dotfiles: install the rsync release's ssh.exe beside rsync.exe

The rsync-windows release is now one zip per architecture -- rsync.exe, the
ssh.exe it runs, and the licence texts, under exactly those names -- rather
than a bare rsync.exe, so the pinned .../download/v3.5.0-g521ad8ad/rsync.exe
this script fetched no longer exists.

Fetch rsync-windows-x64.zip or rsync-windows-x86.zip by OS bitness, verify it
against the .sha256 published beside it, unpack to a scratch directory and move
out the four files we asked for -- so a future release adding a fifth cannot
quietly drop it onto the machine PATH.  The two exes go in together on purpose:
rsync.exe prefers an ssh.exe in its own directory, and the release builds one
because the client Windows ships reads its stdin 3KB at a time, which holds a
transfer *from* the box at ~17MB/s however fast the link is.  Nothing else
about it differs -- same ~/.ssh, same ssh-agent, same known_hosts -- and a bare
`ssh` still resolves to the in-box client, which sits ahead of C:\Tools\rsync
on the PATH.

That ssh.exe links against the libcrypto.dll the OpenSSH Client capability puts
in System32, and ships no copy of its own, so that capability is now installed
here rather than assumed: it was already the thing ssh-agent, the git
core.sshCommand in the non-elevated half, and rsync's own transport all depend
on.  Where it is absent, or its LibreSSL is older than the 3.8.2 the release is
built against, the script says so and installs rsync alone.

The URL follows the releases/latest/download/ redirect rather than the API,
whose unauthenticated 60/hour per-IP limit a provisioning run behind a shared
NAT can genuinely exhaust; pin the tag in $RsyncUrl to hold a box on a build.

Verified end to end against the live release under Windows PowerShell 5.1 --
which is what the .bat launches, and which refuses to Expand-Archive anything
not named .zip, hence "download-$RsyncAsset" for the scratch file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D4ozcQcqMSJBi2Ez4Pfxyc

diff --git a/README.md b/README.md
index e10d872a599b87930611d76d599e4a8fb69e255b..063056a142c969531ac610b8bad1eea65caee9c6 100644 (file)
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ throwaway VM reachable from a Linux host.
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then the non-elevated script, then launches the elevated half and prints its log. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then the non-elevated script, then launches the elevated half and prints its log. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |

-| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs and starts OpenSSH Server, installs `rsync.exe` to the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |
+| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. |

 
 ## Usage
 
 
 ## Usage
 


@@ -83,6 +83,26 @@ throwaway VM reachable from a Linux host.
   a profile. Key auth needs `~/.ssh/authorized_keys` ACL'd to just you and
   `SYSTEM`; accounts in the Administrators group use
   `C:\ProgramData\ssh\administrators_authorized_keys` instead.
   a profile. Key auth needs `~/.ssh/authorized_keys` ACL'd to just you and
   `SYSTEM`; accounts in the Administrators group use
   `C:\ProgramData\ssh\administrators_authorized_keys` instead.

+- **rsync brings its own `ssh.exe`.** That release ships as one zip per
+  architecture — `rsync-windows-x64.zip` / `rsync-windows-x86.zip`, each holding
+  `rsync.exe`, an `ssh.exe`, `COPYING.txt` and `NOTICE-ssh.txt` — and the
+  elevated half picks the zip for the OS bitness, verifies it against the
+  published `.sha256`, and unpacks the pair together. Together is the point:
+  `rsync.exe` prefers an `ssh.exe` sitting in its own directory, and the release
+  builds one because the client Windows ships reads its stdin 3 KB at a time,
+  which holds a transfer *from* the box at ~17 MB/s however fast the link is.
+  Nothing else about it differs — same `~/.ssh`, same `ssh-agent`, same
+  `known_hosts` — and a bare `ssh` still resolves to the in-box client, which
+  sits ahead of `C:\Tools\rsync` on the `PATH`. It links against the
+  `libcrypto.dll` the **OpenSSH Client** capability puts in `System32` (Windows'
+  own LibreSSL, which uses AES-NI) and ships no copy of its own, so the elevated
+  half installs that capability first and falls back to `rsync.exe` alone,
+  warning, on an image that will not offer it.
+- The `rsync` download follows the `releases/latest/download/` redirect rather
+  than the GitHub API: unauthenticated API calls are rate-limited to 60/hour per
+  IP, which a provisioning run behind a shared NAT can genuinely exhaust. To hold
+  a box on a known build, pin the tag in `$RsyncUrl`
+  (`.../releases/download/<tag>/<asset>`) instead.

 - Visual Studio is installed in three labelled passes (base workload, Clang/LLVM,
   XP toolset) so a failure identifies which component group is responsible.
 - The scripts were extracted from a native Windows project, so the component
 - Visual Studio is installed in three labelled passes (base workload, Clang/LLVM,
   XP toolset) so a failure identifies which component group is responsible.
 - The scripts were extracted from a native Windows project, so the component

diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1
index 8da5c5517613530e0f244c10da6253f1408b4271..8d990f5de3dfc43d7fc621c3040773d18400975e 100644 (file)
--- a/setup-windows-with-uac.ps1
+++ b/setup-windows-with-uac.ps1
@@ -5,9 +5,13 @@
   via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
 \r
   What this installs / configures:\r
   via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
 \r
   What this installs / configures:\r

+    - OpenSSH Client capability (the ssh.exe rsync shells out to, and the\r
+      System32 libcrypto.dll the release's own ssh.exe links against)\r

     - ssh-agent set to automatic + started\r
     - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22\r
     - ssh-agent set to automatic + started\r
     - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22\r

-    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine PATH\r
+    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine\r
+      PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this\r
+      architecture\r

     - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
       Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
     - Windows Driver Kit 10.0.26100\r
     - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
       Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
     - Windows Driver Kit 10.0.26100\r


@@ -105,6 +109,36 @@ try {
 # ---------------------------------------------------------------------------\r
 # Base tools via winget\r
 # ---------------------------------------------------------------------------\r
 # ---------------------------------------------------------------------------\r
 # Base tools via winget\r
 # ---------------------------------------------------------------------------\r

+\r
+# ---------------------------------------------------------------------------\r
+# OpenSSH Client\r
+#\r
+# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent\r
+# from some Server images. Two things below want it: rsync does not speak ssh\r
+# itself, it execs an ssh binary, and the release's own ssh.exe links against the\r
+# libcrypto.dll this capability puts in System32. It also owns the ssh-agent\r
+# service configured next, so a missing client is why that step would fail.\r
+#\r
+# Non-fatal, like the server half below: a box that cannot have it should still\r
+# finish provisioning.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'OpenSSH Client'\r
+try {\r
+    $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |\r
+            Select-Object -First 1\r
+    if (-not $sshc) {\r
+        Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'\r
+    } elseif ($sshc.State -eq 'Installed') {\r
+        Write-Host "    OK: $($sshc.Name) already installed"\r
+    } else {\r
+        Write-Host "    Installing $($sshc.Name) ..."\r
+        $r = Add-WindowsCapability -Online -Name $sshc.Name\r
+        if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Client]' -ForegroundColor Yellow }\r
+    }\r
+} catch {\r
+    Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"\r
+}\r
+\r

 # ---------------------------------------------------------------------------\r
 # SSH agent\r
 # ---------------------------------------------------------------------------\r
 # ---------------------------------------------------------------------------\r
 # SSH agent\r
 # ---------------------------------------------------------------------------\r


@@ -174,6 +208,21 @@ try {
 # Windows' OpenSSH ships the transport only - no rsync - so pushing test data\r
 # from a Linux box needs an rsync.exe on the Windows side.\r
 #\r
 # Windows' OpenSSH ships the transport only - no rsync - so pushing test data\r
 # from a Linux box needs an rsync.exe on the Windows side.\r
 #\r

+# The release is one zip per architecture - rsync-windows-x64.zip and\r
+# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the\r
+# licence texts under exactly those names. Both exes are installed, together:\r
+# rsync.exe prefers an ssh.exe in its own directory, and the release's build is\r
+# what makes a push FROM this box run at line rate. The ssh.exe Windows ships\r
+# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the\r
+# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same\r
+# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits\r
+# ahead of C:\Tools\rsync on the machine PATH.\r
+#\r
+# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability\r
+# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses\r
+# AES-NI. No copy of it ships in the zip, so where the capability is missing we\r
+# unpack rsync alone rather than an ssh.exe that will not start.\r
+#\r

 # Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is\r
 # invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes\r
 # the client-side --rsync-path escape hatch painful to quote. Added to the\r
 # Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is\r
 # invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes\r
 # the client-side --rsync-path escape hatch painful to quote. Added to the\r


@@ -184,18 +233,78 @@ try {
 # Non-fatal: a download failure only warns.\r
 # ---------------------------------------------------------------------------\r
 Write-Step 'rsync for Windows'\r
 # Non-fatal: a download failure only warns.\r
 # ---------------------------------------------------------------------------\r
 Write-Step 'rsync for Windows'\r

-$RsyncUrl = 'https://github.com/nuket/rsync-windows/releases/download/v3.5.0-g521ad8ad/rsync.exe'\r
-$RsyncDir = 'C:\Tools\rsync'\r
+$RsyncRepo  = 'nuket/rsync-windows'\r
+$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }\r
+# The /releases/latest/download/ redirect rather than the API: unauthenticated\r
+# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a\r
+# shared NAT can genuinely exhaust, and the redirect costs none of that budget.\r
+# To hold a box on a known build, pin the tag instead:\r
+#     .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset\r
+$RsyncUrl   = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"\r
+$RsyncDir   = 'C:\Tools\rsync'\r

 try {\r
     New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null\r
     $RsyncExe = Join-Path $RsyncDir 'rsync.exe'\r
 try {\r
     New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null\r
     $RsyncExe = Join-Path $RsyncDir 'rsync.exe'\r

-    # Download to a temp name first so an interrupted transfer can't leave a\r
-    # truncated rsync.exe sitting on the PATH.\r
-    $tmpExe = "$RsyncExe.download"\r
+\r
+    # Does the release's ssh.exe have the libcrypto it needs? Decided before the\r
+    # download so the answer can also gate what comes out of the zip.\r
+    $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'\r
+    $WantSsh   = Test-Path $SysCrypto\r
+    if (-not $WantSsh) {\r
+        Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."\r
+    } else {\r
+        $v = (Get-Item $SysCrypto).VersionInfo.FileVersion\r
+        if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {\r
+            Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."\r
+        }\r
+    }\r
+\r
+    # Download and unpack beside the targets, not over them, so an interrupted\r
+    # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch\r
+    # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive\r
+    # refuses any other extension outright ("*.download is not a supported\r
+    # archive file format"), where PowerShell 7 just reads the file.\r

     [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\r
     [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\r

-    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpExe -UseBasicParsing\r
-    Move-Item -Path $tmpExe -Destination $RsyncExe -Force\r
-    Write-Host "    Downloaded rsync.exe to $RsyncExe"\r
+    $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"\r
+    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing\r
+    Write-Host "    Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"\r
+\r
+    # Verify against the .sha256 published beside it. Same origin, so this is an\r
+    # integrity check on the transfer rather than a defence against a hostile\r
+    # release - but a truncated or proxy-mangled download is the failure that\r
+    # actually happens, and it fails here instead of mid-transfer later.\r
+    #\r
+    # -OutFile, not .Content: GitHub serves the .sha256 as\r
+    # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather\r
+    # than a string for any non-text content type, so .Content would compare the\r
+    # first BYTE against the hash and fail on every correct download.\r
+    $tmpSha = "$tmpZip.sha256"\r
+    Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing\r
+    $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()\r
+    Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue\r
+    $got  = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()\r
+    if ($want -and $want -ne $got) {\r
+        Remove-Item $tmpZip -Force\r
+        throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"\r
+    }\r
+    Write-Host "    SHA-256 verified: $got"\r
+\r
+    # Unpack to a scratch directory and move out the files we asked for, rather\r
+    # than expanding straight over the install directory: the zip is the unit\r
+    # that was checksummed, and this way a future release adding something to it\r
+    # cannot quietly drop that something onto the machine PATH.\r
+    $unpack = Join-Path $RsyncDir '.unpack'\r
+    if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }\r
+    Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force\r
+    Remove-Item $tmpZip -Force\r
+    foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {\r
+        $src = Join-Path $unpack $f\r
+        if (-not (Test-Path $src)) { continue }\r
+        if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }\r
+        Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force\r
+    }\r
+    Remove-Item -Recurse -Force $unpack\r
+    Write-Host "    Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"\r

 \r
     # Machine PATH (HKLM environment). Idempotent: only appends if absent.\r
     $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
 \r
     # Machine PATH (HKLM environment). Idempotent: only appends if absent.\r
     $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r


@@ -217,7 +326,8 @@ try {
     & $RsyncExe --version | Select-Object -First 1\r
 } catch {\r
     Write-Warning "rsync install failed: $($_.Exception.Message)"\r
     & $RsyncExe --version | Select-Object -First 1\r
 } catch {\r
     Write-Warning "rsync install failed: $($_.Exception.Message)"\r

-    Write-Warning "Download manually from $RsyncUrl and drop it in $RsyncDir."\r
+    Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"\r
+    Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."\r

 }\r
 \r
 # ---------------------------------------------------------------------------\r
 }\r
 \r
 # ---------------------------------------------------------------------------\r