diff --git a/docs/archived/2026-05-10/README.md b/docs/archived/2026-05-10/README.md new file mode 100644 index 0000000..c465c4a --- /dev/null +++ b/docs/archived/2026-05-10/README.md @@ -0,0 +1,30 @@ +# Archived Documentation + +Date: 2026-05-10 + +## Archived Files + +### Setup-GiteaSSH.md +**Reason**: Obsolete — current workflow uses HTTP URLs + credential manager for Gitea access, not SSH key-based authentication. +**When to revisit**: If SSH-based Git clones become necessary (e.g., for server-to-server scenarios). + +### TEST-7.4-e2e.md +**Reason**: Sprint 7.4 refactor validation document. Specific to §7.4 Deploy↔Setup refactor completion testing. +**When to revive**: As a reference template for validating future template refactors. Contains reusable patterns for: +- Deploy script validation on fresh VM +- Setup script validation (idempotency, state verification) +- Post-refactor sign-off checklist +**Useful for**: §6.6 (Toolchain Tier-1) template updates, Linux template setup (§6.1) + +## Active Documentation + +All current, operational docs remain in parent directory: +- ARCHITECTURE.md +- BEST-PRACTICES.md +- CI-FLOW.md +- HOST-SETUP.md +- WINDOWS-TEMPLATE-SETUP.md +- OPTIMIZATION.md +- RUNBOOK.md +- TEST-PLAN-v1.3-to-HEAD.md +- LINUX-TEMPLATE-SETUP.md (draft for §6.1) diff --git a/docs/archived/2026-05-10/Setup-GiteaSSH.md b/docs/archived/2026-05-10/Setup-GiteaSSH.md new file mode 100644 index 0000000..34f08fc --- /dev/null +++ b/docs/archived/2026-05-10/Setup-GiteaSSH.md @@ -0,0 +1,101 @@ +# Configurazione accesso SSH a Gitea + +**Target**: clone da `git@gitea.emulab.it:Simone/nsis-plugin-nsinnounp.git` +**Gitea**: `http://10.10.20.11:3100` / `https://gitea.emulab.it` + +--- + +## 1. Genera la chiave SSH sull'host Windows + +```powershell +# Da PowerShell normale (non admin necessario) +ssh-keygen -t ed25519 -C "ci-build@WS1-W11" -f "$env:USERPROFILE\.ssh\id_ci_gitea" +``` + +- Passphrase: **lascia vuota** (il CI gira non-interattivo) +- Produce due file: + - `~\.ssh\id_ci_gitea` — chiave privata (non condividere mai) + - `~\.ssh\id_ci_gitea.pub` — chiave pubblica da aggiungere a Gitea + +--- + +## 2. Aggiungi la chiave pubblica a Gitea + +1. Apri `http://10.10.20.11:3100` → Login come **Simone** +2. Menu utente (in alto a destra) → **Settings** → **SSH / GPG Keys** +3. Clicca **Add Key** +4. Incolla il contenuto di `~\.ssh\id_ci_gitea.pub`: + +```powershell +Get-Content "$env:USERPROFILE\.ssh\id_ci_gitea.pub" | clip +``` + +5. **Key Name**: `WS1-CI-Host` +6. Salva → **Add Key** + +--- + +## 3. Configura SSH client sull'host + +> **Attenzione**: `10.10.20.11` è già usato nel file `~\.ssh\config` con `User root` (entry `HomeAssistant`). +> Non usare `Host 10.10.20.11` direttamente — usare un alias dedicato `gitea-ci`. + +Aggiungi in fondo a `~\.ssh\config`: + +```powershell +$entry = @" + +Host gitea-ci + HostName 10.10.20.11 + Port 2222 + User git + IdentityFile $env:USERPROFILE\.ssh\id_ci_gitea + IdentitiesOnly yes +"@ +Add-Content "$env:USERPROFILE\.ssh\config" $entry +``` + +--- + +## 4. Verifica connessione + +```powershell +ssh -T gitea-ci +``` + +Risposta attesa: +``` +Hi there, Simone! You've successfully authenticated with the key named ci-build@WS1-W11, but Gitea does not provide shell access. +``` + +> **Nota**: exit code 1 è **normale** — Gitea non fornisce shell, ma l'autenticazione è avvenuta. + +--- + +## 5. ~~Trova la porta SSH di Gitea~~ + +**Porta confermata: 2222** (verificata con `Test-NetConnection -ComputerName 10.10.20.11 -Port 2222`). + +--- + +## 6. URL SSH da usare in Invoke-CIJob.ps1 + +Usare l'alias `gitea-ci` definito in `~\.ssh\config`: + +```powershell +-RepoUrl 'ssh://gitea-ci/Simone/nsis-plugin-nsinnounp.git' +``` + +Oppure con IP/porta espliciti (equivalente): + +```powershell +-RepoUrl 'ssh://git@10.10.20.11:2222/Simone/nsis-plugin-nsinnounp.git' +``` + +--- + +## 7. Aggiungi host a known_hosts (evita prompt interattivo) + +```powershell +ssh-keyscan -p 2222 10.10.20.11 >> "$env:USERPROFILE\.ssh\known_hosts" +``` diff --git a/docs/archived/2026-05-10/TEST-7.4-e2e.md b/docs/archived/2026-05-10/TEST-7.4-e2e.md new file mode 100644 index 0000000..b68c82e --- /dev/null +++ b/docs/archived/2026-05-10/TEST-7.4-e2e.md @@ -0,0 +1,169 @@ +# §7.4 — E2e test refactor Deploy↔Setup + +Valida che il refactor §7 (2026-05-10) funzioni su VM reale: +Deploy possiede OS hardening → Setup valida senza re-applicare. + +**Non toccare l'existing template** (`CI-WinBuild.vmx` + snapshot `BaseClean`). +Usare VM separata per i test. + +--- + +## Prerequisiti + +- `F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso` presente +- `F:\CI\ISO\VMware-tools-windows.iso` presente +- VMware Workstation aperto, sufficiente spazio su `F:\CI\Templates\WinBuildTest\` + +--- + +## Step 1 — Deploy su VM test + +```powershell +cd N:\Code\Workspace\Local-CI-CD-System\template + +.\Deploy-WinBuild2025.ps1 ` + -WinISO 'F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso' ` + -ToolsISO 'F:\CI\ISO\VMware-tools-windows.iso' ` + -VMXPath 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' ` + -VMName 'WinBuild2025-test' ` + -ProductKey 'TVRH6-WHNXV-R9WG3-9XRFY-MY832' +``` + +Durata attesa: 30–90 min. Exit 0 = OK, snapshot `PostInstall` preso automaticamente. + +Se timeout su `install_complete.flag`: aumentare `-GuestPollMaxMinutes 120`. + +--- + +## Step 2 — Verifica stato Deploy (§7.1 + §7.2) + +Sostituire `192.168.79.xxx` con IP reale della VM test (`ipconfig` dentro la VM). + +```powershell +$ip = '192.168.79.xxx' +$cred = Get-Credential # Administrator / WinBuild! +$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck + +Invoke-Command -ComputerName $ip -Credential $cred ` + -Authentication Basic -SessionOption $so -ScriptBlock { + + "=== §7.1 Firewall ===" + Get-NetFirewallProfile | Select-Object Name, Enabled + + "=== §7.2 WU services ===" + Get-Service wuauserv, UsoSvc | Select-Object Name, StartType, Status + + "=== §7.2 WU GPO ===" + $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' + $wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' + [PSCustomObject]@{ + NoAutoUpdate = (Get-ItemProperty $au -EA SilentlyContinue).NoAutoUpdate + DisableWindowsUpdateAccess = (Get-ItemProperty $wu -EA SilentlyContinue).DisableWindowsUpdateAccess + } + + "=== §7.1 WinRM limits ===" + [PSCustomObject]@{ + MaxMemoryPerShellMB = (Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value + IdleTimeOut = (Get-Item WSMan:\localhost\Shell\IdleTimeOut).Value + } + + "=== §7.1 UAC ===" + Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' | + Select-Object EnableLUA, LocalAccountTokenFilterPolicy +} +``` + +**Atteso**: +| Check | Valore atteso | +| ---------------------------- | --------------- | +| Firewall tutti profili | `Enabled=False` | +| `wuauserv` StartType | `Manual` | +| `UsoSvc` StartType | `Manual` | +| `NoAutoUpdate` | `1` | +| `DisableWindowsUpdateAccess` | `1` | +| `MaxMemoryPerShellMB` | `>= 2048` | +| `EnableLUA` | `0` | + +--- + +## Step 3 — Prepare -SkipWindowsUpdate (Assert-Step validation) + +```powershell +.\Prepare-WinBuild2025.ps1 ` + -VMIPAddress 192.168.79.xxx ` + -SkipWindowsUpdate +``` + +**Cosa verificare nel log**: +- Step 1 (Firewall): solo `[OK]` — nessun `Set-NetFirewallProfile` +- Step 3 (WinRM): solo `[OK]` — nessun `Enable-PSRemoting` né `winrm set` +- Step 4b (UAC): solo `[OK]` — nessun `Set-ItemProperty EnableLUA` +- Step 5b (Explorer): solo `[OK]` +- Step 5c (CIUX): solo `[OK]` +- Step 4 (user `ci_build`): crea utente — operativo, non validation +- Step 5 (CI dirs): crea `C:\CI\{build,output,scripts}` — operativo +- Step 6: `[Setup] Skipping Windows Update` — corretto con `-SkipWindowsUpdate` +- Step 6b: disabilita wuauserv/UsoSvc — deve girare sempre +- Step 7-10: .NET, Python, VS Build Tools installati +- Final gate: tutti e 7 i check `[OK]` +- Exit code: `0` + +Se un Assert-Step fallisce con `[FAIL]` su Step 1/3/4b/5b/5c → Deploy non ha applicato +quel setting → debug Deploy post-install.ps1 (controllare log nella VM). + +--- + +## Step 4 — Prepare senza -Skip (WU lifecycle §7.2) + +> Solo se Step 3 è passato. La VM deve avere internet (VMnet8 NAT). + +```powershell +.\Prepare-WinBuild2025.ps1 -VMIPAddress 192.168.79.xxx +``` + +**Atteso**: +- Step 6 Step A: rimuove `DisableWindowsUpdateAccess` e `NoAutoUpdate` GPO keys +- Step 6 Step D: avvia wuauserv/UsoSvc/bits/cryptsvc (già Manual → solo Start) +- Step 6: WU gira via SchTask SYSTEM, ResultCode ∈ {0, 2, 3} +- Step 6b: `wuauserv StartType=Disabled`, `UsoSvc StartType=Disabled`, GPO keys re-scritti +- Final gate `Windows Update permanently disabled` → `[OK]` +- Exit code: `0` (o `3010` se WU richiede reboot — ripetere con `-SkipWindowsUpdate`) + +--- + +## Step 5 — Snapshot e promozione (opzionale) + +Se tutti i check di Step 3 e 4 passano: + +```powershell +# Spegni VM test +& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' ` + -T ws stop 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' soft + +# Snapshot versionato +& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' ` + -T ws snapshot 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' ` + "BaseClean_$(Get-Date -Format yyyyMMdd)" +``` + +Per promuovere a produzione (rimpiazza template esistente): +1. Copia `F:\CI\Templates\WinBuildTest\` → `F:\CI\Templates\WinBuild\` (backup prima) +2. Aggiorna `GITEA_CI_TEMPLATE_PATH` in `runner/config.yaml` se path cambia +3. Aggiorna `GITEA_CI_SNAPSHOT_NAME` se usi nome versionato (vedi TODO §2.5) + +--- + +## Checklist §7.4 — COMPLETATA 2026-05-10 + +- [x] Step 1: Deploy exit 0, snapshot `PostInstall` presente +- [x] Step 2: Firewall=False, wuauserv=Manual, NoAutoUpdate=1, MaxMemory≥2048, UAC=0 + (UsoSvc era Automatic — fix applicato in Deploy; corretto manualmente sulla VM test) +- [x] Step 3: Prepare `-SkipWindowsUpdate` exit 0, nessun Set in Step 1/3/4b/5b/5c +- [x] Step 4: Prepare senza `-Skip` exit 0 (WU: 0 update, ResultCode=0), wuauserv=Disabled post-Step 6b +- [x] Snapshot `BaseClean` preso con successo + +**Fix applicati durante il test**: +- Deploy: `UsoSvc` esplicitamente a `Manual` (era omesso, default Server 2025 = Automatic) +- Setup cleanup: ri-applica `Disabled` su wuauserv/UsoSvc dopo DISM (WaaSMedicSvc resets StartType) +- Deploy + Setup 5c: autologin Administrator (`AutoAdminLogon=1`, `DefaultUserName`, `DefaultPassword`, `DefaultDomainName`) +- Nuovi: `Validate-DeployState.ps1`, `Validate-SetupState.ps1`