X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/3c096107d23668caeec91ba27095c9f94d3792b5..b8144088df5abe5fb042890ef5bc8fd72b279b79:/setup-windows-with-uac.ps1 diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1 index 254db14..8d990f5 100644 --- a/setup-windows-with-uac.ps1 +++ b/setup-windows-with-uac.ps1 @@ -1,11 +1,17 @@ #Requires -RunAsAdministrator <# setup-windows-with-uac.ps1 - Elevated portion of BlockBox Windows provisioning. Invoked by setup-windows.bat + Elevated portion of the Windows provisioning. Invoked by setup-windows.bat via Start-Process -Verb RunAs, or run manually from an Administrator prompt. What this installs / configures: + - OpenSSH Client capability (the ssh.exe rsync shells out to, and the + System32 libcrypto.dll the release's own ssh.exe links against) - ssh-agent set to automatic + started + - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22 + - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine + PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this + architecture - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX, Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset) - Windows Driver Kit 10.0.26100 @@ -103,6 +109,36 @@ try { # --------------------------------------------------------------------------- # Base tools via winget # --------------------------------------------------------------------------- + +# --------------------------------------------------------------------------- +# OpenSSH Client +# +# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent +# from some Server images. Two things below want it: rsync does not speak ssh +# itself, it execs an ssh binary, and the release's own ssh.exe links against the +# libcrypto.dll this capability puts in System32. It also owns the ssh-agent +# service configured next, so a missing client is why that step would fail. +# +# Non-fatal, like the server half below: a box that cannot have it should still +# finish provisioning. +# --------------------------------------------------------------------------- +Write-Step 'OpenSSH Client' +try { + $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' | + Select-Object -First 1 + if (-not $sshc) { + Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.' + } elseif ($sshc.State -eq 'Installed') { + Write-Host " OK: $($sshc.Name) already installed" + } else { + Write-Host " Installing $($sshc.Name) ..." + $r = Add-WindowsCapability -Online -Name $sshc.Name + if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Client]' -ForegroundColor Yellow } + } +} catch { + Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)" +} + # --------------------------------------------------------------------------- # SSH agent # --------------------------------------------------------------------------- @@ -110,6 +146,190 @@ Write-Step 'Enabling ssh-agent' Set-Service -Name ssh-agent -StartupType Automatic if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent } +# --------------------------------------------------------------------------- +# OpenSSH Server (sshd) +# +# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the +# transport rsync rides on when seeding test data in. Ships with Windows 10 +# 1809+ / Windows 11 as an on-demand capability, so no third-party install. +# +# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall +# rule; we verify and create it if missing (it is absent on some images). +# +# Non-fatal: a box that can't run sshd should still finish provisioning. +# --------------------------------------------------------------------------- +Write-Step 'OpenSSH Server (sshd)' +try { + $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' | + Select-Object -First 1 + if (-not $sshd) { + Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.' + } else { + if ($sshd.State -ne 'Installed') { + Write-Host " Installing $($sshd.Name) ..." + $r = Add-WindowsCapability -Online -Name $sshd.Name + if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Server]' -ForegroundColor Yellow } + } else { + Write-Host " OK: $($sshd.Name) already installed" + } + + Set-Service -Name sshd -StartupType Automatic + if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd } + Write-Host ' sshd: Automatic + running' + + # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and + # bridged adapters are frequently classified Public, and the capability's + # own rule is Private-only on some images, which is what leaves a plainly + # running sshd plainly unreachable. + # + # OpenSSH-Server-In-TCP is the name the capability itself uses, so this + # WIDENS that rule rather than adding a second one next to it. Creating + # our own under a different name would leave the narrow rule in place and + # the box still unreachable on a Public-classified adapter; creating one + # under the same name would collide. Adopt it if present, create it if not. + $ruleName = 'OpenSSH-Server-In-TCP' + if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) { + Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any + Write-Host " Widened firewall rule $ruleName to all profiles" + } else { + New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' ` + -Enabled True -Direction Inbound -Protocol TCP -Action Allow ` + -LocalPort 22 -Profile Any | Out-Null + Write-Host " Added firewall rule $ruleName (TCP 22, all profiles)" + } + } +} catch { + Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)" +} + +# --------------------------------------------------------------------------- +# rsync for Windows (github.com/nuket/rsync-windows) +# +# Windows' OpenSSH ships the transport only - no rsync - so pushing test data +# from a Linux box needs an rsync.exe on the Windows side. +# +# The release is one zip per architecture - rsync-windows-x64.zip and +# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the +# licence texts under exactly those names. Both exes are installed, together: +# rsync.exe prefers an ssh.exe in its own directory, and the release's build is +# what makes a push FROM this box run at line rate. The ssh.exe Windows ships +# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the +# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same +# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits +# ahead of C:\Tools\rsync on the machine PATH. +# +# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability +# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses +# AES-NI. No copy of it ships in the zip, so where the capability is missing we +# unpack rsync alone rather than an ssh.exe that will not start. +# +# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is +# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes +# the client-side --rsync-path escape hatch painful to quote. Added to the +# MACHINE PATH so it resolves for every account, including the non-interactive +# sshd session, which builds its environment from the machine + user registry +# PATH rather than from a login shell. +# +# Non-fatal: a download failure only warns. +# --------------------------------------------------------------------------- +Write-Step 'rsync for Windows' +$RsyncRepo = 'nuket/rsync-windows' +$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' } +# The /releases/latest/download/ redirect rather than the API: unauthenticated +# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a +# shared NAT can genuinely exhaust, and the redirect costs none of that budget. +# To hold a box on a known build, pin the tag instead: +# .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset +$RsyncUrl = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset" +$RsyncDir = 'C:\Tools\rsync' +try { + New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null + $RsyncExe = Join-Path $RsyncDir 'rsync.exe' + + # Does the release's ssh.exe have the libcrypto it needs? Decided before the + # download so the answer can also gate what comes out of the zip. + $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll' + $WantSsh = Test-Path $SysCrypto + if (-not $WantSsh) { + Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH." + } else { + $v = (Get-Item $SysCrypto).VersionInfo.FileVersion + if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') { + Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start." + } + } + + # Download and unpack beside the targets, not over them, so an interrupted + # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch + # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive + # refuses any other extension outright ("*.download is not a supported + # archive file format"), where PowerShell 7 just reads the file. + [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset" + Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing + Write-Host " Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)" + + # Verify against the .sha256 published beside it. Same origin, so this is an + # integrity check on the transfer rather than a defence against a hostile + # release - but a truncated or proxy-mangled download is the failure that + # actually happens, and it fails here instead of mid-transfer later. + # + # -OutFile, not .Content: GitHub serves the .sha256 as + # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather + # than a string for any non-text content type, so .Content would compare the + # first BYTE against the hash and fail on every correct download. + $tmpSha = "$tmpZip.sha256" + Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing + $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower() + Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue + $got = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower() + if ($want -and $want -ne $got) { + Remove-Item $tmpZip -Force + throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got" + } + Write-Host " SHA-256 verified: $got" + + # Unpack to a scratch directory and move out the files we asked for, rather + # than expanding straight over the install directory: the zip is the unit + # that was checksummed, and this way a future release adding something to it + # cannot quietly drop that something onto the machine PATH. + $unpack = Join-Path $RsyncDir '.unpack' + if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack } + Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force + Remove-Item $tmpZip -Force + foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') { + $src = Join-Path $unpack $f + if (-not (Test-Path $src)) { continue } + if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue } + Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force + } + Remove-Item -Recurse -Force $unpack + Write-Host " Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })" + + # Machine PATH (HKLM environment). Idempotent: only appends if absent. + $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') + if (-not $m) { $m = '' } + if (($m -split ';') -notcontains $RsyncDir) { + $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir } + [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') + Write-Host " Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)." + # sshd caches the environment it was started with, so an already-running + # service would not see the new PATH until restarted. + if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') { + Restart-Service sshd + Write-Host ' Restarted sshd so it inherits the updated machine PATH.' + } + } else { + Write-Host " OK: $RsyncDir already in the machine PATH" + } + + & $RsyncExe --version | Select-Object -First 1 +} catch { + Write-Warning "rsync install failed: $($_.Exception.Message)" + Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually" + Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together." +} + # --------------------------------------------------------------------------- # Visual Studio 2022 Community # ---------------------------------------------------------------------------