X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/d254a9bebd5448269d34a5c6dfcd36b646659b31..0b4125206461c1a63a971ac9cf503319bcb05798:/setup-windows-with-uac.ps1 diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1 index 4b7ea94..4e3602f 100644 --- a/setup-windows-with-uac.ps1 +++ b/setup-windows-with-uac.ps1 @@ -4,6 +4,14 @@ Elevated portion of the Windows provisioning. Invoked by setup-windows.bat via Start-Process -Verb RunAs, or run manually from an Administrator prompt. + Its steps are the 'uac' rows of setup-windows-steps.ps1. The batch file runs it + with -Only -Yes, having already asked. Run + by hand, it lists what it will do and asks before doing any of it: + + .\setup-windows-with-uac.ps1 all of it, after asking + .\setup-windows-with-uac.ps1 -Only VisualStudio,Wdk just these + .\setup-windows-with-uac.ps1 -Skip VTune -Yes without asking + What this installs / configures: - OpenSSH Client capability (the ssh.exe rsync shells out to, and the System32 libcrypto.dll the release's own ssh.exe links against) @@ -37,6 +45,16 @@ What changes is called out at each step, and $HostArch below is what drives it. #> +[CmdletBinding()] +param( + # Step names from setup-windows-steps.ps1, comma-separated. `powershell -File` + # hands "A,B" to an array parameter as one string; it is split, so both work. + [string[]] $Only, + [string[]] $Skip = @(), + # Do not ask first. setup-windows.bat passes it, having asked already. + [switch] $Yes +) + $ErrorActionPreference = 'Stop' # --------------------------------------------------------------------------- @@ -53,14 +71,16 @@ $ErrorActionPreference = 'Stop' # under .NET Framework on Prism it is not, so it is kept only as a fallback. # # $IsArm64 gates: +# - which steps run at all. VsClang, VsWinXP and Wdk are x64-only, and that is +# decided in setup-windows-steps.ps1 (-X64Only, with the reason the plan +# shows); the comments at each step here carry the full reasoning. In short: +# the v141/XP toolset has no ARM64-hosted compiler and Microsoft does not +# ship Windows XP targeting for Arm hosts; Clang/LLVM and the WDK are out by +# policy rather than by limitation - both are available and native on Arm # - which rsync-windows release zip is fetched (x86 / x64 / arm64, all native) # - which Visual Studio generation is driven ($VsChannel: 18 on Arm, 17 on x64) -# - the Visual Studio component groups: ARM64 build tools in; the v141/XP -# toolset out because it has no ARM64-hosted compiler and Microsoft does not -# ship Windows XP targeting for Arm hosts; Clang/LLVM and the WDK VSIX out by -# policy rather than by limitation - both are available and native on Arm -# - whether the Windows Driver Kit is installed at all -# - what the VTune and WPT steps report +# - the base Visual Studio components: ARM64 build tools in, the WDK VSIX out +# - what the verification, VTune and WPT steps report # --------------------------------------------------------------------------- $rawArch = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -ErrorAction SilentlyContinue).PROCESSOR_ARCHITECTURE if (-not $rawArch) { $rawArch = [Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString() } @@ -121,6 +141,18 @@ function Get-VsInstallPath { Select-Object -First 1 } +function Test-VsHasComponents([string[]] $Ids) { + # True when the Visual Studio this script drives already has every one of + # these workload / component ids. vswhere's -requires matches only an + # instance that has ALL of them (checked: one id it does not have, and the + # instance is not returned), and it is scoped to $VsChannel the same way + # Get-VsInstallPath is, so the answer is about the install the passes target. + if (-not $Ids -or -not $script:InstallPath -or -not (Test-Path $script:VsWhere)) { return $false } + $range = "[$script:VsChannel.0,$($script:VsChannel + 1).0)" + $found = & $script:VsWhere -products '*' -version $range -requires $Ids -property installationPath -format value + @($found) -contains $script:InstallPath +} + function Invoke-VsModify { # Run one VS install/modify pass for a named group of components. Splitting # the install into separate passes makes it obvious WHICH group fails: each @@ -140,6 +172,14 @@ function Invoke-VsModify { Write-Host ' (no components in this group for this architecture - skipping)' -ForegroundColor DarkGray return } + # Everything already there: running the installer would change nothing and + # cost minutes. This script never UPDATES Visual Studio - `modify` adds + # components, it does not move the product version - so skipping loses + # nothing. Updates come from the Visual Studio Installer, as always. + if (Test-VsHasComponents $Ids) { + Write-Host " All $($Ids.Count) components already installed in $script:InstallPath; not running the installer." + return + } $addStr = ($Ids | ForEach-Object { "--add $_" }) -join ' ' # --installPath must be quoted: it contains spaces ("C:\Program Files\..."). # Windows PowerShell 5.1's Start-Process does not quote array elements, so we @@ -165,6 +205,38 @@ function Invoke-VsModify { if (-not $script:InstallPath) { $script:InstallPath = Get-VsInstallPath } } +# --------------------------------------------------------------------------- +# Which steps to take +# +# The steps, and which of them cannot run on this machine, come from the 'uac' +# rows of setup-windows-steps.ps1 - the same catalog setup-windows.bat builds its +# plan from. The plan is printed first, inside the transcript, so the log the +# batch file shows afterwards starts with what this half was asked to do. +# +# Every section below is gated on Test-SetupStep with its catalog Id, which also +# records that it was asked. Both kinds of disagreement with the catalog are +# loud: an Id the catalog does not have throws where it is used, and a selected +# step that no section ever asks about fails the run at the end rather than +# letting "All done." cover a step that was never taken. +# --------------------------------------------------------------------------- +. (Join-Path $PSScriptRoot 'setup-windows-steps.ps1') + +# Elevation is a given here (#Requires above), so nothing is blocked on it. +$Plan = @(Resolve-SetupSelection -Steps @(Get-SetupCatalog -IsArm64 $IsArm64 | Where-Object Runner -eq 'uac') ` + -Only $(if ($PSBoundParameters.ContainsKey('Only')) { $Only } else { $null }) -Skip $Skip ` + -IsArm64 $IsArm64 -Elevation 'ALREADY') +$StepIds = @($Plan | ForEach-Object { $_.Id }) +$RunSteps = @($Plan | Where-Object Selected | ForEach-Object { $_.Id }) +$AskedSteps = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + +function Test-SetupStep([string] $Id) { + if ($script:StepIds -notcontains $Id) { + throw "Test-SetupStep: '$Id' is not a setup-windows-with-uac.ps1 step in setup-windows-steps.ps1." + } + [void]$script:AskedSteps.Add($Id) + $script:RunSteps -contains $Id +} + # --------------------------------------------------------------------------- # This runs in a separate elevated window that closes the moment it exits, so # the non-elevated caller (setup-windows.bat) can't see what happened. Mirror @@ -177,6 +249,17 @@ try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {} try { +Write-SetupPlan $Plan "Plan for setup-windows-with-uac.ps1 (host: $HostArch)" +if (-not $RunSteps) { + Write-Host ' Nothing selected, so there is nothing to do.' + exit 0 +} +# From the batch file, -Yes: the question was asked before anything ran. By +# hand, ask now. Either way `exit` here still runs the finally below, so the +# transcript is closed and its ACL relaxed. +$ok = Confirm-SetupPlan -Yes:$Yes -Count $RunSteps.Count +if ($ok -ne $true) { exit $(if ($null -eq $ok) { 2 } else { 0 }) } + Write-Step "Host architecture: $HostArch" if ($IsArm64) { # x64 emulation ("Prism") is what carries every x64-only tool this script @@ -209,29 +292,33 @@ if ($IsArm64) { # Non-fatal, like the server half below: a box that cannot have it should still # finish provisioning. # --------------------------------------------------------------------------- -Write-Step 'OpenSSH Client' -try { - $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' | - Select-Object -First 1 - if (-not $sshc) { - Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.' - } elseif ($sshc.State -eq 'Installed') { - Write-Host " OK: $($sshc.Name) already installed" - } else { - Write-Host " Installing $($sshc.Name) ..." - $r = Add-WindowsCapability -Online -Name $sshc.Name - if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Client]' -ForegroundColor Yellow } +if (Test-SetupStep 'OpenSshClient') { + Write-Step 'OpenSSH Client' + try { + $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' | + Select-Object -First 1 + if (-not $sshc) { + Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.' + } elseif ($sshc.State -eq 'Installed') { + Write-Host " OK: $($sshc.Name) already installed" + } else { + Write-Host " Installing $($sshc.Name) ..." + $r = Add-WindowsCapability -Online -Name $sshc.Name + if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Client]' -ForegroundColor Yellow } + } + } catch { + Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)" } -} catch { - Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)" } # --------------------------------------------------------------------------- # SSH agent # --------------------------------------------------------------------------- -Write-Step 'Enabling ssh-agent' -Set-Service -Name ssh-agent -StartupType Automatic -if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent } +if (Test-SetupStep 'SshAgent') { + Write-Step 'Enabling ssh-agent' + Set-Service -Name ssh-agent -StartupType Automatic + if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent } +} # --------------------------------------------------------------------------- # OpenSSH Server (sshd) @@ -245,48 +332,50 @@ if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent } # # Non-fatal: a box that can't run sshd should still finish provisioning. # --------------------------------------------------------------------------- -Write-Step 'OpenSSH Server (sshd)' -try { - $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' | - Select-Object -First 1 - if (-not $sshd) { - Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.' - } else { - if ($sshd.State -ne 'Installed') { - Write-Host " Installing $($sshd.Name) ..." - $r = Add-WindowsCapability -Online -Name $sshd.Name - if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Server]' -ForegroundColor Yellow } +if (Test-SetupStep 'OpenSshServer') { + Write-Step 'OpenSSH Server (sshd)' + try { + $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' | + Select-Object -First 1 + if (-not $sshd) { + Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.' } else { - Write-Host " OK: $($sshd.Name) already installed" - } + if ($sshd.State -ne 'Installed') { + Write-Host " Installing $($sshd.Name) ..." + $r = Add-WindowsCapability -Online -Name $sshd.Name + if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Server]' -ForegroundColor Yellow } + } else { + Write-Host " OK: $($sshd.Name) already installed" + } - Set-Service -Name sshd -StartupType Automatic - if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd } - Write-Host ' sshd: Automatic + running' + Set-Service -Name sshd -StartupType Automatic + if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd } + Write-Host ' sshd: Automatic + running' - # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and - # bridged adapters are frequently classified Public, and the capability's - # own rule is Private-only on some images, which is what leaves a plainly - # running sshd plainly unreachable. - # - # OpenSSH-Server-In-TCP is the name the capability itself uses, so this - # WIDENS that rule rather than adding a second one next to it. Creating - # our own under a different name would leave the narrow rule in place and - # the box still unreachable on a Public-classified adapter; creating one - # under the same name would collide. Adopt it if present, create it if not. - $ruleName = 'OpenSSH-Server-In-TCP' - if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) { - Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any - Write-Host " Widened firewall rule $ruleName to all profiles" - } else { - New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' ` - -Enabled True -Direction Inbound -Protocol TCP -Action Allow ` - -LocalPort 22 -Profile Any | Out-Null - Write-Host " Added firewall rule $ruleName (TCP 22, all profiles)" + # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and + # bridged adapters are frequently classified Public, and the capability's + # own rule is Private-only on some images, which is what leaves a plainly + # running sshd plainly unreachable. + # + # OpenSSH-Server-In-TCP is the name the capability itself uses, so this + # WIDENS that rule rather than adding a second one next to it. Creating + # our own under a different name would leave the narrow rule in place and + # the box still unreachable on a Public-classified adapter; creating one + # under the same name would collide. Adopt it if present, create it if not. + $ruleName = 'OpenSSH-Server-In-TCP' + if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) { + Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any + Write-Host " Widened firewall rule $ruleName to all profiles" + } else { + New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' ` + -Enabled True -Direction Inbound -Protocol TCP -Action Allow ` + -LocalPort 22 -Profile Any | Out-Null + Write-Host " Added firewall rule $ruleName (TCP 22, all profiles)" + } } + } catch { + Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)" } -} catch { - Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)" } # --------------------------------------------------------------------------- @@ -319,177 +408,200 @@ try { # # Non-fatal: a download failure only warns. # --------------------------------------------------------------------------- -Write-Step 'rsync for Windows' -$RsyncRepo = 'nuket/rsync-windows' -# The release publishes x86, x64 and - since v3.5.0-gdeeda96f - arm64, so every -# architecture this script runs on gets a native build. ARM64 used to take the -# x64 zip under emulation, which was defensible (a transfer is bound by the -# socket, not by emulated CPU) but cost the release's ssh.exe: that x64 binary -# could not load the ARM64 libcrypto.dll in System32 and had to be deleted on -# every run. The arm64 asset ships an ARM64 rsync.exe AND an ARM64 ssh.exe, so -# both halves are now native and the fast client survives. -# -# Selected off $HostArch rather than Is64BitOperatingSystem, which answers "true" -# on ARM64 and so cannot tell the two 64-bit cases apart. -$RsyncAsset = switch ($HostArch) { - 'X64' { 'rsync-windows-x64.zip' } - 'Arm64' { 'rsync-windows-arm64.zip' } - default { 'rsync-windows-x86.zip' } -} -if ($IsArm64) { - Write-Host ' ARM64: using the native arm64 asset (rsync.exe and ssh.exe both ARM64).' -ForegroundColor Green -} -# The /releases/latest/download/ redirect rather than the API: unauthenticated -# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a -# shared NAT can genuinely exhaust, and the redirect costs none of that budget. -# To hold a box on a known build, pin the tag instead: -# .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset -$RsyncUrl = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset" -$RsyncDir = 'C:\Tools\rsync' -try { - New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null - $RsyncExe = Join-Path $RsyncDir 'rsync.exe' - - # Does the release's ssh.exe have the libcrypto it needs? Decided before the - # download so the answer can also gate what comes out of the zip. This is a - # cheap pre-filter only - the authoritative check is running the thing, which - # happens after the unpack below. - $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll' - $WantSsh = Test-Path $SysCrypto - if (-not $WantSsh) { - Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH." - } else { - $v = (Get-Item $SysCrypto).VersionInfo.FileVersion - if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') { - Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start." - } - # No architecture special-case here any more: the asset chosen above - # matches the host, so the release's ssh.exe and System32's libcrypto.dll - # are the same architecture on every box. The run-it check below still - # happens on all of them - it is cheap, and it is what caught the ARM64 - # mismatch back when this took the x64 zip. - } - - # Download and unpack beside the targets, not over them, so an interrupted - # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch - # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive - # refuses any other extension outright ("*.download is not a supported - # archive file format"), where PowerShell 7 just reads the file. - [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 - $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset" - Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing - Write-Host " Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)" - - # Verify against the .sha256 published beside it. Same origin, so this is an - # integrity check on the transfer rather than a defence against a hostile - # release - but a truncated or proxy-mangled download is the failure that - # actually happens, and it fails here instead of mid-transfer later. +if (Test-SetupStep 'Rsync') { + Write-Step 'rsync for Windows' + $RsyncRepo = 'nuket/rsync-windows' + # The release publishes x86, x64 and - since v3.5.0-gdeeda96f - arm64, so every + # architecture this script runs on gets a native build. ARM64 used to take the + # x64 zip under emulation, which was defensible (a transfer is bound by the + # socket, not by emulated CPU) but cost the release's ssh.exe: that x64 binary + # could not load the ARM64 libcrypto.dll in System32 and had to be deleted on + # every run. The arm64 asset ships an ARM64 rsync.exe AND an ARM64 ssh.exe, so + # both halves are now native and the fast client survives. # - # -OutFile, not .Content: GitHub serves the .sha256 as - # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather - # than a string for any non-text content type, so .Content would compare the - # first BYTE against the hash and fail on every correct download. - $tmpSha = "$tmpZip.sha256" - Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing - $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower() - Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue - $got = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower() - if ($want -and $want -ne $got) { - Remove-Item $tmpZip -Force - throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got" + # Selected off $HostArch rather than Is64BitOperatingSystem, which answers "true" + # on ARM64 and so cannot tell the two 64-bit cases apart. + $RsyncAsset = switch ($HostArch) { + 'X64' { 'rsync-windows-x64.zip' } + 'Arm64' { 'rsync-windows-arm64.zip' } + default { 'rsync-windows-x86.zip' } } - Write-Host " SHA-256 verified: $got" - - # Unpack to a scratch directory and move out the files we asked for, rather - # than expanding straight over the install directory: the zip is the unit - # that was checksummed, and this way a future release adding something to it - # cannot quietly drop that something onto the machine PATH. - $unpack = Join-Path $RsyncDir '.unpack' - if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack } - Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force - Remove-Item $tmpZip -Force - foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') { - $src = Join-Path $unpack $f - if (-not (Test-Path $src)) { continue } - if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue } - Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force + if ($IsArm64) { + Write-Host ' ARM64: using the native arm64 asset (rsync.exe and ssh.exe both ARM64).' -ForegroundColor Green } - Remove-Item -Recurse -Force $unpack + # The /releases/latest/download/ redirect rather than the API: unauthenticated + # API calls are rate-limited to 60/hour per IP, which a provisioning run behind a + # shared NAT can genuinely exhaust, and the redirect costs none of that budget. + # To hold a box on a known build, pin the tag instead: + # .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset + $RsyncUrl = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset" + $RsyncDir = 'C:\Tools\rsync' + try { + New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null + $RsyncExe = Join-Path $RsyncDir 'rsync.exe' - # Prove the unpacked ssh.exe actually starts, and DELETE it if it does not. - # - # This matters more than it looks. rsync.exe prefers an ssh.exe sitting in its - # own directory, so a present-but-unstartable one does not degrade to the - # in-box client - it breaks rsync outright, and the error you get is a remote - # shell that died rather than anything naming ssh.exe. The way to land there - # is a missing or too-old System32 libcrypto.dll. Removing it is the repair: - # rsync then falls back to the ssh on the PATH, which is the in-box client. - # - # This also used to fire on every ARM64 run, when the x64 asset was the only - # 64-bit one published and its ssh.exe could not load the ARM64 libcrypto - # (exit 0xC0000135, STATUS_DLL_NOT_FOUND). The arm64 asset fixed that at the - # source; the check stays because it is how that was found in the first place. - # - # EAP back to Continue for the call: ssh -V writes its version to STDERR, and - # under $ErrorActionPreference = 'Stop' a native command's stderr becomes a - # terminating error, so a WORKING client would look like a broken one. - # $global:LASTEXITCODE is cleared first because an exe that cannot start at - # all throws without setting one, and the stale 0 from the previous native - # command would otherwise read as success. - # - # DRAIN THE OUTPUT BEFORE READING $LASTEXITCODE. `... | Select-Object -First 1` - # was the original spelling here, and it is a trap: Select-Object stops the - # pipeline the instant it has its one object, and that is when ssh.exe has - # WRITTEN its banner - not when it has exited. PowerShell then tears the - # pipeline down, kills the still-running process, and reports -1. Measured on a - # healthy binary on an x64 box: 24 of 25 runs reported exit -1 through - # Select-Object, and 25 of 25 reported 0 when the output was collected first. - # - # So this check was deleting a perfectly good ssh.exe on almost every run, on - # every architecture, and the resulting fallback to the in-box client - the - # ~17MB/s one this whole step exists to avoid - looked like a property of the - # release rather than a bug in the test. Collect, THEN take the first line. - $SshExe = Join-Path $RsyncDir 'ssh.exe' - if ($WantSsh -and (Test-Path $SshExe)) { - $prevEap = $ErrorActionPreference - $ErrorActionPreference = 'Continue' - $global:LASTEXITCODE = $null - $sshVer = $null - try { $sshOut = (& $SshExe -V 2>&1); $sshVer = $sshOut | Select-Object -First 1 } catch { } - finally { $ErrorActionPreference = $prevEap } - if ($LASTEXITCODE -eq 0) { - Write-Host " ssh.exe runs: $sshVer" + # Does the release's ssh.exe have the libcrypto it needs? Decided before the + # download so the answer can also gate what comes out of the zip. This is a + # cheap pre-filter only - the authoritative check is running the thing, which + # happens after the unpack below. + $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll' + $WantSsh = Test-Path $SysCrypto + if (-not $WantSsh) { + Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH." } else { - $why = if ($null -eq $LASTEXITCODE) { 'it would not start' } else { "exit $LASTEXITCODE" } - Write-Warning "The release's ssh.exe does not run here ($why)$(if ($sshVer) { ": $sshVer" }). Removing it so rsync.exe falls back to the ssh on the PATH instead of failing on it." - Remove-Item $SshExe -Force -ErrorAction SilentlyContinue - $WantSsh = $false + $v = (Get-Item $SysCrypto).VersionInfo.FileVersion + if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') { + Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start." + } + # No architecture special-case here any more: the asset chosen above + # matches the host, so the release's ssh.exe and System32's libcrypto.dll + # are the same architecture on every box. The run-it check below still + # happens on all of them - it is cheap, and it is what caught the ARM64 + # mismatch back when this took the x64 zip. } - } - Write-Host " Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })" - - # Machine PATH (HKLM environment). Idempotent: only appends if absent. - $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') - if (-not $m) { $m = '' } - if (($m -split ';') -notcontains $RsyncDir) { - $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir } - [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') - Write-Host " Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)." - # sshd caches the environment it was started with, so an already-running - # service would not see the new PATH until restarted. - if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') { - Restart-Service sshd - Write-Host ' Restarted sshd so it inherits the updated machine PATH.' + + # Download and unpack beside the targets, not over them, so an interrupted + # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch + # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive + # refuses any other extension outright ("*.download is not a supported + # archive file format"), where PowerShell 7 just reads the file. + [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset" + + # The .sha256 published beside the zip is fetched FIRST, for two jobs. It + # verifies the download below. Same origin, so that is an integrity check on + # the transfer rather than a defence against a hostile release - but a + # truncated or proxy-mangled download is the failure that actually happens, + # and it fails here instead of mid-transfer later. + # + # And it says whether there is anything new to fetch at all. The hash of the + # zip the installed files came from is recorded beside them in + # rsync-windows.sha256, written only once they have all landed (as BinSkim's + # nupkg-version.txt is). When the release's hash still matches and the files + # are all there, the download and unpack are skipped - a re-run costs one + # small request instead of the zip. An ssh.exe that was wanted but is gone + # (removed below for not starting) does NOT count as there, so each run + # tries it again: whatever stopped it starting may have been fixed since. + # + # -OutFile, not .Content: GitHub serves the .sha256 as + # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather + # than a string for any non-text content type, so .Content would compare the + # first BYTE against the hash and fail on every correct download. + $tmpSha = "$tmpZip.sha256" + Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing + $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower() + Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue + + $RsyncMarker = Join-Path $RsyncDir 'rsync-windows.sha256' + $InstalledSha = if (Test-Path $RsyncMarker) { (Get-Content $RsyncMarker -Raw).Trim().ToLower() } else { '' } + $RsyncCurrent = $want -and ($InstalledSha -eq $want) -and (Test-Path $RsyncExe) -and + (-not $WantSsh -or (Test-Path (Join-Path $RsyncDir 'ssh.exe'))) + if ($RsyncCurrent) { + Write-Host " $RsyncAsset unchanged since it was installed (SHA-256 $want); not downloading it again." + } else { + Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing + Write-Host " Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)" + $got = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower() + if ($want -and $want -ne $got) { + Remove-Item $tmpZip -Force + throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got" + } + Write-Host " SHA-256 verified: $got" + + # Unpack to a scratch directory and move out the files we asked for, rather + # than expanding straight over the install directory: the zip is the unit + # that was checksummed, and this way a future release adding something to it + # cannot quietly drop that something onto the machine PATH. + $unpack = Join-Path $RsyncDir '.unpack' + if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack } + Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force + Remove-Item $tmpZip -Force + foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') { + $src = Join-Path $unpack $f + if (-not (Test-Path $src)) { continue } + if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue } + Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force + } + Remove-Item -Recurse -Force $unpack + # Written last: the marker must only claim a release that fully landed. + if ($want) { Set-Content -Path $RsyncMarker -Value $want -Encoding ascii } } - } else { - Write-Host " OK: $RsyncDir already in the machine PATH" - } - & $RsyncExe --version | Select-Object -First 1 -} catch { - Write-Warning "rsync install failed: $($_.Exception.Message)" - Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually" - Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together." + # Prove the unpacked ssh.exe actually starts, and DELETE it if it does not. + # + # This matters more than it looks. rsync.exe prefers an ssh.exe sitting in its + # own directory, so a present-but-unstartable one does not degrade to the + # in-box client - it breaks rsync outright, and the error you get is a remote + # shell that died rather than anything naming ssh.exe. The way to land there + # is a missing or too-old System32 libcrypto.dll. Removing it is the repair: + # rsync then falls back to the ssh on the PATH, which is the in-box client. + # + # This also used to fire on every ARM64 run, when the x64 asset was the only + # 64-bit one published and its ssh.exe could not load the ARM64 libcrypto + # (exit 0xC0000135, STATUS_DLL_NOT_FOUND). The arm64 asset fixed that at the + # source; the check stays because it is how that was found in the first place. + # + # EAP back to Continue for the call: ssh -V writes its version to STDERR, and + # under $ErrorActionPreference = 'Stop' a native command's stderr becomes a + # terminating error, so a WORKING client would look like a broken one. + # $global:LASTEXITCODE is cleared first because an exe that cannot start at + # all throws without setting one, and the stale 0 from the previous native + # command would otherwise read as success. + # + # DRAIN THE OUTPUT BEFORE READING $LASTEXITCODE. `... | Select-Object -First 1` + # was the original spelling here, and it is a trap: Select-Object stops the + # pipeline the instant it has its one object, and that is when ssh.exe has + # WRITTEN its banner - not when it has exited. PowerShell then tears the + # pipeline down, kills the still-running process, and reports -1. Measured on a + # healthy binary on an x64 box: 24 of 25 runs reported exit -1 through + # Select-Object, and 25 of 25 reported 0 when the output was collected first. + # + # So this check was deleting a perfectly good ssh.exe on almost every run, on + # every architecture, and the resulting fallback to the in-box client - the + # ~17MB/s one this whole step exists to avoid - looked like a property of the + # release rather than a bug in the test. Collect, THEN take the first line. + $SshExe = Join-Path $RsyncDir 'ssh.exe' + if ($WantSsh -and (Test-Path $SshExe)) { + $prevEap = $ErrorActionPreference + $ErrorActionPreference = 'Continue' + $global:LASTEXITCODE = $null + $sshVer = $null + try { $sshOut = (& $SshExe -V 2>&1); $sshVer = $sshOut | Select-Object -First 1 } catch { } + finally { $ErrorActionPreference = $prevEap } + if ($LASTEXITCODE -eq 0) { + Write-Host " ssh.exe runs: $sshVer" + } else { + $why = if ($null -eq $LASTEXITCODE) { 'it would not start' } else { "exit $LASTEXITCODE" } + Write-Warning "The release's ssh.exe does not run here ($why)$(if ($sshVer) { ": $sshVer" }). Removing it so rsync.exe falls back to the ssh on the PATH instead of failing on it." + Remove-Item $SshExe -Force -ErrorAction SilentlyContinue + $WantSsh = $false + } + } + Write-Host " $(if ($RsyncCurrent) { 'Kept' } else { 'Installed' }) $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })" + + # Machine PATH (HKLM environment). Idempotent: only appends if absent. + $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') + if (-not $m) { $m = '' } + if (($m -split ';') -notcontains $RsyncDir) { + $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir } + [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') + Write-Host " Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)." + # sshd caches the environment it was started with, so an already-running + # service would not see the new PATH until restarted. + if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') { + Restart-Service sshd + Write-Host ' Restarted sshd so it inherits the updated machine PATH.' + } + } else { + Write-Host " OK: $RsyncDir already in the machine PATH" + } + + & $RsyncExe --version | Select-Object -First 1 + } catch { + Write-Warning "rsync install failed: $($_.Exception.Message)" + Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually" + Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together." + } } # --------------------------------------------------------------------------- @@ -554,20 +666,19 @@ if (-not $IsArm64) { # It is dropped on ARM64 because that machine is a constrained VM provisioned as # a single-compiler build box: MSVC and nothing else. Compiler diversity - MSVC, # VS clang-cl and upstream LLVM over the same sources - now lives entirely on the -# x64 machine, which is the one with room for three toolchains. Empty here means -# Invoke-VsModify is never called for this group. -$ClangComponents = if ($IsArm64) { @() } else { - @( - 'Microsoft.VisualStudio.Component.VC.Llvm.Clang' - 'Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset' - ) -} +# x64 machine, which is the one with room for three toolchains. The VsClang step +# is -X64Only in setup-windows-steps.ps1, so on ARM64 this group is never asked +# for. +$ClangComponents = @( + 'Microsoft.VisualStudio.Component.VC.Llvm.Clang' + 'Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset' +) # Windows XP targeting (v141_xp toolset, used in CMakePresets.json). The v141 # (VS2017) build tools provide the 14.16 compiler that the XP toolset wraps; # WinXP layers the XP-compatible CRT/SDK on top of it. # -# NOT USED ON ARM64, and left empty there. The components are still listed in the +# NOT USED ON ARM64 - VsWinXP is -X64Only. The components are still listed in the # catalog on Arm, so this is not strictly "unavailable" - but the 14.16 toolset # predates Windows on Arm as a host and ships HostX86/HostX64 compilers only, so # the best you could get is an x86-emulated compiler, and Microsoft does not @@ -575,12 +686,10 @@ $ClangComponents = if ($IsArm64) { @() } else { # used: Windows XP never ran on ARM64, so an XP-targeting build from an ARM64 # host has no purpose beyond producing x86 binaries, which the current toolset # does natively via -A Win32. On x64 the group is installed exactly as before. -$XpComponents = if ($IsArm64) { @() } else { - @( - 'Microsoft.VisualStudio.Component.VC.v141.x86.x64' - 'Microsoft.VisualStudio.Component.WinXP' - ) -} +$XpComponents = @( + 'Microsoft.VisualStudio.Component.VC.v141.x86.x64' + 'Microsoft.VisualStudio.Component.WinXP' +) # Which Visual Studio generation to drive: 17 = VS 2022, 18 = VS 2026. Both have # native ARM64 installers and ARM64-hosted MSVC. This picks the bootstrapper URL, @@ -613,13 +722,30 @@ $VsChannelPath = if ($VsChannel -ge 18) { 'stable' } else { 'release' } $VsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe' $InstallPath = Get-VsInstallPath +# Three steps drive Visual Studio - the base install and the two optional groups +# layered on it. They share the bootstrapper download and the verification +# below, which happen once if any of them runs. Asked once, here. +$DoVsBase = Test-SetupStep 'VisualStudio' +$DoVsClang = Test-SetupStep 'VsClang' +$DoVsXp = Test-SetupStep 'VsWinXP' +$DoVs = $DoVsBase -or $DoVsClang -or $DoVsXp + +# Whether any selected pass still has something to add. When none does, the +# bootstrapper is not even downloaded: each pass would find its components +# already installed (Test-VsHasComponents) and return before using it. The Clang +# and XP passes only count with an install to add them to - without one they +# stand down below, and would not use the bootstrapper either. +$VsNeedsInstaller = ($DoVsBase -and -not (Test-VsHasComponents $BaseComponents)) -or + ($DoVsClang -and $InstallPath -and -not (Test-VsHasComponents $ClangComponents)) -or + ($DoVsXp -and $InstallPath -and -not (Test-VsHasComponents $XpComponents)) + # Report any OTHER Visual Studio generations on the box. They are left alone - # the passes below only ever touch $InstallPath - but when none of them matches # $VsChannel this script is about to download and install a second, largely # redundant toolchain, and that should be a visible decision rather than a # surprise 10GB. (On ARM64, where $VsChannel is 18, an existing VS 2026 IS the # match and gets modified in place rather than duplicated.) -if (Test-Path $VsWhere) { +if ($DoVs -and (Test-Path $VsWhere)) { $others = & $VsWhere -products '*' -format value -property installationPath | Where-Object { $_ -and $_ -ne $InstallPath } if ($others) { @@ -630,23 +756,29 @@ if (Test-Path $VsWhere) { } } -Write-Step "Downloading VS $VsChannel $VsEdition bootstrapper (host: $HostArch)" -# aka.ms serves the bootstrapper for the requesting machine's architecture, so on -# ARM64 this is the native ARM64 installer - no --arch flag needed or offered. -$VsInstallerUrl = "https://aka.ms/vs/$VsChannel/$VsChannelPath/vs_$VsEdition.exe" -$VsBootstrapper = Join-Path $TempDir "vs_$VsEdition.exe" -Write-Host " $VsInstallerUrl" -ForegroundColor DarkGray -Invoke-WebRequest -Uri $VsInstallerUrl -OutFile $VsBootstrapper -UseBasicParsing - -# Prove we got an installer and not a web page. The Bing redirect described above -# returns 200 with HTML, and every other aka.ms typo behaves the same way, so a -# bad channel/edition combination is otherwise only discovered when the "exe" -# fails to start. 'MZ' is the DOS header every PE begins with. -$vsHead = [IO.File]::ReadAllBytes($VsBootstrapper) | Select-Object -First 2 -if (-not ($vsHead.Count -eq 2 -and $vsHead[0] -eq 0x4D -and $vsHead[1] -eq 0x5A)) { - throw "Visual Studio: $VsInstallerUrl did not return an executable (no MZ header; $((Get-Item $VsBootstrapper).Length) bytes). Check `$VsChannel / `$VsChannelPath / `$VsEdition." +if ($DoVs -and -not $VsNeedsInstaller -and $InstallPath) { + Write-Step 'Visual Studio' + Write-Host " Every selected component group is already in $InstallPath; not downloading the installer." +} +if ($VsNeedsInstaller) { + Write-Step "Downloading VS $VsChannel $VsEdition bootstrapper (host: $HostArch)" + # aka.ms serves the bootstrapper for the requesting machine's architecture, so on + # ARM64 this is the native ARM64 installer - no --arch flag needed or offered. + $VsInstallerUrl = "https://aka.ms/vs/$VsChannel/$VsChannelPath/vs_$VsEdition.exe" + $VsBootstrapper = Join-Path $TempDir "vs_$VsEdition.exe" + Write-Host " $VsInstallerUrl" -ForegroundColor DarkGray + Invoke-WebRequest -Uri $VsInstallerUrl -OutFile $VsBootstrapper -UseBasicParsing + + # Prove we got an installer and not a web page. The Bing redirect described above + # returns 200 with HTML, and every other aka.ms typo behaves the same way, so a + # bad channel/edition combination is otherwise only discovered when the "exe" + # fails to start. 'MZ' is the DOS header every PE begins with. + $vsHead = [IO.File]::ReadAllBytes($VsBootstrapper) | Select-Object -First 2 + if (-not ($vsHead.Count -eq 2 -and $vsHead[0] -eq 0x4D -and $vsHead[1] -eq 0x5A)) { + throw "Visual Studio: $VsInstallerUrl did not return an executable (no MZ header; $((Get-Item $VsBootstrapper).Length) bytes). Check `$VsChannel / `$VsChannelPath / `$VsEdition." + } + Write-Host " OK: bootstrapper is a PE ($([math]::Round((Get-Item $VsBootstrapper).Length / 1MB, 2)) MB)" } -Write-Host " OK: bootstrapper is a PE ($([math]::Round((Get-Item $VsBootstrapper).Length / 1MB, 2)) MB)" # Install in three sequential passes. The base set is installed first (this is # the configuration that previously worked); Clang and the XP toolset are added @@ -656,22 +788,27 @@ Write-Host " OK: bootstrapper is a PE ($([math]::Round((Get-Item $VsBootstrap # needed to build with MSVC, and on a host where one of them is simply not # offered a hard failure here would cost you the whole toolchain over a component # you can add later from the installer UI. -Invoke-VsModify -Label 'base toolset + workload' -Ids $BaseComponents -if ($IsArm64) { - Write-Step 'Visual Studio: Clang / LLVM' - Write-Host ' Skipped on ARM64 by choice, not by limitation: a native ARM64 clang-cl is' -ForegroundColor Yellow - Write-Host ' offered here and works. This box is provisioned with MSVC alone; the' -ForegroundColor Yellow - Write-Host ' multi-compiler builds belong on the x64 machine.' -ForegroundColor Yellow -} else { - Invoke-VsModify -Label 'Clang / LLVM' -Ids $ClangComponents -Optional +# +# On ARM64 only the first pass is ever selected: VsClang and VsWinXP are +# -X64Only in setup-windows-steps.ps1, and the plan printed at the top says why. +# +# The last two MODIFY an existing install. With the base step switched off and +# no Visual Studio of this generation on the box, there is nothing to modify - +# and letting the pass run anyway would install a Visual Studio holding that one +# component group and no C++ workload. So they say so and stand down instead. +if ($DoVsBase) { + Invoke-VsModify -Label 'base toolset + workload' -Ids $BaseComponents } -if ($IsArm64) { - Write-Step 'Visual Studio: Windows XP (v141 + WinXP)' - Write-Host ' Skipped on ARM64: the v141 (14.16) toolset ships x86/x64-hosted compilers only,' -ForegroundColor Yellow - Write-Host ' and Windows XP targeting is not offered for Arm hosts. Build x86 with the' -ForegroundColor Yellow - Write-Host ' current toolset instead (cmake -A Win32), which is native here.' -ForegroundColor Yellow -} else { - Invoke-VsModify -Label 'Windows XP (v141 + WinXP)' -Ids $XpComponents -Optional +foreach ($pass in @( + @{ Run = $DoVsClang; Label = 'Clang / LLVM'; Ids = $ClangComponents } + @{ Run = $DoVsXp; Label = 'Windows XP (v141 + WinXP)'; Ids = $XpComponents })) { + if (-not $pass.Run) { continue } + if ($InstallPath) { + Invoke-VsModify -Label $pass.Label -Ids $pass.Ids -Optional + } else { + Write-Step "Visual Studio: $($pass.Label)" + Write-Warning "No Visual Studio $VsChannel is installed to add this to. Select the VisualStudio step as well." + } } # --------------------------------------------------------------------------- @@ -687,78 +824,85 @@ if ($IsArm64) { # the installer UI, not a reason to fail a provisioning run that installed a # working compiler. # --------------------------------------------------------------------------- -Write-Step 'Verifying the installed toolsets' -$InstallPath = Get-VsInstallPath -if (-not $InstallPath) { - Write-Warning "No Visual Studio $VsChannel installation found after the passes above; cannot verify toolsets." -} else { - Write-Host " Install path: $InstallPath" - - # What MSVC versions landed, and which host toolchains each one carries. - # HostARM64 is the directory that proves the native ARM64 compiler is here - # rather than an x64 one that would run under emulation. - $msvcRoot = Join-Path $InstallPath 'VC\Tools\MSVC' - foreach ($v in (Get-ChildItem $msvcRoot -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) { - $hosts = Get-ChildItem (Join-Path $v.FullName 'bin') -Directory -ErrorAction SilentlyContinue | - ForEach-Object { $_.Name } - Write-Host " MSVC $($v.Name): $(if ($hosts) { $hosts -join ', ' } else { '(no bin dir)' })" - } - if ($IsArm64) { - $armHost = Test-Path (Join-Path $msvcRoot '*\bin\HostARM64\ARM64\cl.exe') - if ($armHost) { - Write-Host ' OK: native ARM64-hosted cl.exe present.' -ForegroundColor Green - } else { - Write-Warning 'No HostARM64 cl.exe found - MSVC would run under x64 emulation. Add "MSVC v14x - VS 2022 C++ ARM64/ARM64EC build tools" in the installer.' +if ($DoVs) { + Write-Step 'Verifying the installed toolsets' + $InstallPath = Get-VsInstallPath + if (-not $InstallPath) { + Write-Warning "No Visual Studio $VsChannel installation found after the passes above; cannot verify toolsets." + } else { + Write-Host " Install path: $InstallPath" + + # What MSVC versions landed, and which host toolchains each one carries. + # HostARM64 is the directory that proves the native ARM64 compiler is here + # rather than an x64 one that would run under emulation. + $msvcRoot = Join-Path $InstallPath 'VC\Tools\MSVC' + foreach ($v in (Get-ChildItem $msvcRoot -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) { + $hosts = Get-ChildItem (Join-Path $v.FullName 'bin') -Directory -ErrorAction SilentlyContinue | + ForEach-Object { $_.Name } + Write-Host " MSVC $($v.Name): $(if ($hosts) { $hosts -join ', ' } else { '(no bin dir)' })" + } + if ($IsArm64) { + $armHost = Test-Path (Join-Path $msvcRoot '*\bin\HostARM64\ARM64\cl.exe') + if ($armHost) { + Write-Host ' OK: native ARM64-hosted cl.exe present.' -ForegroundColor Green + } else { + Write-Warning 'No HostARM64 cl.exe found - MSVC would run under x64 emulation. Add "MSVC v14x - VS 2022 C++ ARM64/ARM64EC build tools" in the installer.' + } } - } - # clang-cl, for the ClangCL toolset in CMakePresets.json. Checked per host - # directory, because the Llvm tree is partitioned by HOST architecture and - # only the matching one is a native compiler. - # - # Look for clang-cl.exe specifically, NOT for the directory. VC\Tools\Llvm\*\bin - # holds clang-format.exe and clang-tidy.exe on every host whether or not the - # Clang component was ever installed - those ship with the NativeDesktop - # workload - so a present ARM64\bin proves nothing on its own. That is the - # false positive to avoid when checking this by hand. - $llvmRoot = Join-Path $InstallPath 'VC\Tools\Llvm' - $clangArm = Test-Path (Join-Path $llvmRoot 'ARM64\bin\clang-cl.exe') - $clangX64 = Test-Path (Join-Path $llvmRoot 'x64\bin\clang-cl.exe') - $clangX86 = Test-Path (Join-Path $llvmRoot 'bin\clang-cl.exe') - $clangAny = $clangArm -or $clangX64 -or $clangX86 - if ($IsArm64) { - # Not installed here by design, so its absence is the expected result and - # must not read as a fault. Its PRESENCE is the thing worth a line: a box - # provisioned before this split still carries it, and the component stays - # until it is explicitly removed - the installer never uninstalls what you - # simply stopped asking for. - if ($clangAny) { - Write-Host ' clang-cl: present but no longer provisioned on ARM64 - left over from an earlier run.' -ForegroundColor Yellow - Write-Host ' Remove it with: vs_installer.exe modify --installPath "" --remove Microsoft.VisualStudio.Component.VC.Llvm.Clang --remove Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset --quiet' -ForegroundColor Yellow + # clang-cl, for the ClangCL toolset in CMakePresets.json. Checked per host + # directory, because the Llvm tree is partitioned by HOST architecture and + # only the matching one is a native compiler. + # + # Look for clang-cl.exe specifically, NOT for the directory. VC\Tools\Llvm\*\bin + # holds clang-format.exe and clang-tidy.exe on every host whether or not the + # Clang component was ever installed - those ship with the NativeDesktop + # workload - so a present ARM64\bin proves nothing on its own. That is the + # false positive to avoid when checking this by hand. + $llvmRoot = Join-Path $InstallPath 'VC\Tools\Llvm' + $clangArm = Test-Path (Join-Path $llvmRoot 'ARM64\bin\clang-cl.exe') + $clangX64 = Test-Path (Join-Path $llvmRoot 'x64\bin\clang-cl.exe') + $clangX86 = Test-Path (Join-Path $llvmRoot 'bin\clang-cl.exe') + $clangAny = $clangArm -or $clangX64 -or $clangX86 + if ($IsArm64) { + # Not installed here by design, so its absence is the expected result and + # must not read as a fault. Its PRESENCE is the thing worth a line: a box + # provisioned before this split still carries it, and the component stays + # until it is explicitly removed - the installer never uninstalls what you + # simply stopped asking for. + if ($clangAny) { + Write-Host ' clang-cl: present but no longer provisioned on ARM64 - left over from an earlier run.' -ForegroundColor Yellow + Write-Host ' Remove it with: vs_installer.exe modify --installPath "" --remove Microsoft.VisualStudio.Component.VC.Llvm.Clang --remove Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset --quiet' -ForegroundColor Yellow + } else { + Write-Host ' clang-cl: n/a on ARM64 (MSVC only by design; use the x64 box for ClangCL).' -ForegroundColor DarkGray + } + } elseif ($clangAny) { + Write-Host " clang-cl: $(@(if ($clangArm) {'ARM64'}; if ($clangX64) {'x64'}; if ($clangX86) {'x86'}) -join ', ')" -ForegroundColor Green + } elseif (-not $DoVsClang) { + # Switched off in the plan: a choice, so not worth a warning. + Write-Host ' clang-cl: not installed (the VsClang step was not selected).' -ForegroundColor DarkGray } else { - Write-Host ' clang-cl: n/a on ARM64 (MSVC only by design; use the x64 box for ClangCL).' -ForegroundColor DarkGray + Write-Warning 'clang-cl not found - the ClangCL presets will fail. Add the "C++ Clang tools for Windows" component.' } - } elseif ($clangAny) { - Write-Host " clang-cl: $(@(if ($clangArm) {'ARM64'}; if ($clangX64) {'x64'}; if ($clangX86) {'x86'}) -join ', ')" -ForegroundColor Green - } else { - Write-Warning 'clang-cl not found - the ClangCL presets will fail. Add the "C++ Clang tools for Windows" component.' - } - # v141 / XP. Only meaningful where the toolset can exist at all; on ARM64 the - # group above was deliberately skipped, so warning here would be noise about - # a decision this script made on purpose two steps ago. - if ($IsArm64) { - Write-Host ' v141 / Windows XP toolset: n/a on ARM64 (not offered for Arm hosts).' -ForegroundColor DarkGray - } else { - $V141 = Get-ChildItem $msvcRoot -Directory -ErrorAction SilentlyContinue | - Where-Object { $_.Name -like '14.16.*' } | Select-Object -First 1 - if ($V141) { - Write-Host " OK: v141 toolset present ($($V141.Name))" -ForegroundColor Green + # v141 / XP. Only meaningful where the toolset can exist at all; on ARM64 the + # group above was deliberately skipped, so warning here would be noise about + # a decision this script made on purpose two steps ago. + if ($IsArm64) { + Write-Host ' v141 / Windows XP toolset: n/a on ARM64 (not offered for Arm hosts).' -ForegroundColor DarkGray } else { - Write-Warning 'v141 (14.16.x) toolset NOT found - the XP build presets will fail.' - Write-Warning 'Add it via Visual Studio Installer > Modify > Individual components:' - Write-Warning ' - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)' - Write-Warning ' - C++ Windows XP Support for VS 2017 (v141) tools' + $V141 = Get-ChildItem $msvcRoot -Directory -ErrorAction SilentlyContinue | + Where-Object { $_.Name -like '14.16.*' } | Select-Object -First 1 + if ($V141) { + Write-Host " OK: v141 toolset present ($($V141.Name))" -ForegroundColor Green + } elseif (-not $DoVsXp) { + Write-Host ' v141 / Windows XP toolset: not installed (the VsWinXP step was not selected).' -ForegroundColor DarkGray + } else { + Write-Warning 'v141 (14.16.x) toolset NOT found - the XP build presets will fail.' + Write-Warning 'Add it via Visual Studio Installer > Modify > Individual components:' + Write-Warning ' - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)' + Write-Warning ' - C++ Windows XP Support for VS 2017 (v141) tools' + } } } } @@ -788,47 +932,46 @@ if (-not $InstallPath) { # pairs VS 2026 with the 28000.x kit - not this link. # # On x64 with VS 2022 the SDK and this WDK are the matched pair, so it installs. +# +# The x64-only rule itself is the Wdk step's -X64Only in setup-windows-steps.ps1, +# so on ARM64 this step never runs and the plan says why. # --------------------------------------------------------------------------- -$WdkVersion = '10.0.26100' -# Both hives. The WDK installer is a 32-bit program, so on x64 it writes under -# WOW6432Node - but which hive a given kit lands in has varied across kit -# versions and architectures, and reading only one of them makes an installed WDK -# look absent, which costs a needless multi-GB reinstall on every run. Check the -# native hive too and take whichever answers. -$WdkInstalledRoot = @( - 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots' - 'HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots' -) | ForEach-Object { (Get-ItemProperty $_ -ErrorAction SilentlyContinue).WdkBinRootVersioned } | - Where-Object { $_ } | Select-Object -First 1 +if (Test-SetupStep 'Wdk') { + $WdkVersion = '10.0.26100' + # Both hives. The WDK installer is a 32-bit program, so on x64 it writes under + # WOW6432Node - but which hive a given kit lands in has varied across kit + # versions and architectures, and reading only one of them makes an installed WDK + # look absent, which costs a needless multi-GB reinstall on every run. Check the + # native hive too and take whichever answers. + $WdkInstalledRoot = @( + 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots' + 'HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots' + ) | ForEach-Object { (Get-ItemProperty $_ -ErrorAction SilentlyContinue).WdkBinRootVersioned } | + Where-Object { $_ } | Select-Object -First 1 -if ($IsArm64) { - Write-Step 'Windows Driver Kit' - Write-Host ' Skipped on ARM64: this box builds user-mode software only, and WDK 26100.6584' -ForegroundColor Yellow - Write-Host ' cannot install beside the 26100.7705 SDK that Visual Studio 2026 brings - the' -ForegroundColor Yellow - Write-Host ' kit needs the matching SDK revision and they are not side-by-side. See the' -ForegroundColor Yellow - Write-Host ' comment above this step for the exit code and what to use instead.' -ForegroundColor Yellow -} elseif ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion)) { - # Re-running wdksetup.exe for an already-present version returns exit code - # 2008 (maintenance mode / nothing to do), which is not a real failure. - Write-Step "WDK $WdkVersion already installed - skipping ($WdkInstalledRoot)" -} else { - Write-Step 'Downloading WDK installer' - $WdkUrl = 'https://go.microsoft.com/fwlink/?linkid=2335869' - $WdkInstaller = Join-Path $TempDir 'wdksetup.exe' - Invoke-WebRequest -Uri $WdkUrl -OutFile $WdkInstaller -UseBasicParsing - - Write-Step 'Installing WDK' - # wdksetup.exe is a 32-bit binary and runs under emulation on ARM64; the kit - # it lays down does include the ARM64 target headers, libs and tools (the - # signing/deployment tools under bin\arm64), so an ARM64 driver builds from - # an ARM64 host. Only the installer is emulated, not the toolchain. - $proc = Start-Process -FilePath $WdkInstaller -ArgumentList '/quiet /norestart' -Wait -PassThru -NoNewWindow - Write-Host " WDK installer exit code: $($proc.ExitCode)" - if ($proc.ExitCode -eq 2008) { - # 2008 = the WDK is already present; the installer has nothing to do. - Write-Host ' [WDK already installed (exit 2008) - treating as success]' -ForegroundColor Yellow + if ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion)) { + # Re-running wdksetup.exe for an already-present version returns exit code + # 2008 (maintenance mode / nothing to do), which is not a real failure. + Write-Step "WDK $WdkVersion already installed - skipping ($WdkInstalledRoot)" } else { - Assert-ExitCode $proc.ExitCode 'WDK' + Write-Step 'Downloading WDK installer' + $WdkUrl = 'https://go.microsoft.com/fwlink/?linkid=2335869' + $WdkInstaller = Join-Path $TempDir 'wdksetup.exe' + Invoke-WebRequest -Uri $WdkUrl -OutFile $WdkInstaller -UseBasicParsing + + Write-Step 'Installing WDK' + # wdksetup.exe is a 32-bit binary and runs under emulation on ARM64; the kit + # it lays down does include the ARM64 target headers, libs and tools (the + # signing/deployment tools under bin\arm64), so an ARM64 driver builds from + # an ARM64 host. Only the installer is emulated, not the toolchain. + $proc = Start-Process -FilePath $WdkInstaller -ArgumentList '/quiet /norestart' -Wait -PassThru -NoNewWindow + Write-Host " WDK installer exit code: $($proc.ExitCode)" + if ($proc.ExitCode -eq 2008) { + # 2008 = the WDK is already present; the installer has nothing to do. + Write-Host ' [WDK already installed (exit 2008) - treating as success]' -ForegroundColor Yellow + } else { + Assert-ExitCode $proc.ExitCode 'WDK' + } } } @@ -858,66 +1001,68 @@ if ($IsArm64) { # # Idempotent and non-fatal - it never aborts provisioning. # --------------------------------------------------------------------------- -Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)' -$WptDirs = @( - (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'), - (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit'), - (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit') -) -function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 } +if (Test-SetupStep 'Wpt') { + Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)' + $WptDirs = @( + (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'), + (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit'), + (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit') + ) + function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 } -$WptDir = Find-WptDir -if ($WptDir) { - Write-Host " OK: WPT already present ($WptDir)" -ForegroundColor Green -} else { - try { - # The ADK manifest offers no ARM64 installer, so on ARM64 winget fetches - # the x64 one; it runs under emulation and lays down a toolkit that does - # include the ARM64 binaries. The SDK feature is the lighter route on any - # architecture and is worth preferring if this fallback ever gives - # trouble - see the winsdksetup.exe line in the comment above. - if ($IsArm64) { - Write-Host ' ARM64: the ADK installer is x64 (emulated); the toolkit it installs is ARM64.' -ForegroundColor Yellow + $WptDir = Find-WptDir + if ($WptDir) { + Write-Host " OK: WPT already present ($WptDir)" -ForegroundColor Green + } else { + try { + # The ADK manifest offers no ARM64 installer, so on ARM64 winget fetches + # the x64 one; it runs under emulation and lays down a toolkit that does + # include the ARM64 binaries. The SDK feature is the lighter route on any + # architecture and is worth preferring if this fallback ever gives + # trouble - see the winsdksetup.exe line in the comment above. + if ($IsArm64) { + Write-Host ' ARM64: the ADK installer is x64 (emulated); the toolkit it installs is ARM64.' -ForegroundColor Yellow + } + winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity ` + --accept-source-agreements --accept-package-agreements + Write-Host ' Windows ADK (includes Windows Performance Toolkit) installed.' + $WptDir = Find-WptDir + } catch { + Write-Warning "WPT install failed: $($_.Exception.Message)" + Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the' + Write-Warning 'Windows SDK "Windows Performance Toolkit" optional feature.' } - winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity ` - --accept-source-agreements --accept-package-agreements - Write-Host ' Windows ADK (includes Windows Performance Toolkit) installed.' - $WptDir = Find-WptDir - } catch { - Write-Warning "WPT install failed: $($_.Exception.Message)" - Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the' - Write-Warning 'Windows SDK "Windows Performance Toolkit" optional feature.' } -} -if ($WptDir) { - # Report what actually landed. wpa.exe is the piece people come looking for - # and it is the one that is absent if a trimmed toolkit ever shows up. - foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') { - $p = Join-Path $WptDir $tool - if (Test-Path $p) { - Write-Host " $tool $((Get-Item $p).VersionInfo.ProductVersion)" - } else { - Write-Warning "$tool is missing from $WptDir" + if ($WptDir) { + # Report what actually landed. wpa.exe is the piece people come looking for + # and it is the one that is absent if a trimmed toolkit ever shows up. + foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') { + $p = Join-Path $WptDir $tool + if (Test-Path $p) { + Write-Host " $tool $((Get-Item $p).VersionInfo.ProductVersion)" + } else { + Write-Warning "$tool is missing from $WptDir" + } } - } - # The WPT installer normally adds this to the machine PATH itself (and the - # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for - # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user - # one so it also resolves for the non-interactive sshd sessions this box is - # driven through, which build their environment from the registry PATH. - # Compared trailing-backslash-insensitively - the installer's own entry has - # one, and adding a second spelling of the same directory is just noise. - $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') - if (-not $m) { $m = '' } - $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') } - if ($have) { - Write-Host " OK: $WptDir already in the machine PATH" - } else { - $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir } - [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') - Write-Host " Added $WptDir to the machine PATH (restart shells to pick it up)." + # The WPT installer normally adds this to the machine PATH itself (and the + # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for + # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user + # one so it also resolves for the non-interactive sshd sessions this box is + # driven through, which build their environment from the registry PATH. + # Compared trailing-backslash-insensitively - the installer's own entry has + # one, and adding a second spelling of the same directory is just noise. + $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') + if (-not $m) { $m = '' } + $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') } + if ($have) { + Write-Host " OK: $WptDir already in the machine PATH" + } else { + $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir } + [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') + Write-Host " Added $WptDir to the machine PATH (restart shells to pick it up)." + } } } @@ -939,41 +1084,52 @@ if ($WptDir) { # and run it elevated; it installs unattended with # intel-vtune-_offline.exe -a --silent --cli --eula accept # --------------------------------------------------------------------------- -Write-Step 'Intel VTune Profiler (status only)' -if ($IsArm64) { - # Not a "not installed yet" case - there is no Windows-on-Arm build of VTune, - # and there is nothing for it to sample: its whole value is reading Intel PMU - # counters. Say so plainly and point at what does work here, rather than - # printing a download link for a product this box cannot run. - Write-Host ' n/a on ARM64: Intel ships no Windows-on-Arm build, and hardware event-based' -ForegroundColor DarkGray - Write-Host ' sampling reads Intel PMU counters. Use the Windows Performance Toolkit above' -ForegroundColor DarkGray - Write-Host ' (wpr / xperf to collect, wpa to analyse) for profiling on this box.' -ForegroundColor DarkGray - Write-Host ' Arm also publishes Arm Performance Studio / Streamline for Arm PMU sampling.' -ForegroundColor DarkGray -} else { - $UninstallKeys = @( - 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' - 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' - ) - $vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue | - Where-Object { $_.DisplayName -match 'VTune' } | - Select-Object -First 1 - if ($vtune) { - Write-Host " Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green - # The oneAPI layout keeps a `latest` junction beside the versioned directory, - # so this path stays right across upgrades. - $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe' - if (Test-Path $VTuneCli) { Write-Host " CLI: $VTuneCli" } +if (Test-SetupStep 'VTune') { + Write-Step 'Intel VTune Profiler (status only)' + if ($IsArm64) { + # Not a "not installed yet" case - there is no Windows-on-Arm build of VTune, + # and there is nothing for it to sample: its whole value is reading Intel PMU + # counters. Say so plainly and point at what does work here, rather than + # printing a download link for a product this box cannot run. + Write-Host ' n/a on ARM64: Intel ships no Windows-on-Arm build, and hardware event-based' -ForegroundColor DarkGray + Write-Host ' sampling reads Intel PMU counters. Use the Windows Performance Toolkit above' -ForegroundColor DarkGray + Write-Host ' (wpr / xperf to collect, wpa to analyse) for profiling on this box.' -ForegroundColor DarkGray + Write-Host ' Arm also publishes Arm Performance Studio / Streamline for Arm PMU sampling.' -ForegroundColor DarkGray } else { - Write-Host ' Not installed.' -ForegroundColor Yellow - Write-Host ' https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow - $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer - if ($cpu -and $cpu -notmatch 'Intel') { - Write-Host " (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow + $UninstallKeys = @( + 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' + 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' + ) + $vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue | + Where-Object { $_.DisplayName -match 'VTune' } | + Select-Object -First 1 + if ($vtune) { + Write-Host " Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green + # The oneAPI layout keeps a `latest` junction beside the versioned directory, + # so this path stays right across upgrades. + $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe' + if (Test-Path $VTuneCli) { Write-Host " CLI: $VTuneCli" } + } else { + Write-Host ' Not installed.' -ForegroundColor Yellow + Write-Host ' https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow + $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer + if ($cpu -and $cpu -notmatch 'Intel') { + Write-Host " (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow + } } } } # --------------------------------------------------------------------------- +# A selected step that no section above asked about means this script and the +# catalog disagree - an Id renamed in one and not the other, or a row added with +# nothing behind it. That is a failure: the plan promised a step that was not +# taken. +$neverAsked = @($RunSteps | Where-Object { -not $AskedSteps.Contains($_) }) +if ($neverAsked) { + throw "Selected in the plan but not implemented by setup-windows-with-uac.ps1: $($neverAsked -join ', ')" +} + Write-Host "`nAll done." -ForegroundColor Green Write-Host "Host architecture was $HostArch." Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'