALAPPDATA 'Programs\BinSkim'
 
+# Where the elevated half puts rsync.exe and the ssh.exe it ships with. Only
+# read here, to prefer that ssh.exe for git - keep it in step with $RsyncDir in
+# setup-windows-with-uac.ps1 if you move the install.
+$RsyncDir = 'C:\Tools\rsync'
+
 function Write-Step([string]$Msg) {
     Write-Host "`n==> $Msg" -ForegroundColor Cyan
 }
@@ -84,6 +94,22 @@ function Add-WinMergeToUserPath {
     Add-ToUserPath $dir
 }
 
+function Add-VsWhereToUserPath {
+    # vswhere.exe is how scripts locate Visual Studio (MSBuild, VsDevCmd.bat,
+    # the Windows SDK), and the VS installer drops it in a fixed directory that
+    # is never on the PATH. VsDevCmd.bat itself prints "'vswhere.exe' is not
+    # recognized" on every run without it. The directory is fixed by contract
+    # (32-bit Program Files, no version in the path), so there is nothing to
+    # search for: if it is missing, Visual Studio is not installed.
+    Write-Step 'vswhere on the user PATH'
+    $dir = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer'
+    if (-not (Test-Path (Join-Path $dir 'vswhere.exe'))) {
+        Write-Warning "vswhere.exe not found in $dir (no Visual Studio installer present); user PATH unchanged."
+        return
+    }
+    Add-ToUserPath $dir
+}
+
 function Install-BinSkim {
     # BinSkim checks the exact mitigations the native project enables in
     # CMakeLists.txt (CFG/XFG, CET, ASLR/HighEntropyVA, DEP, /GS, stack cookies,
@@ -211,18 +237,57 @@ function Set-GlobalGitConfig {
         Write-Host "    identity: $GitUserName <$GitUserEmail>"
     }
 
-    # --- Make git use the Windows OpenSSH client ---
+    # --- Make git use a Win32-OpenSSH client ---
     # Git for Windows ships its own MSYS2 ssh.exe and prefers it, and that client
     # cannot reach the Windows ssh-agent service that the elevated half enables:
     # Win32-OpenSSH publishes the agent on a named pipe the MSYS2 build does not
     # speak. So keys added with `ssh-add` from PowerShell stay invisible to git,
     # and a push falls back to hunting for a key file and prompting for its
-    # passphrase. Pointing core.sshCommand at the in-box ssh.exe gives git the
-    # same client, the same agent, and the same %USERPROFILE%\.ssh\config as
+    # passphrase. Pointing core.sshCommand at a Win32-OpenSSH ssh.exe gives git
+    # the same client, the same agent, and the same %USERPROFILE%\.ssh\config as
     # `ssh` from an ordinary shell.
-    $winSsh = Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe'
-    if (-not (Test-Path $winSsh)) {
-        Write-Warning "No Windows OpenSSH client at $winSsh. Add the 'OpenSSH Client' optional feature and re-run; until then git uses its own bundled ssh.exe, which cannot see keys held by the Windows ssh-agent service."
+    #
+    # Two of those are on the box, and the one beside rsync.exe is preferred.
+    # It is the same client from the same source, with the same ~/.ssh, agent
+    # and known_hosts, built with a pump on its stdin: the in-box one reads
+    # stdin 3KB at a time, which holds anything git PUSHES to ~17MB/s however
+    # fast the link is. It only exists once the elevated half has run, so the
+    # in-box client stays the fallback - and on a first provisioning run from
+    # setup-windows.bat it is the elevated half that runs first, so the fast one
+    # is normally already there.
+    $sshCandidates = @(
+        (Join-Path $RsyncDir 'ssh.exe'),
+        (Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe')
+    )
+    $winSsh = $null
+    foreach ($cand in $sshCandidates) {
+        if (-not (Test-Path $cand)) { continue }
+        # Run it, rather than just believing the file is there: the build beside
+        # rsync.exe links against the libcrypto.dll the OpenSSH Client capability
+        # puts in System32, and without that capability it is a binary that does
+        # not start. Better to find that out here than on the next `git push`.
+        #
+        # EAP back to Continue for the call: ssh -V writes its version to
+        # STDERR, and with $ErrorActionPreference = 'Stop' a native command's
+        # stderr becomes a terminating RemoteException - so the working client
+        # would look like the broken one.
+        $prevEap = $ErrorActionPreference
+        $ErrorActionPreference = 'Continue'
+        $version = $null
+        # Clear the exit code first, explicitly at global scope. An exe that
+        # cannot start at all - the missing-libcrypto case - throws here without
+        # ever setting one, and the stale 0 from the last native command that DID
+        # run would otherwise read as success. $global: because a bare assignment
+        # would make a local copy that the native call then does not update.
+        $global:LASTEXITCODE = $null
+        try { $version = (& $cand -V 2>&1 | Select-Object -First 1) } catch { }
+        finally { $ErrorActionPreference = $prevEap }
+        if ($LASTEXITCODE -eq 0) { $winSsh = $cand; break }
+        $why = if ($null -eq $LASTEXITCODE) { 'it would not start' } else { "exit $LASTEXITCODE" }
+        Write-Warning "$cand did not run ($why)$(if ($version) { ": $version" })"
+    }
+    if (-not $winSsh) {
+        Write-Warning "No working Win32-OpenSSH client found (looked in $($sshCandidates -join ', ')). Add the 'OpenSSH Client' optional feature and re-run; until then git uses its own bundled ssh.exe, which cannot see keys held by the Windows ssh-agent service."
         return
     }
     # Forward slashes on purpose: git parses core.sshCommand with shell quoting
@@ -230,6 +295,7 @@ function Set-GlobalGitConfig {
     $value = $winSsh -replace '\\', '/'
     & $git config --global core.sshCommand $value
     Write-Host "    core.sshCommand: $value"
+    Write-Host "    $version"
 }
 
 # ---------------------------------------------------------------------------
@@ -242,6 +308,7 @@ if (([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::
 
 $steps = [ordered]@{
     WinMerge  = { Add-WinMergeToUserPath }
+    VsWhere   = { Add-VsWhereToUserPath }
     BinSkim   = { Install-BinSkim }
     GitConfig = { Set-GlobalGitConfig }
 }