| File | Purpose |
| --- | --- |
-| `setup-windows.bat` | Entry point. Runs the winget installs, then the non-elevated script, then launches the elevated half and prints its log. |
+| `setup-windows.bat` | Entry point. Runs the winget installs, then launches the elevated half and prints its log, then runs the non-elevated script. |
| `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |
| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
- The elevated half writes a transcript to `setup-windows-uac.log` next to the
script; the batch file prints it when the elevated window closes. The log is
gitignored, as it contains local paths.
-- **git uses the Windows SSH client.** `setup-windows-no-uac.ps1` sets
- `core.sshCommand` to `%WINDIR%/System32/OpenSSH/ssh.exe`. Git for Windows
- otherwise prefers its own bundled MSYS2 `ssh.exe`, which cannot reach the
- Windows `ssh-agent` service that the elevated half enables - Win32-OpenSSH
- publishes the agent on a named pipe the MSYS2 build does not speak. Without
- this, keys loaded with `ssh-add` from PowerShell are invisible to `git`, and a
- push falls back to hunting for a key file and prompting for its passphrase.
- The value uses forward slashes on purpose: git parses `core.sshCommand` with
- shell quoting rules, in which a backslash is an escape character.
+- **git uses a Win32-OpenSSH client.** `setup-windows-no-uac.ps1` sets
+ `core.sshCommand`. Git for Windows otherwise prefers its own bundled MSYS2
+ `ssh.exe`, which cannot reach the Windows `ssh-agent` service that the elevated
+ half enables - Win32-OpenSSH publishes the agent on a named pipe the MSYS2
+ build does not speak. Without this, keys loaded with `ssh-add` from PowerShell
+ are invisible to `git`, and a push falls back to hunting for a key file and
+ prompting for its passphrase. The value uses forward slashes on purpose: git
+ parses `core.sshCommand` with shell quoting rules, in which a backslash is an
+ escape character.
+- **Which `ssh.exe` git gets.** `C:\Tools\rsync\ssh.exe` — the fast build the
+ elevated half unpacks — if it is there, `%WINDIR%/System32/OpenSSH/ssh.exe`
+ otherwise. It is the same client with the same `~/.ssh`, agent and
+ `known_hosts`; the difference is the stdin pump, and without it anything git
+ *pushes* is capped at ~17 MB/s. Candidates are tried by **running** them
+ (`ssh -V`), not by `Test-Path`: the fast build needs a `libcrypto.dll` that an
+ image without the OpenSSH Client capability does not have, and a client that
+ will not start should be found here rather than on the next `git push`.
+ This is also why `setup-windows.bat` now runs the elevated half **first** — the
+ fast `ssh.exe` has to exist before the git config step can prefer it. The
+ non-elevated half still runs even when the elevated one failed; it just falls
+ back. Re-run `setup-windows-no-uac.ps1` on its own at any time to re-pick.
- All three scripts are idempotent — re-running skips anything already installed.
BinSkim in particular checks NuGet for the newest stable version *before*
downloading: the package is a self-contained .NET build well over 100 MB, and
- WinMerge on the user PATH
- BinSkim (binary hardening analyzer) in %LOCALAPPDATA%\Programs\BinSkim,
on the user PATH
- - Global git identity, and core.sshCommand pointed at the Windows OpenSSH
- client so git shares the Windows ssh-agent
+ - Global git identity, and core.sshCommand pointed at a Win32-OpenSSH
+ client so git shares the Windows ssh-agent: the fast ssh.exe the elevated
+ half unpacks beside rsync.exe if it is there, the in-box one otherwise
FILL IN $GitUserName / $GitUserEmail below before the first run.
$BinSkimPackage = 'microsoft.codeanalysis.binskim'
$BinSkimDir = Join-Path $env:LOCALAPPDATA 'Programs\BinSkim'
+# Where the elevated half puts rsync.exe and the ssh.exe it ships with. Only
+# read here, to prefer that ssh.exe for git - keep it in step with $RsyncDir in
+# setup-windows-with-uac.ps1 if you move the install.
+$RsyncDir = 'C:\Tools\rsync'
+
function Write-Step([string]$Msg) {
Write-Host "`n==> $Msg" -ForegroundColor Cyan
}
Write-Host " identity: $GitUserName <$GitUserEmail>"
}
- # --- Make git use the Windows OpenSSH client ---
+ # --- Make git use a Win32-OpenSSH client ---
# Git for Windows ships its own MSYS2 ssh.exe and prefers it, and that client
# cannot reach the Windows ssh-agent service that the elevated half enables:
# Win32-OpenSSH publishes the agent on a named pipe the MSYS2 build does not
# speak. So keys added with `ssh-add` from PowerShell stay invisible to git,
# and a push falls back to hunting for a key file and prompting for its
- # passphrase. Pointing core.sshCommand at the in-box ssh.exe gives git the
- # same client, the same agent, and the same %USERPROFILE%\.ssh\config as
+ # passphrase. Pointing core.sshCommand at a Win32-OpenSSH ssh.exe gives git
+ # the same client, the same agent, and the same %USERPROFILE%\.ssh\config as
# `ssh` from an ordinary shell.
- $winSsh = Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe'
- if (-not (Test-Path $winSsh)) {
- Write-Warning "No Windows OpenSSH client at $winSsh. Add the 'OpenSSH Client' optional feature and re-run; until then git uses its own bundled ssh.exe, which cannot see keys held by the Windows ssh-agent service."
+ #
+ # Two of those are on the box, and the one beside rsync.exe is preferred.
+ # It is the same client from the same source, with the same ~/.ssh, agent
+ # and known_hosts, built with a pump on its stdin: the in-box one reads
+ # stdin 3KB at a time, which holds anything git PUSHES to ~17MB/s however
+ # fast the link is. It only exists once the elevated half has run, so the
+ # in-box client stays the fallback - and on a first provisioning run from
+ # setup-windows.bat it is the elevated half that runs first, so the fast one
+ # is normally already there.
+ $sshCandidates = @(
+ (Join-Path $RsyncDir 'ssh.exe'),
+ (Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe')
+ )
+ $winSsh = $null
+ foreach ($cand in $sshCandidates) {
+ if (-not (Test-Path $cand)) { continue }
+ # Run it, rather than just believing the file is there: the build beside
+ # rsync.exe links against the libcrypto.dll the OpenSSH Client capability
+ # puts in System32, and without that capability it is a binary that does
+ # not start. Better to find that out here than on the next `git push`.
+ #
+ # EAP back to Continue for the call: ssh -V writes its version to
+ # STDERR, and with $ErrorActionPreference = 'Stop' a native command's
+ # stderr becomes a terminating RemoteException - so the working client
+ # would look like the broken one.
+ $prevEap = $ErrorActionPreference
+ $ErrorActionPreference = 'Continue'
+ $version = $null
+ # Clear the exit code first, explicitly at global scope. An exe that
+ # cannot start at all - the missing-libcrypto case - throws here without
+ # ever setting one, and the stale 0 from the last native command that DID
+ # run would otherwise read as success. $global: because a bare assignment
+ # would make a local copy that the native call then does not update.
+ $global:LASTEXITCODE = $null
+ try { $version = (& $cand -V 2>&1 | Select-Object -First 1) } catch { }
+ finally { $ErrorActionPreference = $prevEap }
+ if ($LASTEXITCODE -eq 0) { $winSsh = $cand; break }
+ $why = if ($null -eq $LASTEXITCODE) { 'it would not start' } else { "exit $LASTEXITCODE" }
+ Write-Warning "$cand did not run ($why)$(if ($version) { ": $version" })"
+ }
+ if (-not $winSsh) {
+ Write-Warning "No working Win32-OpenSSH client found (looked in $($sshCandidates -join ', ')). Add the 'OpenSSH Client' optional feature and re-run; until then git uses its own bundled ssh.exe, which cannot see keys held by the Windows ssh-agent service."
return
}
# Forward slashes on purpose: git parses core.sshCommand with shell quoting
$value = $winSsh -replace '\\', '/'
& $git config --global core.sshCommand $value
Write-Host " core.sshCommand: $value"
+ Write-Host " $version"
}
# ---------------------------------------------------------------------------
@rem which it reads). The installer elevates via UAC.\r
winget install OpenCppCoverage.OpenCppCoverage\r
\r
-@rem --- Non-elevated PowerShell half ---\r
-@rem WinMerge on the user PATH, BinSkim, and the global git config (identity +\r
-@rem core.sshCommand -> the Windows OpenSSH client, so git shares the Windows\r
-@rem ssh-agent). EDIT THE GIT IDENTITY at the top of setup-windows-no-uac.ps1\r
-@rem before the first run.\r
-@rem\r
-@rem Deliberately NOT elevated: every step writes per-user state (the HKCU PATH,\r
-@rem the .gitconfig under %USERPROFILE%), which the elevated half would write to\r
-@rem the administrator profile instead.\r
-@rem\r
-@rem Non-fatal: these are conveniences, and the elevated half below is the part\r
-@rem worth the UAC prompt. A failure warns and provisioning continues.\r
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-no-uac.ps1"\r
-if not "%ERRORLEVEL%"=="0" echo [setup-windows] WARNING: setup-windows-no-uac.ps1 reported a failure ^(see above^); continuing.\r
-\r
@rem ---------------------------------------------------------------------------\r
@rem No package manager needed for the Windows build\r
@rem\r
echo [setup-windows] The elevated window may have been cancelled at the UAC prompt.\r
)\r
\r
+@rem --- Non-elevated PowerShell half ---\r
+@rem WinMerge on the user PATH, BinSkim, and the global git config (identity +\r
+@rem core.sshCommand -> a Win32-OpenSSH client, so git shares the Windows\r
+@rem ssh-agent). EDIT THE GIT IDENTITY at the top of setup-windows-no-uac.ps1\r
+@rem before the first run.\r
+@rem\r
+@rem Deliberately NOT elevated: every step writes per-user state (the HKCU PATH,\r
+@rem the .gitconfig under %USERPROFILE%), which the elevated half would write to\r
+@rem the administrator profile instead.\r
+@rem\r
+@rem AFTER the elevated half on purpose: core.sshCommand prefers the ssh.exe that\r
+@rem half unpacks beside rsync.exe - a push through the in-box client is capped\r
+@rem at ~17MB/s - and it can only prefer it once it is on disk. Run either way,\r
+@rem including when the elevated half failed above: nothing here depends on it,\r
+@rem and the fallback is the in-box client that Windows already has.\r
+@rem\r
+@rem Non-fatal: these are conveniences, and the elevated half is the part worth\r
+@rem the UAC prompt. A failure warns and provisioning continues.\r
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-no-uac.ps1"\r
+if not "%ERRORLEVEL%"=="0" echo [setup-windows] WARNING: setup-windows-no-uac.ps1 reported a failure ^(see above^); continuing.\r
+\r
if not "%UAC_RC%"=="0" (\r
echo.\r
echo [setup-windows] ELEVATED SETUP FAILED ^(exit code %UAC_RC%^). See log above.\r
vilimpoc.org / repos / dotfiles / commitdiff