development environment: editors and shells, Python, the Visual Studio 2022
toolchain (including the Clang and Windows XP targeting toolsets), the Windows
Driver Kit, and a handful of analysis tools (Sysinternals, OpenCppCoverage,
-BinSkim, the Windows Performance Toolkit).
+BinSkim, the Windows Performance Toolkit). It also sets the box up to be driven
+remotely: OpenSSH Server plus an rsync build for Windows, which is what makes a
+throwaway VM reachable from a Linux host.
## Files
| File | Purpose |
| --- | --- |
| `setup-windows.bat` | Entry point. Runs the non-elevated, per-user half (winget installs, user `PATH` edits, global git config), then launches the elevated half and prints its log. |
-| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
+| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs and starts OpenSSH Server, installs `rsync.exe` to the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
## Usage
script; the batch file prints it when the elevated window closes. The log is
gitignored, as it contains local paths.
- Both halves are idempotent — re-running skips anything already installed.
+ BinSkim in particular checks NuGet for the newest stable version *before*
+ downloading: the package is a self-contained .NET build well over 100 MB, and
+ re-provisioning an up-to-date box should not pay for it. The installed version
+ is tracked in `nupkg-version.txt` beside the tool.
+- **Remote access.** OpenSSH Server is installed from the Windows on-demand
+ capability (10/1809+), set to start automatically, and given an inbound TCP 22
+ firewall rule on *all* profiles — a VM's host-only or bridged adapter is
+ routinely classified Public, which is the usual reason a running `sshd` is
+ unreachable. Windows ships no `rsync`, so a build of it
+ ([nuket/rsync-windows](https://github.com/nuket/rsync-windows)) is installed to
+ `C:\Tools\rsync` and added to the **machine** `PATH`. That last detail matters:
+ the remote end of an `rsync` runs non-interactively, with no login shell, and
+ Win32-OpenSSH builds that environment from the registry `PATH` rather than from
+ a profile. Key auth needs `~/.ssh/authorized_keys` ACL'd to just you and
+ `SYSTEM`; accounts in the Administrators group use
+ `C:\ProgramData\ssh\administrators_authorized_keys` instead.
- Visual Studio is installed in three labelled passes (base workload, Clang/LLVM,
XP toolset) so a failure identifies which component group is responsible.
- The scripts were extracted from a native Windows project, so the component
#Requires -RunAsAdministrator\r
<#\r
setup-windows-with-uac.ps1\r
- Elevated portion of BlockBox Windows provisioning. Invoked by setup-windows.bat\r
+ Elevated portion of the Windows provisioning. Invoked by setup-windows.bat\r
via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
\r
What this installs / configures:\r
- ssh-agent set to automatic + started\r
+ - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22\r
+ - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine PATH\r
- Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
- Windows Driver Kit 10.0.26100\r
Set-Service -Name ssh-agent -StartupType Automatic\r
if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent }\r
\r
+# ---------------------------------------------------------------------------\r
+# OpenSSH Server (sshd)\r
+#\r
+# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the\r
+# transport rsync rides on when seeding test data in. Ships with Windows 10\r
+# 1809+ / Windows 11 as an on-demand capability, so no third-party install.\r
+#\r
+# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall\r
+# rule; we verify and create it if missing (it is absent on some images).\r
+#\r
+# Non-fatal: a box that can't run sshd should still finish provisioning.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'OpenSSH Server (sshd)'\r
+try {\r
+ $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' |\r
+ Select-Object -First 1\r
+ if (-not $sshd) {\r
+ Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.'\r
+ } else {\r
+ if ($sshd.State -ne 'Installed') {\r
+ Write-Host " Installing $($sshd.Name) ..."\r
+ $r = Add-WindowsCapability -Online -Name $sshd.Name\r
+ if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Server]' -ForegroundColor Yellow }\r
+ } else {\r
+ Write-Host " OK: $($sshd.Name) already installed"\r
+ }\r
+\r
+ Set-Service -Name sshd -StartupType Automatic\r
+ if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd }\r
+ Write-Host ' sshd: Automatic + running'\r
+\r
+ # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and\r
+ # bridged adapters are frequently classified Public, and the capability's\r
+ # own rule is Private-only on some images, which is what leaves a plainly\r
+ # running sshd plainly unreachable.\r
+ #\r
+ # OpenSSH-Server-In-TCP is the name the capability itself uses, so this\r
+ # WIDENS that rule rather than adding a second one next to it. Creating\r
+ # our own under a different name would leave the narrow rule in place and\r
+ # the box still unreachable on a Public-classified adapter; creating one\r
+ # under the same name would collide. Adopt it if present, create it if not.\r
+ $ruleName = 'OpenSSH-Server-In-TCP'\r
+ if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) {\r
+ Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any\r
+ Write-Host " Widened firewall rule $ruleName to all profiles"\r
+ } else {\r
+ New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' `\r
+ -Enabled True -Direction Inbound -Protocol TCP -Action Allow `\r
+ -LocalPort 22 -Profile Any | Out-Null\r
+ Write-Host " Added firewall rule $ruleName (TCP 22, all profiles)"\r
+ }\r
+ }\r
+} catch {\r
+ Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)"\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+# rsync for Windows (github.com/nuket/rsync-windows)\r
+#\r
+# Windows' OpenSSH ships the transport only - no rsync - so pushing test data\r
+# from a Linux box needs an rsync.exe on the Windows side.\r
+#\r
+# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is\r
+# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes\r
+# the client-side --rsync-path escape hatch painful to quote. Added to the\r
+# MACHINE PATH so it resolves for every account, including the non-interactive\r
+# sshd session, which builds its environment from the machine + user registry\r
+# PATH rather than from a login shell.\r
+#\r
+# Non-fatal: a download failure only warns.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'rsync for Windows'\r
+$RsyncUrl = 'https://github.com/nuket/rsync-windows/releases/download/v3.5.0-g521ad8ad/rsync.exe'\r
+$RsyncDir = 'C:\Tools\rsync'\r
+try {\r
+ New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null\r
+ $RsyncExe = Join-Path $RsyncDir 'rsync.exe'\r
+ # Download to a temp name first so an interrupted transfer can't leave a\r
+ # truncated rsync.exe sitting on the PATH.\r
+ $tmpExe = "$RsyncExe.download"\r
+ [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\r
+ Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpExe -UseBasicParsing\r
+ Move-Item -Path $tmpExe -Destination $RsyncExe -Force\r
+ Write-Host " Downloaded rsync.exe to $RsyncExe"\r
+\r
+ # Machine PATH (HKLM environment). Idempotent: only appends if absent.\r
+ $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
+ if (-not $m) { $m = '' }\r
+ if (($m -split ';') -notcontains $RsyncDir) {\r
+ $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir }\r
+ [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')\r
+ Write-Host " Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)."\r
+ # sshd caches the environment it was started with, so an already-running\r
+ # service would not see the new PATH until restarted.\r
+ if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') {\r
+ Restart-Service sshd\r
+ Write-Host ' Restarted sshd so it inherits the updated machine PATH.'\r
+ }\r
+ } else {\r
+ Write-Host " OK: $RsyncDir already in the machine PATH"\r
+ }\r
+\r
+ & $RsyncExe --version | Select-Object -First 1\r
+} catch {\r
+ Write-Warning "rsync install failed: $($_.Exception.Message)"\r
+ Write-Warning "Download manually from $RsyncUrl and drop it in $RsyncDir."\r
+}\r
+\r
# ---------------------------------------------------------------------------\r
# Visual Studio 2022 Community\r
# ---------------------------------------------------------------------------\r
@echo off\r
\r
@rem ---------------------------------------------------------------------------\r
-@rem setup-windows.bat - provision a fresh Windows box for BlockBox development\r
+@rem setup-windows.bat - provision a fresh Windows box for native development\r
@rem ---------------------------------------------------------------------------\r
\r
@rem --- Non-admin (per-user) installs + git config ---\r
winget install WiXToolset.WiXCLI\r
\r
@rem OpenCppCoverage: native (PE) line coverage for the C++ binaries. run-coverage-occ.py drives the\r
-@rem pytest suite under it to produce an HTML report (BlockBox + the sandbox DLLs build with PDBs,\r
+@rem pytest suite under it to produce an HTML report (the binaries under test build with PDBs,\r
@rem which it reads). The installer elevates via UAC.\r
winget install OpenCppCoverage.OpenCppCoverage\r
\r
@rem Microsoft.CodeAnalysis.BinSkim NuGet package ships a self-contained win-x64\r
@rem build, so this needs no .NET SDK/runtime: download the .nupkg (a zip), extract\r
@rem the win-x64 tool folder to %LOCALAPPDATA%\Programs\BinSkim, and add it to the\r
-@rem user PATH. After restarting the shell: binskim analyze path\to\BlockBox.exe\r
+@rem user PATH. After restarting the shell: binskim analyze path\to\your.exe\r
+@rem\r
+@rem VERSION CHECK FIRST. The .nupkg is a large download (self-contained .NET), so\r
+@rem we ask NuGet what the newest stable version is BEFORE fetching anything, and\r
+@rem skip the download entirely when the installed copy already matches. The\r
+@rem installed version is recorded in nupkg-version.txt next to the tool; for a\r
+@rem copy installed before that marker existed we fall back to BinSkim.exe's own\r
+@rem ProductVersion, which costs at most one more download and then self-heals.\r
+@rem The flat-container URL pins the exact version we checked, unlike the v2\r
+@rem /package/<id> endpoint, which just redirects to whatever is newest at the\r
+@rem moment of the request.\r
+@rem\r
+@rem The user PATH is refreshed on every run, including the skip path, so a lost\r
+@rem PATH entry is repaired without re-downloading the tool to do it.\r
@rem A failure here only warns (exit 0) so it never aborts the rest of provisioning.\r
-powershell -NoProfile -Command "try { $ErrorActionPreference='Stop'; [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; $dest=Join-Path $env:LOCALAPPDATA 'Programs\BinSkim'; $tmp=Join-Path $env:TEMP ('binskim_'+[guid]::NewGuid().ToString('N')); New-Item -ItemType Directory -Force -Path $tmp | Out-Null; $zip=Join-Path $tmp 'binskim.zip'; Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.CodeAnalysis.BinSkim' -OutFile $zip; Expand-Archive -Path $zip -DestinationPath $tmp -Force; $exe=Get-ChildItem -Path $tmp -Recurse -Filter 'BinSkim.exe' | Where-Object { $_.FullName -match 'win-x64' } | Sort-Object FullName | Select-Object -Last 1; if (-not $exe) { throw 'BinSkim.exe (win-x64) not found in package.' }; if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; New-Item -ItemType Directory -Force -Path $dest | Out-Null; Copy-Item -Path (Join-Path $exe.Directory.FullName '*') -Destination $dest -Recurse -Force; Remove-Item -Recurse -Force $tmp; $u=[Environment]::GetEnvironmentVariable('Path','User'); if (-not $u) { $u='' }; if (($u -split ';') -notcontains $dest) { $new = if ($u.Trim()) { $u.TrimEnd(';')+';'+$dest } else { $dest }; [Environment]::SetEnvironmentVariable('Path',$new,'User'); Write-Host ('Added '+$dest+' to user PATH (restart your shell to pick it up).') } else { Write-Host ($dest+' already in user PATH.') }; Write-Host ('BinSkim installed to '+$dest) } catch { Write-Warning ('BinSkim install failed: '+$_.Exception.Message); exit 0 }"\r
+powershell -NoProfile -Command "try { $ErrorActionPreference='Stop'; [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; $dest=Join-Path $env:LOCALAPPDATA 'Programs\BinSkim'; $exe=Join-Path $dest 'BinSkim.exe'; $mark=Join-Path $dest 'nupkg-version.txt'; $have=$null; if (Test-Path $exe) { if (Test-Path $mark) { $have=(Get-Content $mark -Raw).Trim() } else { $pv=(Get-Item $exe).VersionInfo.ProductVersion; if ($pv) { $have=$pv.Split('+')[0].Trim() } } }; $latest=$null; try { $idx=Invoke-RestMethod -Uri 'https://api.nuget.org/v3-flatcontainer/microsoft.codeanalysis.binskim/index.json' -UseBasicParsing; $latest=$idx.versions | Where-Object { $_ -notmatch '-' } | Select-Object -Last 1 } catch { Write-Warning ('BinSkim version check failed: '+$_.Exception.Message) }; if (-not $latest) { if ($have) { Write-Host ('BinSkim '+$have+' kept (could not reach NuGet to check for a newer one).') } else { Write-Warning 'BinSkim not installed and NuGet unreachable; skipping.'; exit 0 } } elseif ($have -and ($have -eq $latest -or $have -eq ($latest+'.0'))) { Write-Host ('BinSkim '+$have+' is already the newest stable release; skipping download.') } else { if ($have) { Write-Host ('BinSkim '+$have+' -> '+$latest+'; downloading.') } else { Write-Host ('BinSkim '+$latest+'; downloading.') }; $tmp=Join-Path $env:TEMP ('binskim_'+[guid]::NewGuid().ToString('N')); New-Item -ItemType Directory -Force -Path $tmp | Out-Null; $zip=Join-Path $tmp 'binskim.zip'; Invoke-WebRequest -Uri ('https://api.nuget.org/v3-flatcontainer/microsoft.codeanalysis.binskim/'+$latest+'/microsoft.codeanalysis.binskim.'+$latest+'.nupkg') -OutFile $zip -UseBasicParsing; Expand-Archive -Path $zip -DestinationPath $tmp -Force; $src=Get-ChildItem -Path $tmp -Recurse -Filter 'BinSkim.exe' | Where-Object { $_.FullName -match 'win-x64' } | Sort-Object FullName | Select-Object -Last 1; if (-not $src) { throw 'BinSkim.exe (win-x64) not found in package.' }; if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; New-Item -ItemType Directory -Force -Path $dest | Out-Null; Copy-Item -Path (Join-Path $src.Directory.FullName '*') -Destination $dest -Recurse -Force; Remove-Item -Recurse -Force $tmp; Set-Content -Path $mark -Value $latest -Encoding ascii; Write-Host ('BinSkim '+$latest+' installed to '+$dest) }; $u=[Environment]::GetEnvironmentVariable('Path','User'); if (-not $u) { $u='' }; if (($u -split ';') -notcontains $dest) { $new = if ($u.Trim()) { $u.TrimEnd(';')+';'+$dest } else { $dest }; [Environment]::SetEnvironmentVariable('Path',$new,'User'); Write-Host ('Added '+$dest+' to user PATH (restart your shell to pick it up).') } else { Write-Host ($dest+' already in user PATH.') } } catch { Write-Warning ('BinSkim install failed: '+$_.Exception.Message); exit 0 }"\r
\r
@rem --- Global git identity: EDIT THESE BEFORE RUNNING ---\r
@rem Replace the placeholders with your own name and email, or comment the two\r
vilimpoc.org / repos / dotfiles / commitdiff