X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/649b04df2966260f38a18d5225a68bd4e0896b95..cd774a195092cd0ab4c8e92862d0c5cf7e04f195:/setup-windows-no-uac.ps1 diff --git a/setup-windows-no-uac.ps1 b/setup-windows-no-uac.ps1 index 5d713c3..1fd2c1f 100644 --- a/setup-windows-no-uac.ps1 +++ b/setup-windows-no-uac.ps1 @@ -40,7 +40,7 @@ param( # for several, dot-call the script or use -Command: # .\setup-windows-no-uac.ps1 -Skip BinSkim,GitConfig # powershell -File .\setup-windows-no-uac.ps1 -Skip BinSkim - [ValidateSet('WinMerge', 'VsWhere', 'BinSkim', 'GitConfig', 'ArchAudit')] + [ValidateSet('WinMerge', 'VsWhere', 'BinSkim', 'GitConfig', 'NinjaPath', 'LlvmPath', 'ArchAudit')] [string[]] $Skip = @() ) @@ -73,19 +73,46 @@ function Write-Step([string]$Msg) { Write-Host "`n==> $Msg" -ForegroundColor Cyan } -function Add-ToUserPath([string]$Dir) { +function Add-ToUserPath { # HKCU PATH, not the process PATH: this must outlive the script. Idempotent, # and re-applied on every run so an entry lost to an unrelated PATH edit is # repaired without re-doing the install that put it there. + # + # -Prepend puts the directory FIRST and moves it there if it is already + # present further down, which is the difference between "on the PATH" and + # "the one that wins". Only for entries where that matters; appending is the + # polite default and stays the default. + param( + [string] $Dir, + [switch] $Prepend + ) $user = [Environment]::GetEnvironmentVariable('Path', 'User') if (-not $user) { $user = '' } - if (($user -split ';') -contains $Dir) { - Write-Host " $Dir already in user PATH." + # Compare trailing-backslash-insensitively: C:\x and C:\x\ are the same + # directory, and adding a second spelling of one is just noise. + $norm = { param($s) $s.Trim().TrimEnd('\') } + $entries = @($user -split ';' | Where-Object { $_.Trim() }) + $already = $entries | Where-Object { (& $norm $_) -eq (& $norm $Dir) } + + if (-not $Prepend) { + if ($already) { Write-Host " $Dir already in user PATH."; return } + $new = if ($user.Trim()) { $user.TrimEnd(';') + ';' + $Dir } else { $Dir } + [Environment]::SetEnvironmentVariable('Path', $new, 'User') + Write-Host " Added $Dir to user PATH (restart your shell to pick it up)." + return + } + + if ($already -and (& $norm $entries[0]) -eq (& $norm $Dir)) { + Write-Host " $Dir already first in user PATH." return } - $new = if ($user.Trim()) { $user.TrimEnd(';') + ';' + $Dir } else { $Dir } - [Environment]::SetEnvironmentVariable('Path', $new, 'User') - Write-Host " Added $Dir to user PATH (restart your shell to pick it up)." + $rest = $entries | Where-Object { (& $norm $_) -ne (& $norm $Dir) } + [Environment]::SetEnvironmentVariable('Path', (@($Dir) + $rest) -join ';', 'User') + if ($already) { + Write-Host " Moved $Dir to the front of the user PATH (restart your shell to pick it up)." + } else { + Write-Host " Added $Dir to the front of the user PATH (restart your shell to pick it up)." + } } function Add-WinMergeToUserPath { @@ -341,6 +368,104 @@ function Set-GlobalGitConfig { Write-Host " $version" } +function Set-NativeNinjaFirst { + # Make the native ninja.exe the one that wins, including inside a Visual + # Studio Developer Command Prompt. + # + # WHY THIS IS INSURANCE RATHER THAN THE FIX. VS ships an x64 ninja.exe even on + # ARM64 and puts it on the PATH from + # Common7\Tools\vsdevcmd\ext\cmake.bat, which does: + # set "PATH=%PATH%;...\CMake\bin;...\CMake\Ninja" + # That APPENDS - the VS directories land at the very end of the composed + # PATH, behind every machine and user entry. So a native ninja installed + # anywhere on the user PATH already beats it, and measurement on an ARM64 box + # confirms it does. (An earlier revision of this script claimed VsDevCmd + # prepends and that the VS copy therefore always won; that was wrong.) + # + # It is still worth pinning the order explicitly: winget appends its package + # directory to the user PATH, so the margin depends on nothing more than two + # append orders staying as they are, in a file Microsoft owns and revises. + # Putting the directory first costs nothing and removes the dependency. + # + # Ninja is worth this attention where a one-off tool would not be: it is + # re-invoked for every edge in the build graph, so it is the one place an + # emulated binary is paid over and over rather than once. + Write-Step 'Native ninja ahead of the Visual Studio copy' + + $candidates = @() + $candidates += Get-ChildItem (Join-Path $env:LOCALAPPDATA 'Microsoft\WinGet\Packages') ` + -Filter 'ninja.exe' -Recurse -Depth 2 -ErrorAction SilentlyContinue | + ForEach-Object { $_.FullName } + $candidates += @( + (Join-Path $env:ProgramFiles 'Ninja\ninja.exe') + (Join-Path $env:LOCALAPPDATA 'Programs\Ninja\ninja.exe') + ) + # A ninja already on the PATH counts too - but only if it is not the VS one, + # which is the binary this step exists to get out in front of. + $onPath = (Get-Command ninja.exe -ErrorAction SilentlyContinue | Select-Object -First 1).Source + if ($onPath -and $onPath -notmatch 'CommonExtensions\\Microsoft\\CMake') { $candidates += $onPath } + + $native = $null + foreach ($c in ($candidates | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique)) { + $m = Get-PEMachine $c + if ($m -eq $(if ($IsArm64) { 'ARM64' } else { 'x64' })) { $native = $c; break } + } + + if (-not $native) { + Write-Warning 'No native ninja.exe found. Install it with: winget install Ninja-build.Ninja' + Write-Warning 'Until then a build using the Ninja generator gets the x64 ninja Visual Studio bundles.' + return + } + + Write-Host " native ninja: $native ($(Get-PEMachine $native))" + Add-ToUserPath (Split-Path $native -Parent) -Prepend +} + +function Add-LlvmToUserPath { + # Put the upstream LLVM's bin directory on the user PATH. + # + # Two reasons this needs a step rather than trusting the installer: + # + # 1. WHERE IT LANDS. LLVM's NSIS installer targets %ProgramFiles%\LLVM, and + # when it cannot write there - a standard user, no elevation - it does not + # fail. It silently falls back to a per-user directory, observed as + # %USERPROFILE%\Documents\LLVM, and winget still reports "Successfully + # installed". So the package is registered, the compiler is genuinely + # there and native, and nothing can find it. + # 2. PATH. The installer's "add to PATH" option is not taken in a silent + # install, so clang-cl is not a command afterwards either way. + # + # Appended, not prepended: this is a second compiler kept deliberately + # alongside MSVC, and it should not quietly win a `clang-cl` that some script + # meant for Visual Studio's copy. Note VS does NOT put its own + # VC\Tools\Llvm on the PATH (its clang-cl is reached through CMake's + # -T ClangCL), so there is no collision to lose here. + Write-Step 'Upstream LLVM on the user PATH' + $candidates = @( + (Join-Path $env:ProgramFiles 'LLVM\bin') + (Join-Path ${env:ProgramFiles(x86)} 'LLVM\bin') + (Join-Path $env:LOCALAPPDATA 'Programs\LLVM\bin') + (Join-Path ([Environment]::GetFolderPath('MyDocuments')) 'LLVM\bin') + (Join-Path $env:USERPROFILE 'Documents\LLVM\bin') + ) + $dir = $candidates | Where-Object { Test-Path (Join-Path $_ 'clang-cl.exe') } | Select-Object -First 1 + if (-not $dir) { + Write-Host ' Not installed (winget install LLVM.LLVM); Visual Studio''s own clang-cl is unaffected.' -ForegroundColor DarkGray + return + } + $exe = Join-Path $dir 'clang-cl.exe' + $mach = Get-PEMachine $exe + Write-Host " $exe ($mach)" + if ($IsArm64 -and $mach -ne 'ARM64') { + Write-Warning "This LLVM is $mach, not ARM64. winget install LLVM.LLVM should resolve to the -woa64 build on this host." + } + if ($dir -notmatch [regex]::Escape($env:ProgramFiles)) { + Write-Host ' Note: not under Program Files - the installer fell back to a per-user' -ForegroundColor Yellow + Write-Host ' location because it could not write there. Re-run elevated for a machine-wide install.' -ForegroundColor Yellow + } + Add-ToUserPath $dir +} + function Get-PEMachine { # Architecture of a PE, read straight from the COFF header: the 2 bytes at # the e_lfanew offset + 4. Cheap, and it answers the only question that @@ -386,6 +511,31 @@ function Invoke-ArchAudit { # either native or a known, listed exception. Write-Step "Architecture audit (host: $HostArch)" + # Resolve against the PATH a NEW shell would get, not this process's. + # + # The steps above write the HKCU PATH, which a running process never sees - + # so auditing $env:PATH would report the state from before this script ran and + # warn about a problem it had just fixed. Compose machine + user from the + # registry (the order Windows itself uses), then append anything extra this + # process happens to carry: that tail is where a Developer Command Prompt's VS + # directories live, and keeping it last mirrors how VsDevCmd appends them. + $composed = @() + foreach ($scope in 'Machine', 'User') { + $v = [Environment]::GetEnvironmentVariable('Path', $scope) + if ($v) { $composed += ($v -split ';' | Where-Object { $_.Trim() }) } + } + $composed += ($env:PATH -split ';' | Where-Object { $_.Trim() }) + $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + $searchPath = @($composed | Where-Object { $seen.Add($_.Trim().TrimEnd('\')) }) + + function Resolve-OnPath([string]$Exe) { + foreach ($d in $searchPath) { + $p = Join-Path $d $Exe + if (Test-Path $p -PathType Leaf) { return $p } + } + return $null + } + # Tools with no native ARM64 build available anywhere, with the reason. These # print as expected rather than as problems - see the README's ARM64 section. $KnownEmulated = @{ @@ -402,16 +552,15 @@ function Invoke-ArchAudit { # it. Printed with the finding so the log carries the remedy, not just the # complaint. # - # ninja is the one that actually bites. Visual Studio bundles an x64 ninja.exe - # even on ARM64, and VsDevCmd.bat PREPENDS the VS directories to PATH - so - # inside a Developer Command Prompt the emulated one wins over the native - # winget copy, and that is exactly the shell C++ builds happen in. It matters - # more than a one-off tool because ninja is re-invoked for every edge in the - # build graph. + # ninja is the one that actually bites: Visual Studio bundles an x64 ninja.exe + # even on ARM64, and it is re-invoked for every edge in the build graph, so + # an emulated one is paid over and over rather than once. The NinjaPath step + # puts the native copy first; this is the check that it worked. $Remedies = @{ - 'ninja.exe' = 'Visual Studio bundles an x64 ninja and VsDevCmd prepends its directory. Pass -DCMAKE_MAKE_PROGRAM to the native one (winget install Ninja-build.Ninja), or put its directory ahead of the VS one.' - 'cmake.exe' = 'Install the native build with: winget install Kitware.CMake' - 'clang-cl.exe' = 'Install the upstream native LLVM with: winget install LLVM.LLVM' + 'ninja.exe' = 'Visual Studio bundles an x64 ninja. Install the native one (winget install Ninja-build.Ninja) and re-run - the NinjaPath step puts its directory at the front of the user PATH.' + 'cmake.exe' = 'Install the native build with: winget install Kitware.CMake (its MSI is machine-scope, so it needs an administrator).' + 'clang-cl.exe' = 'Install the upstream native LLVM with: winget install LLVM.LLVM' + 'WinMergeU.exe' = 'Upstream ships ARM64 as a MACHINE-scope installer and x64 as per-user, so an unelevated winget picks x64. Re-run as an administrator to get: winget install WinMerge.WinMerge --architecture arm64' } $vs = $null @@ -428,7 +577,13 @@ function Invoke-ArchAudit { 'pwsh.exe' = @() 'cmake.exe' = @((Join-Path $env:ProgramFiles 'CMake\bin\cmake.exe')) 'ninja.exe' = @() - 'clang-cl.exe' = @((Join-Path $env:ProgramFiles 'LLVM\bin\clang-cl.exe')) + # Upstream LLVM. The Documents path is not a typo - see Add-LlvmToUserPath + # for why an unelevated install lands there. + 'clang-cl.exe' = @( + (Join-Path $env:ProgramFiles 'LLVM\bin\clang-cl.exe') + (Join-Path $env:LOCALAPPDATA 'Programs\LLVM\bin\clang-cl.exe') + (Join-Path ([Environment]::GetFolderPath('MyDocuments')) 'LLVM\bin\clang-cl.exe') + ) 'dotnet.exe' = @((Join-Path $env:ProgramFiles 'dotnet\dotnet.exe')) 'WinMergeU.exe' = @((Join-Path $env:ProgramFiles 'WinMerge\WinMergeU.exe'), (Join-Path ${env:ProgramFiles(x86)} 'WinMerge\WinMergeU.exe')) 'BinSkim.exe' = @((Join-Path $BinSkimDir 'BinSkim.exe')) @@ -456,12 +611,21 @@ function Invoke-ArchAudit { $native = if ($IsArm64) { 'ARM64' } else { 'x64' } $unexpected = @() foreach ($name in $targets.Keys) { - # PATH first - that is the binary a build would actually invoke - then the - # explicit candidates. The bare exe name is stripped of any " (label)". - $exe = ($name -split ' ')[0] - $path = (Get-Command $exe -ErrorAction SilentlyContinue | - Select-Object -First 1).Source - if (-not $path) { $path = $targets[$name] | Where-Object { $_ -and (Test-Path $_) } | Select-Object -First 1 } + # A LABELLED entry - "clang-cl.exe (VS)" - names one specific copy, so it + # is resolved ONLY from its explicit candidates. Falling back to the PATH + # there would silently answer with a different installation of the same + # tool: with upstream LLVM on the PATH, the "(VS)" row reported the + # upstream compiler and so claimed Visual Studio's was present when it was + # not. Unlabelled entries still resolve PATH-first, because for those the + # question is which binary a build would actually invoke. + $exe = ($name -split ' ')[0] + $isPinned = $name -ne $exe + if ($isPinned) { + $path = $targets[$name] | Where-Object { $_ -and (Test-Path $_) } | Select-Object -First 1 + } else { + $path = Resolve-OnPath $exe + if (-not $path) { $path = $targets[$name] | Where-Object { $_ -and (Test-Path $_) } | Select-Object -First 1 } + } if (-not $path) { Write-Host (" {0,-22} {1}" -f $name, '- not installed') -ForegroundColor DarkGray; continue } $mach = Get-PEMachine $path @@ -502,6 +666,8 @@ $steps = [ordered]@{ VsWhere = { Add-VsWhereToUserPath } BinSkim = { Install-BinSkim } GitConfig = { Set-GlobalGitConfig } + NinjaPath = { Set-NativeNinjaFirst } + LlvmPath = { Add-LlvmToUserPath } # Last on purpose: it reports on what the steps above (and the winget installs # in setup-windows.bat) actually put on the box. ArchAudit = { Invoke-ArchAudit }