| --- | --- |
| `setup-windows.bat` | Entry point. Runs the winget installs, then the non-elevated script, then launches the elevated half and prints its log. |
| `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |
-| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs and starts OpenSSH Server, installs `rsync.exe` to the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
+| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
## Usage
a profile. Key auth needs `~/.ssh/authorized_keys` ACL'd to just you and
`SYSTEM`; accounts in the Administrators group use
`C:\ProgramData\ssh\administrators_authorized_keys` instead.
+- **rsync brings its own `ssh.exe`.** That release ships as one zip per
+ architecture — `rsync-windows-x64.zip` / `rsync-windows-x86.zip`, each holding
+ `rsync.exe`, an `ssh.exe`, `COPYING.txt` and `NOTICE-ssh.txt` — and the
+ elevated half picks the zip for the OS bitness, verifies it against the
+ published `.sha256`, and unpacks the pair together. Together is the point:
+ `rsync.exe` prefers an `ssh.exe` sitting in its own directory, and the release
+ builds one because the client Windows ships reads its stdin 3 KB at a time,
+ which holds a transfer *from* the box at ~17 MB/s however fast the link is.
+ Nothing else about it differs — same `~/.ssh`, same `ssh-agent`, same
+ `known_hosts` — and a bare `ssh` still resolves to the in-box client, which
+ sits ahead of `C:\Tools\rsync` on the `PATH`. It links against the
+ `libcrypto.dll` the **OpenSSH Client** capability puts in `System32` (Windows'
+ own LibreSSL, which uses AES-NI) and ships no copy of its own, so the elevated
+ half installs that capability first and falls back to `rsync.exe` alone,
+ warning, on an image that will not offer it.
+- The `rsync` download follows the `releases/latest/download/` redirect rather
+ than the GitHub API: unauthenticated API calls are rate-limited to 60/hour per
+ IP, which a provisioning run behind a shared NAT can genuinely exhaust. To hold
+ a box on a known build, pin the tag in `$RsyncUrl`
+ (`.../releases/download/<tag>/<asset>`) instead.
- Visual Studio is installed in three labelled passes (base workload, Clang/LLVM,
XP toolset) so a failure identifies which component group is responsible.
- The scripts were extracted from a native Windows project, so the component
via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
\r
What this installs / configures:\r
+ - OpenSSH Client capability (the ssh.exe rsync shells out to, and the\r
+ System32 libcrypto.dll the release's own ssh.exe links against)\r
- ssh-agent set to automatic + started\r
- OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22\r
- - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine PATH\r
+ - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine\r
+ PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this\r
+ architecture\r
- Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
- Windows Driver Kit 10.0.26100\r
# ---------------------------------------------------------------------------\r
# Base tools via winget\r
# ---------------------------------------------------------------------------\r
+\r
+# ---------------------------------------------------------------------------\r
+# OpenSSH Client\r
+#\r
+# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent\r
+# from some Server images. Two things below want it: rsync does not speak ssh\r
+# itself, it execs an ssh binary, and the release's own ssh.exe links against the\r
+# libcrypto.dll this capability puts in System32. It also owns the ssh-agent\r
+# service configured next, so a missing client is why that step would fail.\r
+#\r
+# Non-fatal, like the server half below: a box that cannot have it should still\r
+# finish provisioning.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'OpenSSH Client'\r
+try {\r
+ $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |\r
+ Select-Object -First 1\r
+ if (-not $sshc) {\r
+ Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'\r
+ } elseif ($sshc.State -eq 'Installed') {\r
+ Write-Host " OK: $($sshc.Name) already installed"\r
+ } else {\r
+ Write-Host " Installing $($sshc.Name) ..."\r
+ $r = Add-WindowsCapability -Online -Name $sshc.Name\r
+ if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Client]' -ForegroundColor Yellow }\r
+ }\r
+} catch {\r
+ Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"\r
+}\r
+\r
# ---------------------------------------------------------------------------\r
# SSH agent\r
# ---------------------------------------------------------------------------\r
# Windows' OpenSSH ships the transport only - no rsync - so pushing test data\r
# from a Linux box needs an rsync.exe on the Windows side.\r
#\r
+# The release is one zip per architecture - rsync-windows-x64.zip and\r
+# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the\r
+# licence texts under exactly those names. Both exes are installed, together:\r
+# rsync.exe prefers an ssh.exe in its own directory, and the release's build is\r
+# what makes a push FROM this box run at line rate. The ssh.exe Windows ships\r
+# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the\r
+# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same\r
+# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits\r
+# ahead of C:\Tools\rsync on the machine PATH.\r
+#\r
+# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability\r
+# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses\r
+# AES-NI. No copy of it ships in the zip, so where the capability is missing we\r
+# unpack rsync alone rather than an ssh.exe that will not start.\r
+#\r
# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is\r
# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes\r
# the client-side --rsync-path escape hatch painful to quote. Added to the\r
# Non-fatal: a download failure only warns.\r
# ---------------------------------------------------------------------------\r
Write-Step 'rsync for Windows'\r
-$RsyncUrl = 'https://github.com/nuket/rsync-windows/releases/download/v3.5.0-g521ad8ad/rsync.exe'\r
-$RsyncDir = 'C:\Tools\rsync'\r
+$RsyncRepo = 'nuket/rsync-windows'\r
+$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }\r
+# The /releases/latest/download/ redirect rather than the API: unauthenticated\r
+# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a\r
+# shared NAT can genuinely exhaust, and the redirect costs none of that budget.\r
+# To hold a box on a known build, pin the tag instead:\r
+# .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset\r
+$RsyncUrl = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"\r
+$RsyncDir = 'C:\Tools\rsync'\r
try {\r
New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null\r
$RsyncExe = Join-Path $RsyncDir 'rsync.exe'\r
- # Download to a temp name first so an interrupted transfer can't leave a\r
- # truncated rsync.exe sitting on the PATH.\r
- $tmpExe = "$RsyncExe.download"\r
+\r
+ # Does the release's ssh.exe have the libcrypto it needs? Decided before the\r
+ # download so the answer can also gate what comes out of the zip.\r
+ $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'\r
+ $WantSsh = Test-Path $SysCrypto\r
+ if (-not $WantSsh) {\r
+ Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."\r
+ } else {\r
+ $v = (Get-Item $SysCrypto).VersionInfo.FileVersion\r
+ if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {\r
+ Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."\r
+ }\r
+ }\r
+\r
+ # Download and unpack beside the targets, not over them, so an interrupted\r
+ # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch\r
+ # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive\r
+ # refuses any other extension outright ("*.download is not a supported\r
+ # archive file format"), where PowerShell 7 just reads the file.\r
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\r
- Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpExe -UseBasicParsing\r
- Move-Item -Path $tmpExe -Destination $RsyncExe -Force\r
- Write-Host " Downloaded rsync.exe to $RsyncExe"\r
+ $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"\r
+ Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing\r
+ Write-Host " Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"\r
+\r
+ # Verify against the .sha256 published beside it. Same origin, so this is an\r
+ # integrity check on the transfer rather than a defence against a hostile\r
+ # release - but a truncated or proxy-mangled download is the failure that\r
+ # actually happens, and it fails here instead of mid-transfer later.\r
+ #\r
+ # -OutFile, not .Content: GitHub serves the .sha256 as\r
+ # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather\r
+ # than a string for any non-text content type, so .Content would compare the\r
+ # first BYTE against the hash and fail on every correct download.\r
+ $tmpSha = "$tmpZip.sha256"\r
+ Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing\r
+ $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()\r
+ Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue\r
+ $got = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()\r
+ if ($want -and $want -ne $got) {\r
+ Remove-Item $tmpZip -Force\r
+ throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"\r
+ }\r
+ Write-Host " SHA-256 verified: $got"\r
+\r
+ # Unpack to a scratch directory and move out the files we asked for, rather\r
+ # than expanding straight over the install directory: the zip is the unit\r
+ # that was checksummed, and this way a future release adding something to it\r
+ # cannot quietly drop that something onto the machine PATH.\r
+ $unpack = Join-Path $RsyncDir '.unpack'\r
+ if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }\r
+ Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force\r
+ Remove-Item $tmpZip -Force\r
+ foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {\r
+ $src = Join-Path $unpack $f\r
+ if (-not (Test-Path $src)) { continue }\r
+ if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }\r
+ Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force\r
+ }\r
+ Remove-Item -Recurse -Force $unpack\r
+ Write-Host " Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"\r
\r
# Machine PATH (HKLM environment). Idempotent: only appends if absent.\r
$m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
& $RsyncExe --version | Select-Object -First 1\r
} catch {\r
Write-Warning "rsync install failed: $($_.Exception.Message)"\r
- Write-Warning "Download manually from $RsyncUrl and drop it in $RsyncDir."\r
+ Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"\r
+ Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."\r
}\r
\r
# ---------------------------------------------------------------------------\r
vilimpoc.org / repos / dotfiles / commitdiff