Joseph Doherty
ac4c4d40dc
v2-ci / unit-tests (push) Has been cancelled
Adds scripts/validation/opcua-windows-service/: a phased PowerShell gate (Invoke-ServiceGate.ps1) that installs the known-good build as the real OtOpcUaHost service via Install-Services.ps1, seeds LocalDb through the production cache API (Seeder, built against the baseline tree), upgrades in place with config/PKI/LocalDb carried with their ACLs, starts/stops through the SCM, runs a strict SDK 2 probe matrix (Sign + SignAndEncrypt, valid/wrong/unknown/disabled/anonymous keys, untrusted client and server), exercises the ScriptWorker isolation, rolls back and cleans up. windev 2026-11-12 (efb9197a->438484fd->efb9197a): app cert CEF9D91F... reused byte-for-byte with identical PKI SDDL on every start, all gating checks pass, 0 secrets in logs. Findings filed: #879 (None endpoint cannot be dropped), #880 (SDK 2 client 65-char key vs SDK 1.5 server: rollback/QA risk), #883 (Install-ScriptWorkerIsolation.ps1 fails on pwsh 7 and 5.1; runtime isolation proven with the patch in the evidence directory). Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
50 lines
3.2 KiB
Diff
50 lines
3.2 KiB
Diff
--- /private/tmp/claude-501/-Users-dohertj2-Desktop-scadaproj/a6d396bd-5e2c-4e21-a60d-576a5e97f6b7/scratchpad/wt800/scripts/install/ScriptWorkerIsolation.psm1 2026-11-12 09:40:54
|
|
+++ /private/tmp/claude-501/-Users-dohertj2-Desktop-scadaproj/a6d396bd-5e2c-4e21-a60d-576a5e97f6b7/scratchpad/art/install-candidate-patched/ScriptWorkerIsolation.psm1 2026-11-12 10:18:53
|
|
@@ -188,16 +188,17 @@
|
|
if ($Remove) { return 'unchanged' }
|
|
throw "$Path does not exist"
|
|
}
|
|
- $item = Get-Item -LiteralPath $Path
|
|
- $acl = $item.GetAccessControl('Access')
|
|
+ $acl = Get-Acl -LiteralPath $Path # #800: DirectoryInfo.GetAccessControl does not exist on PowerShell 7 (.NET)
|
|
$identity = [System.Security.Principal.SecurityIdentifier]::new($Sid)
|
|
$explicit = @($acl.GetAccessRules($true, $false, [System.Security.Principal.SecurityIdentifier]) |
|
|
Where-Object { $_.IdentityReference -eq $identity })
|
|
$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
|
|
- $wanted = if ($Remove) { @() } else {
|
|
- , [System.Security.AccessControl.FileSystemAccessRule]::new($identity, [System.Security.AccessControl.FileSystemRights]$Mask,
|
|
+ # #800: @() keeps $wanted an array; the if-expression unrolled it to a scalar ($null on -Remove), and .Count on that
|
|
+ # throws under Set-StrictMode -Version Latest on Windows PowerShell 5.1.
|
|
+ $wanted = @(if (-not $Remove) {
|
|
+ [System.Security.AccessControl.FileSystemAccessRule]::new($identity, [System.Security.AccessControl.FileSystemRights]$Mask,
|
|
$inherit, [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]$Type)
|
|
- }
|
|
+ })
|
|
$same = ($explicit.Count -eq $wanted.Count) -and (
|
|
$wanted.Count -eq 0 -or (
|
|
[int]$explicit[0].FileSystemRights -eq $Mask -and $explicit[0].AccessControlType -eq $wanted[0].AccessControlType -and
|
|
@@ -205,7 +206,7 @@
|
|
if ($same) { return 'unchanged' }
|
|
$acl.PurgeAccessRules($identity)
|
|
foreach ($rule in $wanted) { $acl.AddAccessRule($rule) }
|
|
- $item.SetAccessControl($acl)
|
|
+ Set-Acl -LiteralPath $Path -AclObject $acl
|
|
'changed'
|
|
}
|
|
|
|
@@ -252,12 +253,11 @@
|
|
}
|
|
$changed = $false
|
|
if (-not (Test-Path -LiteralPath $d.Path)) { New-Item -ItemType Directory -Path $d.Path -Force | Out-Null; $changed = $true }
|
|
- $item = Get-Item -LiteralPath $d.Path
|
|
- $current = $item.GetAccessControl('Access, Owner').GetSecurityDescriptorSddlForm('Access, Owner')
|
|
+ $current = (Get-Acl -LiteralPath $d.Path).GetSecurityDescriptorSddlForm('Access, Owner')
|
|
$desired = [System.Security.AccessControl.DirectorySecurity]::new()
|
|
$desired.SetSecurityDescriptorSddlForm($d.Sddl, 'Access, Owner')
|
|
if ($current -ne $desired.GetSecurityDescriptorSddlForm('Access, Owner')) {
|
|
- $item.SetAccessControl($desired) # propagates to the key file, pe\ and workers\ (inherited ACEs)
|
|
+ Set-Acl -LiteralPath $d.Path -AclObject $desired # propagates to the key file, pe\ and workers\ (inherited ACEs)
|
|
$changed = $true
|
|
}
|
|
return $(if ($changed) { 'changed' } else { 'unchanged' })
|