(#230) Add Admin Only Source For Chocolatey Core Packages #255

ryanrichter94 · 2024-07-22T21:18:19Z

Description Of Changes

Add ChocolateyCore admin only source
Add ChocolateyCore NuGet repo within Nexus
Add Jenkins job Update ChocolateyCore Repository
Change previous C:\choco-setup\files\files directory to be C:\choco-setup\files\packages

Motivation and Context

Main reason for creating this repository was from feedback of admins not wanting their end users to see the Chocolatey core packages in the default repository. This way ChocolateyInternal only contains the packages brought in by the Jenkins internalization pipeline. Also cleaning up the end user view.

Testing

Tested on local VM.

Operating Systems Testing

Windows Server 2022

Change Types Made

~~[ ] Bug fix (non-breaking change).~~
~~[ ] Feature / Enhancement (non-breaking change).~~
Breaking change (fix or feature that could cause existing functionality to change).
Documentation changes.
PowerShell code changes.

Change Checklist

Requires a change to the documentation.
Documentation has been updated.
Tests to cover my changes, have been added.
All new and existing tests passed?
PowerShell code changes: PowerShell v3 compatibility checked?

Related Issue

Docs PR with README changes: (doc) Update QSG with New Nexus Repo docs#1038

Fixes #230

ryanrichter94 · 2024-07-26T21:09:29Z

Converted back to draft after finding issue when running ClientSetup script.

JPRuskin

Sorry, delayed hitting send on this while you were out but remembered.

I think we need to change up how we're adding the internal source a little.

Set-SslSecurity.ps1

scripts/ClientSetup.ps1

jenkins/Update production repository/config.xml

packages/jenkins.json

README.md

scripts/ClientSetup.ps1

Set-SslSecurity.ps1

steviecoaster

Sorry

README.md

Set-SslSecurity.ps1

steviecoaster · 2024-08-09T14:53:24Z

Start-C4bNexusSetup.ps1

-    Get-ChildItem -Path "$env:SystemDrive\choco-setup\files\files" -Filter *.nupkg | ForEach-Object {
-        choco push $_.FullName --source "$((Get-NexusRepository -Name 'ChocolateyInternal').url)/index.json" --apikey $NugetApiKey --force
+    Get-ChildItem -Path "$env:SystemDrive\choco-setup\files\packages" -Filter *.nupkg | ForEach-Object {
+        choco push $_.FullName --source "$((Get-NexusRepository -Name 'ChocolateyCore').url)/index.json" --apikey $NugetApiKey --force


Are we sure we're only pushing what we need to here? What is in the packages folder at this point? The only filter is "give me all the nupkgs"

steviecoaster · 2024-08-09T14:57:22Z

Start-C4bNexusSetup.ps1

-    if (-not (Test-Path 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe')) {
+    if (Test-Path 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'){
+        Write-Host "Syncing Microsoft Edge, to bring it under Chocolatey management"
+        choco sync --id="Microsoft Edge" --package-id="microsoft-edge"


Careful with this Sync. I've seen edge Shipped as Windows be in Programs and Features but not be able to be synced because it's installed "special" and isn't in the hive(s) you'd expect from the registry.

In fact, do we even need this? Edge is default in 2019+, which is what we support so it'll never not be there and on the path. This seems overly complicated at this stage.

Server 2019 does not ship with Microsoft Edge, also if we are installing our product suite onto a fresh server dedicated just for Chocolatey use, should we not make sure all software on that machine is managed by a Chocolatey package?

Yes, we should. I'm just warning that in cases where Edge has been installed via servicing channel (think a Windows Update), choco sync does not detect it, even though it's installed, so we might drop out of the check erroneously.

It might be simpler to just go "screw it, I'm putting edge on here", install the package, and let the underlying install sort things out.

I bring this up because I've seen sync not work even though Edge was very clearly displaying in Programs and Features. It's a real peach.

jenkins/Update ChocolateyCore Repository/builds/permalinks

jenkins/Update ChocolateyCore Repository/builds/legacyIds

jenkins/Update ChocolateyCore Repository/nextBuildNumber

steviecoaster · 2024-08-09T15:05:00Z

scripts/ClientSetup.ps1

@@ -112,21 +112,28 @@ choco config set cacheLocation $env:ChocolateyInstall\choco-cache
 choco config set commandExecutionTimeoutSeconds 14400

 if ($InternetEnabled) {
-    choco source add --name="'ChocolateyInternal'" --source="'$RepositoryUrl'" --allow-self-service --user="'$($Credential.UserName)'" --password="'$($Credential.GetNetworkCredential().Password)'" --priority=1
+    choco source add --name="'ChocolateyCore'" --source="'$RepositoryUrl'" --allow-self-service --admin-only --user="'$($Credential.UserName)'" --password="'$($Credential.GetNetworkCredential().Password)'" --priority=0


Think it a good idea to have the admin-only source configured with the same credentials as the non-admin source? What if the non-admin creds get found out? Now you got 2 problems, not 1.

This requires bigger changes

The only reason ChocolateyCore repo has admin-only is to hide it from the end user GUI view. Also the credential is the same account with permissions to browse and download out of a raw/NuGet repo that ChocolateyInternal originally had before this change.

As this script is meant for a non-admin client registration. I wouldn't feel comfortable putting a true "admin" credential on either of these sources as default behavior.

Admin in name only. The credential should and would (at least this is what I expect) to be limited to browse/read operations on this new repository. The existing credential would not have access to this repository. This is a true separation such that if either credential is leaked somehow, only 1 repository is affected, and even then only in that they can download the packages, they'll still not be able to delete or write anything.

The manifest folders lived in a folder named after one in the Ansible project. This didn't make sense here, where it often lives inside a /files/ directory already. This has been changed.

- Add ChocolateyCore repo as main repo for core packages - Add callout to new ChocolateyCore repository - Remove See It In Action README section as video is outdated - Fixup spelling/grammar in README - Add new Update ChocolateyCore Repository Jenkins Job - Add test to check for new Jenkins job - Remove legacy build files from new and existing Jenkins jobs

Add pester package so its downloaded and available for Validation step. This means the validation step can be used in a fully offline environment.

Add handling to bring edge under Chocolatey management if it was natively installed by a newer server OS. This should ensure that the test is more consistent, delivering the same result regardless of if the Chocolatey package were installed or not.

ryanrichter94 force-pushed the QSG-230 branch 5 times, most recently from 24711b3 to 3fe0c59 Compare July 24, 2024 18:58

ryanrichter94 self-assigned this Jul 24, 2024

ryanrichter94 force-pushed the QSG-230 branch 2 times, most recently from 7e070da to 75ed7a5 Compare July 24, 2024 19:17

ryanrichter94 mentioned this pull request Jul 25, 2024

(doc) Update QSG with New Nexus Repo chocolatey/docs#1038

Draft

3 tasks

ryanrichter94 requested review from JPRuskin and steviecoaster July 25, 2024 20:08

ryanrichter94 marked this pull request as ready for review July 25, 2024 20:10

ryanrichter94 marked this pull request as draft July 26, 2024 21:08

ryanrichter94 force-pushed the QSG-230 branch 3 times, most recently from 15ddbb0 to 51af786 Compare July 29, 2024 13:38

ryanrichter94 marked this pull request as ready for review July 29, 2024 13:42

JPRuskin reviewed Aug 7, 2024

View reviewed changes

JPRuskin force-pushed the QSG-230 branch from 51af786 to d51f8d4 Compare August 7, 2024 16:32

ryanrichter94 force-pushed the QSG-230 branch 4 times, most recently from 184a914 to 7d2ab5a Compare August 9, 2024 14:48

ryanrichter94 requested a review from JPRuskin August 9, 2024 14:49

steviecoaster requested changes Aug 9, 2024

View reviewed changes

ryanrichter94 force-pushed the QSG-230 branch 3 times, most recently from c7fe463 to aa63e22 Compare August 14, 2024 15:19

ryanrichter94 force-pushed the QSG-230 branch from aa63e22 to 6c779c2 Compare August 30, 2024 13:52

JPRuskin and others added 4 commits September 9, 2024 10:23

(#230) Change "files" directory to "packages" directory

cb0be0d

The manifest folders lived in a folder named after one in the Ansible project. This didn't make sense here, where it often lives inside a /files/ directory already. This has been changed.

(maint) Add Pester to Packages Manifest

74eb5f1

Add pester package so its downloaded and available for Validation step. This means the validation step can be used in a fully offline environment.

(fix) Fix Flaky Edge Package Test

84d95e8

Add handling to bring edge under Chocolatey management if it was natively installed by a newer server OS. This should ensure that the test is more consistent, delivering the same result regardless of if the Chocolatey package were installed or not.

ryanrichter94 force-pushed the QSG-230 branch from 6c779c2 to 84d95e8 Compare September 9, 2024 14:37

ryanrichter94 marked this pull request as draft September 17, 2024 13:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(#230) Add Admin Only Source For Chocolatey Core Packages #255

(#230) Add Admin Only Source For Chocolatey Core Packages #255

ryanrichter94 commented Jul 22, 2024 •

edited

Loading

ryanrichter94 commented Jul 26, 2024

JPRuskin left a comment

steviecoaster left a comment

steviecoaster Aug 9, 2024

steviecoaster Aug 9, 2024

steviecoaster Aug 9, 2024

ryanrichter94 Aug 9, 2024 •

edited

Loading

steviecoaster Aug 9, 2024

steviecoaster Aug 9, 2024

ryanrichter94 Aug 9, 2024

steviecoaster Aug 9, 2024

(#230) Add Admin Only Source For Chocolatey Core Packages #255

Are you sure you want to change the base?

(#230) Add Admin Only Source For Chocolatey Core Packages #255

Conversation

ryanrichter94 commented Jul 22, 2024 • edited Loading

Description Of Changes

Motivation and Context

Testing

Operating Systems Testing

Change Types Made

Change Checklist

Related Issue

ryanrichter94 commented Jul 26, 2024

JPRuskin left a comment

Choose a reason for hiding this comment

steviecoaster left a comment

Choose a reason for hiding this comment

steviecoaster Aug 9, 2024

Choose a reason for hiding this comment

steviecoaster Aug 9, 2024

Choose a reason for hiding this comment

steviecoaster Aug 9, 2024

Choose a reason for hiding this comment

ryanrichter94 Aug 9, 2024 • edited Loading

Choose a reason for hiding this comment

steviecoaster Aug 9, 2024

Choose a reason for hiding this comment

steviecoaster Aug 9, 2024

Choose a reason for hiding this comment

ryanrichter94 Aug 9, 2024

Choose a reason for hiding this comment

steviecoaster Aug 9, 2024

Choose a reason for hiding this comment

ryanrichter94 commented Jul 22, 2024 •

edited

Loading

ryanrichter94 Aug 9, 2024 •

edited

Loading