From: Max Vilimpoc Date: Fri, 28 Aug 2026 00:04:08 +0000 (+0200) Subject: dotfiles: give git the ssh.exe that pushes at line rate X-Git-Url: https://vilimpoc.org/repos/dotfiles/commitdiff_plain/2bbc9b414ffb45df936ca1169795cb8e07bb1863 dotfiles: give git the ssh.exe that pushes at line rate core.sshCommand pointed at the in-box System32 client, which reads its stdin 3KB at a time -- the same limit that held an rsync push to ~17MB/s, and it applies to anything git pushes through it too. The elevated half now unpacks a client without that limit beside rsync.exe, so prefer it and keep the in-box one as the fallback. Same client from the same source: same ~/.ssh, same ssh-agent named pipe, same known_hosts. Candidates are tried by RUNNING them rather than by Test-Path. The fast build carries no libcrypto of its own -- it links the one the OpenSSH Client capability puts in System32 -- so on an image without that capability it is a file that exists and a binary that will not start, and the next `git push` is a bad place to discover it. Two traps in doing that from this script: with $ErrorActionPreference = 'Stop' a native command's stderr becomes a terminating error, and `ssh -V` writes its version to stderr, so the WORKING client is the one that looks broken; and an exe that cannot start never sets $LASTEXITCODE, leaving the stale 0 from the last native command that did run to read as success. Hence the EAP dance and the explicit $global:LASTEXITCODE = $null. setup-windows.bat runs the elevated half first for this: the fast ssh.exe has to be on disk before the git config step can prefer it. The non-elevated half still runs when the elevated one failed -- nothing in it depends on that half, and the fallback is the client Windows already has -- and the elevated exit code is still what the batch file exits with. Exercised against real binaries under Windows PowerShell 5.1, with GIT_CONFIG_GLOBAL pointed at a scratch file: fast client present picks 10.0p2, install directory empty falls back to the in-box 9.5p1, a candidate that exits non-zero and one that cannot start at all both warn and fall back. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01D4ozcQcqMSJBi2Ez4Pfxyc --- diff --git a/README.md b/README.md index 063056a..dfe024e 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ throwaway VM reachable from a Linux host. | File | Purpose | | --- | --- | -| `setup-windows.bat` | Entry point. Runs the winget installs, then the non-elevated script, then launches the elevated half and prints its log. | +| `setup-windows.bat` | Entry point. Runs the winget installs, then launches the elevated half and prints its log, then runs the non-elevated script. | | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. | | `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit. Can also be run directly from an Administrator prompt. | @@ -50,15 +50,27 @@ throwaway VM reachable from a Linux host. - The elevated half writes a transcript to `setup-windows-uac.log` next to the script; the batch file prints it when the elevated window closes. The log is gitignored, as it contains local paths. -- **git uses the Windows SSH client.** `setup-windows-no-uac.ps1` sets - `core.sshCommand` to `%WINDIR%/System32/OpenSSH/ssh.exe`. Git for Windows - otherwise prefers its own bundled MSYS2 `ssh.exe`, which cannot reach the - Windows `ssh-agent` service that the elevated half enables - Win32-OpenSSH - publishes the agent on a named pipe the MSYS2 build does not speak. Without - this, keys loaded with `ssh-add` from PowerShell are invisible to `git`, and a - push falls back to hunting for a key file and prompting for its passphrase. - The value uses forward slashes on purpose: git parses `core.sshCommand` with - shell quoting rules, in which a backslash is an escape character. +- **git uses a Win32-OpenSSH client.** `setup-windows-no-uac.ps1` sets + `core.sshCommand`. Git for Windows otherwise prefers its own bundled MSYS2 + `ssh.exe`, which cannot reach the Windows `ssh-agent` service that the elevated + half enables - Win32-OpenSSH publishes the agent on a named pipe the MSYS2 + build does not speak. Without this, keys loaded with `ssh-add` from PowerShell + are invisible to `git`, and a push falls back to hunting for a key file and + prompting for its passphrase. The value uses forward slashes on purpose: git + parses `core.sshCommand` with shell quoting rules, in which a backslash is an + escape character. +- **Which `ssh.exe` git gets.** `C:\Tools\rsync\ssh.exe` — the fast build the + elevated half unpacks — if it is there, `%WINDIR%/System32/OpenSSH/ssh.exe` + otherwise. It is the same client with the same `~/.ssh`, agent and + `known_hosts`; the difference is the stdin pump, and without it anything git + *pushes* is capped at ~17 MB/s. Candidates are tried by **running** them + (`ssh -V`), not by `Test-Path`: the fast build needs a `libcrypto.dll` that an + image without the OpenSSH Client capability does not have, and a client that + will not start should be found here rather than on the next `git push`. + This is also why `setup-windows.bat` now runs the elevated half **first** — the + fast `ssh.exe` has to exist before the git config step can prefer it. The + non-elevated half still runs even when the elevated one failed; it just falls + back. Re-run `setup-windows-no-uac.ps1` on its own at any time to re-pick. - All three scripts are idempotent — re-running skips anything already installed. BinSkim in particular checks NuGet for the newest stable version *before* downloading: the package is a self-contained .NET build well over 100 MB, and diff --git a/setup-windows-no-uac.ps1 b/setup-windows-no-uac.ps1 index e1d5beb..f6500b8 100644 --- a/setup-windows-no-uac.ps1 +++ b/setup-windows-no-uac.ps1 @@ -14,8 +14,9 @@ - WinMerge on the user PATH - BinSkim (binary hardening analyzer) in %LOCALAPPDATA%\Programs\BinSkim, on the user PATH - - Global git identity, and core.sshCommand pointed at the Windows OpenSSH - client so git shares the Windows ssh-agent + - Global git identity, and core.sshCommand pointed at a Win32-OpenSSH + client so git shares the Windows ssh-agent: the fast ssh.exe the elevated + half unpacks beside rsync.exe if it is there, the in-box one otherwise FILL IN $GitUserName / $GitUserEmail below before the first run. @@ -48,6 +49,11 @@ $GitUserEmail = '' # e.g. 'ada@example.com' $BinSkimPackage = 'microsoft.codeanalysis.binskim' $BinSkimDir = Join-Path $env:LOCALAPPDATA 'Programs\BinSkim' +# Where the elevated half puts rsync.exe and the ssh.exe it ships with. Only +# read here, to prefer that ssh.exe for git - keep it in step with $RsyncDir in +# setup-windows-with-uac.ps1 if you move the install. +$RsyncDir = 'C:\Tools\rsync' + function Write-Step([string]$Msg) { Write-Host "`n==> $Msg" -ForegroundColor Cyan } @@ -211,18 +217,57 @@ function Set-GlobalGitConfig { Write-Host " identity: $GitUserName <$GitUserEmail>" } - # --- Make git use the Windows OpenSSH client --- + # --- Make git use a Win32-OpenSSH client --- # Git for Windows ships its own MSYS2 ssh.exe and prefers it, and that client # cannot reach the Windows ssh-agent service that the elevated half enables: # Win32-OpenSSH publishes the agent on a named pipe the MSYS2 build does not # speak. So keys added with `ssh-add` from PowerShell stay invisible to git, # and a push falls back to hunting for a key file and prompting for its - # passphrase. Pointing core.sshCommand at the in-box ssh.exe gives git the - # same client, the same agent, and the same %USERPROFILE%\.ssh\config as + # passphrase. Pointing core.sshCommand at a Win32-OpenSSH ssh.exe gives git + # the same client, the same agent, and the same %USERPROFILE%\.ssh\config as # `ssh` from an ordinary shell. - $winSsh = Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe' - if (-not (Test-Path $winSsh)) { - Write-Warning "No Windows OpenSSH client at $winSsh. Add the 'OpenSSH Client' optional feature and re-run; until then git uses its own bundled ssh.exe, which cannot see keys held by the Windows ssh-agent service." + # + # Two of those are on the box, and the one beside rsync.exe is preferred. + # It is the same client from the same source, with the same ~/.ssh, agent + # and known_hosts, built with a pump on its stdin: the in-box one reads + # stdin 3KB at a time, which holds anything git PUSHES to ~17MB/s however + # fast the link is. It only exists once the elevated half has run, so the + # in-box client stays the fallback - and on a first provisioning run from + # setup-windows.bat it is the elevated half that runs first, so the fast one + # is normally already there. + $sshCandidates = @( + (Join-Path $RsyncDir 'ssh.exe'), + (Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe') + ) + $winSsh = $null + foreach ($cand in $sshCandidates) { + if (-not (Test-Path $cand)) { continue } + # Run it, rather than just believing the file is there: the build beside + # rsync.exe links against the libcrypto.dll the OpenSSH Client capability + # puts in System32, and without that capability it is a binary that does + # not start. Better to find that out here than on the next `git push`. + # + # EAP back to Continue for the call: ssh -V writes its version to + # STDERR, and with $ErrorActionPreference = 'Stop' a native command's + # stderr becomes a terminating RemoteException - so the working client + # would look like the broken one. + $prevEap = $ErrorActionPreference + $ErrorActionPreference = 'Continue' + $version = $null + # Clear the exit code first, explicitly at global scope. An exe that + # cannot start at all - the missing-libcrypto case - throws here without + # ever setting one, and the stale 0 from the last native command that DID + # run would otherwise read as success. $global: because a bare assignment + # would make a local copy that the native call then does not update. + $global:LASTEXITCODE = $null + try { $version = (& $cand -V 2>&1 | Select-Object -First 1) } catch { } + finally { $ErrorActionPreference = $prevEap } + if ($LASTEXITCODE -eq 0) { $winSsh = $cand; break } + $why = if ($null -eq $LASTEXITCODE) { 'it would not start' } else { "exit $LASTEXITCODE" } + Write-Warning "$cand did not run ($why)$(if ($version) { ": $version" })" + } + if (-not $winSsh) { + Write-Warning "No working Win32-OpenSSH client found (looked in $($sshCandidates -join ', ')). Add the 'OpenSSH Client' optional feature and re-run; until then git uses its own bundled ssh.exe, which cannot see keys held by the Windows ssh-agent service." return } # Forward slashes on purpose: git parses core.sshCommand with shell quoting @@ -230,6 +275,7 @@ function Set-GlobalGitConfig { $value = $winSsh -replace '\\', '/' & $git config --global core.sshCommand $value Write-Host " core.sshCommand: $value" + Write-Host " $version" } # --------------------------------------------------------------------------- diff --git a/setup-windows.bat b/setup-windows.bat index f69eced..1d202af 100644 --- a/setup-windows.bat +++ b/setup-windows.bat @@ -17,21 +17,6 @@ winget install WiXToolset.WiXCLI @rem which it reads). The installer elevates via UAC. winget install OpenCppCoverage.OpenCppCoverage -@rem --- Non-elevated PowerShell half --- -@rem WinMerge on the user PATH, BinSkim, and the global git config (identity + -@rem core.sshCommand -> the Windows OpenSSH client, so git shares the Windows -@rem ssh-agent). EDIT THE GIT IDENTITY at the top of setup-windows-no-uac.ps1 -@rem before the first run. -@rem -@rem Deliberately NOT elevated: every step writes per-user state (the HKCU PATH, -@rem the .gitconfig under %USERPROFILE%), which the elevated half would write to -@rem the administrator profile instead. -@rem -@rem Non-fatal: these are conveniences, and the elevated half below is the part -@rem worth the UAC prompt. A failure warns and provisioning continues. -powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-no-uac.ps1" -if not "%ERRORLEVEL%"=="0" echo [setup-windows] WARNING: setup-windows-no-uac.ps1 reported a failure ^(see above^); continuing. - @rem --------------------------------------------------------------------------- @rem No package manager needed for the Windows build @rem @@ -59,6 +44,27 @@ if exist "%UAC_LOG%" ( echo [setup-windows] The elevated window may have been cancelled at the UAC prompt. ) +@rem --- Non-elevated PowerShell half --- +@rem WinMerge on the user PATH, BinSkim, and the global git config (identity + +@rem core.sshCommand -> a Win32-OpenSSH client, so git shares the Windows +@rem ssh-agent). EDIT THE GIT IDENTITY at the top of setup-windows-no-uac.ps1 +@rem before the first run. +@rem +@rem Deliberately NOT elevated: every step writes per-user state (the HKCU PATH, +@rem the .gitconfig under %USERPROFILE%), which the elevated half would write to +@rem the administrator profile instead. +@rem +@rem AFTER the elevated half on purpose: core.sshCommand prefers the ssh.exe that +@rem half unpacks beside rsync.exe - a push through the in-box client is capped +@rem at ~17MB/s - and it can only prefer it once it is on disk. Run either way, +@rem including when the elevated half failed above: nothing here depends on it, +@rem and the fallback is the in-box client that Windows already has. +@rem +@rem Non-fatal: these are conveniences, and the elevated half is the part worth +@rem the UAC prompt. A failure warns and provisioning continues. +powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-no-uac.ps1" +if not "%ERRORLEVEL%"=="0" echo [setup-windows] WARNING: setup-windows-no-uac.ps1 reported a failure ^(see above^); continuing. + if not "%UAC_RC%"=="0" ( echo. echo [setup-windows] ELEVATED SETUP FAILED ^(exit code %UAC_RC%^). See log above.