X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/452f525c182a835867d0f229c821c41118d15808..7d4887fe245e7643a497e87e04fc8f97d8ca436f:/setup-windows-with-uac.ps1

diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1
index 8da5c55..8d990f5 100644
--- a/setup-windows-with-uac.ps1
+++ b/setup-windows-with-uac.ps1
@@ -5,9 +5,13 @@
   via Start-Process -Verb RunAs, or run manually from an Administrator prompt.
 
   What this installs / configures:
+    - OpenSSH Client capability (the ssh.exe rsync shells out to, and the
+      System32 libcrypto.dll the release's own ssh.exe links against)
     - ssh-agent set to automatic + started
     - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22
-    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine PATH
+    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine
+      PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this
+      architecture
     - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,
       Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)
     - Windows Driver Kit 10.0.26100
@@ -105,6 +109,36 @@ try {
 # ---------------------------------------------------------------------------
 # Base tools via winget
 # ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# OpenSSH Client
+#
+# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent
+# from some Server images. Two things below want it: rsync does not speak ssh
+# itself, it execs an ssh binary, and the release's own ssh.exe links against the
+# libcrypto.dll this capability puts in System32. It also owns the ssh-agent
+# service configured next, so a missing client is why that step would fail.
+#
+# Non-fatal, like the server half below: a box that cannot have it should still
+# finish provisioning.
+# ---------------------------------------------------------------------------
+Write-Step 'OpenSSH Client'
+try {
+    $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |
+            Select-Object -First 1
+    if (-not $sshc) {
+        Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'
+    } elseif ($sshc.State -eq 'Installed') {
+        Write-Host "    OK: $($sshc.Name) already installed"
+    } else {
+        Write-Host "    Installing $($sshc.Name) ..."
+        $r = Add-WindowsCapability -Online -Name $sshc.Name
+        if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Client]' -ForegroundColor Yellow }
+    }
+} catch {
+    Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"
+}
+
 # ---------------------------------------------------------------------------
 # SSH agent
 # ---------------------------------------------------------------------------
@@ -174,6 +208,21 @@ try {
 # Windows' OpenSSH ships the transport only - no rsync - so pushing test data
 # from a Linux box needs an rsync.exe on the Windows side.
 #
+# The release is one zip per architecture - rsync-windows-x64.zip and
+# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the
+# licence texts under exactly those names. Both exes are installed, together:
+# rsync.exe prefers an ssh.exe in its own directory, and the release's build is
+# what makes a push FROM this box run at line rate. The ssh.exe Windows ships
+# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the
+# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same
+# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits
+# ahead of C:\Tools\rsync on the machine PATH.
+#
+# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability
+# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses
+# AES-NI. No copy of it ships in the zip, so where the capability is missing we
+# unpack rsync alone rather than an ssh.exe that will not start.
+#
 # Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is
 # invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes
 # the client-side --rsync-path escape hatch painful to quote. Added to the
@@ -184,18 +233,78 @@ try {
 # Non-fatal: a download failure only warns.
 # ---------------------------------------------------------------------------
 Write-Step 'rsync for Windows'
-$RsyncUrl = 'https://github.com/nuket/rsync-windows/releases/download/v3.5.0-g521ad8ad/rsync.exe'
-$RsyncDir = 'C:\Tools\rsync'
+$RsyncRepo  = 'nuket/rsync-windows'
+$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }
+# The /releases/latest/download/ redirect rather than the API: unauthenticated
+# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a
+# shared NAT can genuinely exhaust, and the redirect costs none of that budget.
+# To hold a box on a known build, pin the tag instead:
+#     .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset
+$RsyncUrl   = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"
+$RsyncDir   = 'C:\Tools\rsync'
 try {
     New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null
     $RsyncExe = Join-Path $RsyncDir 'rsync.exe'
-    # Download to a temp name first so an interrupted transfer can't leave a
-    # truncated rsync.exe sitting on the PATH.
-    $tmpExe = "$RsyncExe.download"
+
+    # Does the release's ssh.exe have the libcrypto it needs? Decided before the
+    # download so the answer can also gate what comes out of the zip.
+    $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'
+    $WantSsh   = Test-Path $SysCrypto
+    if (-not $WantSsh) {
+        Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."
+    } else {
+        $v = (Get-Item $SysCrypto).VersionInfo.FileVersion
+        if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {
+            Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."
+        }
+    }
+
+    # Download and unpack beside the targets, not over them, so an interrupted
+    # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch
+    # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive
+    # refuses any other extension outright ("*.download is not a supported
+    # archive file format"), where PowerShell 7 just reads the file.
     [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpExe -UseBasicParsing
-    Move-Item -Path $tmpExe -Destination $RsyncExe -Force
-    Write-Host "    Downloaded rsync.exe to $RsyncExe"
+    $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"
+    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing
+    Write-Host "    Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"
+
+    # Verify against the .sha256 published beside it. Same origin, so this is an
+    # integrity check on the transfer rather than a defence against a hostile
+    # release - but a truncated or proxy-mangled download is the failure that
+    # actually happens, and it fails here instead of mid-transfer later.
+    #
+    # -OutFile, not .Content: GitHub serves the .sha256 as
+    # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather
+    # than a string for any non-text content type, so .Content would compare the
+    # first BYTE against the hash and fail on every correct download.
+    $tmpSha = "$tmpZip.sha256"
+    Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing
+    $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()
+    Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue
+    $got  = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()
+    if ($want -and $want -ne $got) {
+        Remove-Item $tmpZip -Force
+        throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"
+    }
+    Write-Host "    SHA-256 verified: $got"
+
+    # Unpack to a scratch directory and move out the files we asked for, rather
+    # than expanding straight over the install directory: the zip is the unit
+    # that was checksummed, and this way a future release adding something to it
+    # cannot quietly drop that something onto the machine PATH.
+    $unpack = Join-Path $RsyncDir '.unpack'
+    if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }
+    Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force
+    Remove-Item $tmpZip -Force
+    foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {
+        $src = Join-Path $unpack $f
+        if (-not (Test-Path $src)) { continue }
+        if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }
+        Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force
+    }
+    Remove-Item -Recurse -Force $unpack
+    Write-Host "    Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"
 
     # Machine PATH (HKLM environment). Idempotent: only appends if absent.
     $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')
@@ -217,7 +326,8 @@ try {
     & $RsyncExe --version | Select-Object -First 1
 } catch {
     Write-Warning "rsync install failed: $($_.Exception.Message)"
-    Write-Warning "Download manually from $RsyncUrl and drop it in $RsyncDir."
+    Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"
+    Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."
 }
 
 # ---------------------------------------------------------------------------