Make main the lean product a site receives
main was 16 days and 259 commits behind the line the product is actually built on, at contract 0.30.0 against 0.35.0, with no per-PC credential code at all. It was neither current nor curated - just stale. This brings it forward and, at the same time, makes it mean something: main is what a receiving site installs, and nothing else. WHAT IT CARRIES. Twelve plugins - backups, computers, endpoints, guides, knowledgebase, machines, network, notifications, printers, slides, tools, warranty - plus applications, which is manifest-less core and always ships. The only manifest dependency inside that set is endpoints on computers, and both are in it, so the closure is self-contained. WHAT IT DOES NOT. employees, geenforce, measuringtools, printedparts and usb stay on the site line. So do the Windows installer tree, the VM rehearsal helpers, the agent tooling config, one site's data loader, the internal audit and findings records, and the planner spreadsheet. 1,135 tracked files against 1,438. A REMOVAL THAT BREAKS THE APP IS NOT A REMOVAL, and two nearly shipped: deploy/site-profile-universal.json still named all seventeen plugins. It is the file docs/DEPLOY.md tells a site to provision from, so a fresh install would have failed at `flask plugin apply-profile` with PluginError - the first thing a receiving site does, broken by the branch meant to serve them. It now names the twelve that exist, and its comment says the two must agree. agent/ was never refreshed. Whoever populated this branch copied shopdb/, plugins/, frontend/ and tests/ from the site line and left the agent tree at its September state: 22 C# and PowerShell sources missing, including AgentCredentials, EnrollmentService, AgentHttpFactory and the fleet-alert client, plus one file the site line had deleted still present. The old tree is internally consistent, so it compiles, and nothing in CI builds it - every gate was green over a server that speaks enrollment and per-PC credentials to a bundled agent source that cannot. Resynced whole. DECISIONS THIS ENCODES, rather than defers: - The plugin-authoring lab builds printedparts, whose manifest depends on employees, so it could not stay. The lab remains on the site line and main ships no build-along tutorial. That is a real loss for an adopting developer and is recorded here rather than discovered later. - Recognition, Training and Recertification notifications are no longer seeded. Each splits one notification into a card per employee and renders a photo, which needs a plugin this branch does not bundle. Seeding them would offer an author a type that cannot resolve anybody. A site that installs employees gets them from that plugin's own seed. - Windows/IIS is documented as the legacy path throughout, and the README leads with Docker, because that is what a receiving site gets. The API description is regenerated for THIS branch - 347 paths and 483 operations, down from 415 and 573 - so the published contract describes what is here rather than what the site line serves. docs/CONFIG.md lost the two measuring-tool label keys the code no longer declares, which two lanes had decided opposite ways. Suite: 3124 passed, 6 skipped. Naming and style gates pass. The docs gates run rather than skip, and every index line count is derived from the file it names.
This commit is contained in:
cproudlock
@@ -17,11 +17,18 @@
|
||||
# to Asset.assetnumber; the placeholder 9999 is skipped server-side.
|
||||
#
|
||||
# AUTH: the collector API does NOT honor the GE-Enforce IP allowlist (that only
|
||||
# covers the geenforce fetch/report endpoints). It needs a collector.ingest key,
|
||||
# sent as the X-API-Key header. The key is read from HKLM:\SOFTWARE\GE\ShopDB
|
||||
# CollectorKey (same secret store the GE-Enforce client uses; provisioned at
|
||||
# imaging), or overridden via the manifest entry's Args -ApiKey. Never bake the
|
||||
# key into the manifest JSON on the share.
|
||||
# covers the geenforce fetch/report endpoints). Once the endpoint agent (1.20+)
|
||||
# has enrolled this PC, its per-PC credential is read from the agent's
|
||||
# SYSTEM-only credential.bin and sent as X-Endpoint-Credential; the server then
|
||||
# refuses the shared key for this PC (401 SHARED_KEY_REFUSED). Before that, a
|
||||
# collector.ingest key is sent as the X-API-Key header, read from
|
||||
# HKLM:\SOFTWARE\GE\ShopDB CollectorKey (same secret store the GE-Enforce client
|
||||
# uses; provisioned at imaging), or overridden via the manifest entry's Args
|
||||
# -ApiKey. Never bake the key into the manifest JSON on the share.
|
||||
#
|
||||
# PINS: when HKLM:\SOFTWARE\GE\ShopDB ServerPins is set, the server's TLS key
|
||||
# must match one of them or nothing is sent. See
|
||||
# plugins/endpoints/docs/PER-PC-CREDENTIALS-ROLLOUT.md.
|
||||
#
|
||||
# Deployed in common\ (runs on EVERY shopfloor pc-type). Non-DNC bays report
|
||||
# identity with no machineNo, so no PC-to-machine link is built - by design.
|
||||
@@ -70,6 +77,271 @@ function Log([string]$msg) {
|
||||
"$ts $msg" | Tee-Object -FilePath $logFile -Append | Out-Null
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Per-PC credential and server pin. Kept in step with the same block in
|
||||
# Report-AssetToShopDB.ps1, Report-PrintersToShopDB.ps1 and
|
||||
# upgrade-shopdbagent.ps1: each runs standalone, so the text is duplicated.
|
||||
#
|
||||
# Credential: the endpoint agent (1.20+) enrolls and stores its own credential
|
||||
# in credential.bin, DPAPI LocalMachine, readable only by SYSTEM and
|
||||
# Administrators. When present it is sent as X-Endpoint-Credential and the
|
||||
# shared key is not sent. Without it the shared CollectorKey goes as X-API-Key.
|
||||
#
|
||||
# Pins: HKLM\SOFTWARE\GE\ShopDB ServerPins (REG_MULTI_SZ), lowercase hex
|
||||
# SHA-256 of the server leaf certificate's SubjectPublicKeyInfo. When any pin
|
||||
# is set the TLS handshake is accepted only if the leaf key matches one.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
$ShopDbCredentialFile = Join-Path $env:ProgramData 'ShopDB\EndpointAgent\credential\credential.bin'
|
||||
|
||||
$ShopDbPinSource = @'
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Net;
|
||||
using System.Net.Security;
|
||||
using System.Security.Cryptography;
|
||||
using System.Security.Cryptography.X509Certificates;
|
||||
|
||||
public static class ShopDbServerPinValidator
|
||||
{
|
||||
private static readonly HashSet<string> Pins = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
|
||||
public static string LastPresented;
|
||||
|
||||
public static void Install(string[] pins)
|
||||
{
|
||||
Pins.Clear();
|
||||
foreach (string pin in pins)
|
||||
{
|
||||
if (!String.IsNullOrEmpty(pin)) { Pins.Add(pin); }
|
||||
}
|
||||
ServicePointManager.ServerCertificateValidationCallback = Validate;
|
||||
}
|
||||
|
||||
public static bool Validate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors)
|
||||
{
|
||||
if (Pins.Count == 0) { return errors == SslPolicyErrors.None; }
|
||||
if (certificate == null) { return false; }
|
||||
try
|
||||
{
|
||||
LastPresented = SpkiSha256Hex(certificate.GetRawCertData());
|
||||
}
|
||||
catch (Exception)
|
||||
{
|
||||
LastPresented = null;
|
||||
return false;
|
||||
}
|
||||
return Pins.Contains(LastPresented);
|
||||
}
|
||||
|
||||
public static bool IsPinned(string pin)
|
||||
{
|
||||
return !String.IsNullOrEmpty(pin) && Pins.Contains(pin);
|
||||
}
|
||||
|
||||
// Walks the DER: Certificate > TBSCertificate > [0] version (optional),
|
||||
// serialNumber, signature, issuer, validity, subject, subjectPublicKeyInfo.
|
||||
public static string SpkiSha256Hex(byte[] der)
|
||||
{
|
||||
int length;
|
||||
int position = EnterSequence(der, 0, out length);
|
||||
position = EnterSequence(der, position, out length);
|
||||
if (der[position] == 0xA0) { position = Skip(der, position); }
|
||||
for (int field = 0; field < 5; field++) { position = Skip(der, position); }
|
||||
if (der[position] != 0x30) { throw new FormatException("SubjectPublicKeyInfo not found"); }
|
||||
int end = Skip(der, position);
|
||||
using (SHA256 sha = SHA256.Create())
|
||||
{
|
||||
byte[] hash = sha.ComputeHash(der, position, end - position);
|
||||
return BitConverter.ToString(hash).Replace("-", "").ToLowerInvariant();
|
||||
}
|
||||
}
|
||||
|
||||
private static int ReadLength(byte[] der, int position, out int length)
|
||||
{
|
||||
int first = der[position];
|
||||
if (first < 0x80) { length = first; return position + 1; }
|
||||
int count = first & 0x7F;
|
||||
if (count == 0 || count > 4) { throw new FormatException("Unsupported DER length"); }
|
||||
length = 0;
|
||||
for (int i = 1; i <= count; i++) { length = (length << 8) | der[position + i]; }
|
||||
return position + 1 + count;
|
||||
}
|
||||
|
||||
private static int EnterSequence(byte[] der, int position, out int length)
|
||||
{
|
||||
if (der[position] != 0x30) { throw new FormatException("Expected SEQUENCE"); }
|
||||
return ReadLength(der, position + 1, out length);
|
||||
}
|
||||
|
||||
private static int Skip(byte[] der, int position)
|
||||
{
|
||||
int length;
|
||||
int content = ReadLength(der, position + 1, out length);
|
||||
return content + length;
|
||||
}
|
||||
}
|
||||
'@
|
||||
|
||||
function Get-ShopDbServerPins {
|
||||
# Both registry views, like CollectorKey. Anything not 64 hex chars is dropped.
|
||||
$pins = @()
|
||||
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64, [Microsoft.Win32.RegistryView]::Registry32)) {
|
||||
try {
|
||||
$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $view)
|
||||
try {
|
||||
$key = $base.OpenSubKey('SOFTWARE\GE\ShopDB')
|
||||
if ($key) {
|
||||
try {
|
||||
foreach ($value in @($key.GetValue('ServerPins'))) {
|
||||
if ($null -eq $value) { continue }
|
||||
$pin = ([string]$value -replace '[\s:]', '').ToLowerInvariant()
|
||||
if ($pin -match '^[0-9a-f]{64}$' -and $pins -notcontains $pin) { $pins += $pin }
|
||||
}
|
||||
} finally { $key.Dispose() }
|
||||
}
|
||||
} finally { $base.Dispose() }
|
||||
} catch {}
|
||||
}
|
||||
return ,$pins
|
||||
}
|
||||
|
||||
function Test-ShopDbServerPinsValue {
|
||||
# True when ServerPins exists in either registry view, even empty. The
|
||||
# registry then owns the pin list and appsettings pins are ignored, the
|
||||
# same rule the agent follows.
|
||||
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64, [Microsoft.Win32.RegistryView]::Registry32)) {
|
||||
try {
|
||||
$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $view)
|
||||
try {
|
||||
$key = $base.OpenSubKey('SOFTWARE\GE\ShopDB')
|
||||
if ($key) {
|
||||
try {
|
||||
if ($key.GetValueNames() -contains 'ServerPins') { return $true }
|
||||
} finally { $key.Dispose() }
|
||||
}
|
||||
} finally { $base.Dispose() }
|
||||
} catch {}
|
||||
}
|
||||
return $false
|
||||
}
|
||||
|
||||
function Enable-ShopDbServerPins([string[]]$Pins) {
|
||||
# True when pinning is active. False means pins are set but could not be
|
||||
# enforced; the caller must not send anything then.
|
||||
if ($PSVersionTable.PSEdition -eq 'Core') {
|
||||
# PowerShell 7 web cmdlets ignore ServicePointManager, so the check
|
||||
# would silently not happen.
|
||||
Log 'ERROR ServerPins is set; pin checking needs Windows PowerShell 5.1 (powershell.exe), not pwsh'
|
||||
return $false
|
||||
}
|
||||
try {
|
||||
if (-not ('ShopDbServerPinValidator' -as [type])) {
|
||||
Add-Type -TypeDefinition $ShopDbPinSource -ErrorAction Stop
|
||||
}
|
||||
[ShopDbServerPinValidator]::Install($Pins)
|
||||
return $true
|
||||
} catch {
|
||||
Log "ERROR ServerPins is set but pin checking could not be enabled: $($_.Exception.Message)"
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
function Get-ShopDbEndpointCredential([string]$TargetUrl) {
|
||||
# Empty when there is none or it cannot be used for this URL.
|
||||
if (-not (Test-Path -LiteralPath $ShopDbCredentialFile)) { return '' }
|
||||
try {
|
||||
Add-Type -AssemblyName System.Security -ErrorAction Stop
|
||||
$protected = [System.IO.File]::ReadAllBytes($ShopDbCredentialFile)
|
||||
$plain = [System.Security.Cryptography.ProtectedData]::Unprotect(
|
||||
$protected, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
|
||||
$record = [System.Text.Encoding]::UTF8.GetString($plain) | ConvertFrom-Json
|
||||
} catch {
|
||||
Log "WARN could not read the endpoint credential ($ShopDbCredentialFile): $($_.Exception.Message)"
|
||||
return ''
|
||||
}
|
||||
$credential = [string]$record.credential
|
||||
if (-not $credential.StartsWith('sdbe_')) {
|
||||
Log 'WARN endpoint credential file has no usable credential; ignoring it'
|
||||
return ''
|
||||
}
|
||||
if (-not $TargetUrl.StartsWith('https://', [System.StringComparison]::OrdinalIgnoreCase)) {
|
||||
Log "WARN not sending the endpoint credential over a non-https URL ($TargetUrl)"
|
||||
return ''
|
||||
}
|
||||
# Never hand a credential to a server other than the one that issued it.
|
||||
$issuer = ([string]$record.baseurl).Trim().TrimEnd('/')
|
||||
if ($issuer -and -not ($TargetUrl.TrimEnd('/') + '/').StartsWith($issuer + '/', [System.StringComparison]::OrdinalIgnoreCase)) {
|
||||
Log "WARN endpoint credential was issued by $issuer, not the target $TargetUrl; not sending it"
|
||||
return ''
|
||||
}
|
||||
return $credential
|
||||
}
|
||||
|
||||
function Get-ShopDbHttpFailure($ErrorRecord) {
|
||||
# Status and error envelope code (data.error.code) from a failed request.
|
||||
$status = 0
|
||||
$code = ''
|
||||
$text = ''
|
||||
try { $status = [int]$ErrorRecord.Exception.Response.StatusCode } catch {}
|
||||
if ($ErrorRecord.ErrorDetails -and $ErrorRecord.ErrorDetails.Message) {
|
||||
$text = $ErrorRecord.ErrorDetails.Message
|
||||
} else {
|
||||
try {
|
||||
$reader = New-Object System.IO.StreamReader($ErrorRecord.Exception.Response.GetResponseStream())
|
||||
$text = $reader.ReadToEnd()
|
||||
$reader.Dispose()
|
||||
} catch {}
|
||||
}
|
||||
if ($text) {
|
||||
try { $code = [string](($text | ConvertFrom-Json).data.error.code) } catch {}
|
||||
}
|
||||
$presented = ''
|
||||
$matched = $false
|
||||
if ('ShopDbServerPinValidator' -as [type]) {
|
||||
$presented = [string][ShopDbServerPinValidator]::LastPresented
|
||||
$matched = [ShopDbServerPinValidator]::IsPinned($presented)
|
||||
}
|
||||
# Innermost exception text: the outer WebException hides the real cause
|
||||
# (unexpected EOF, connection reset, trust failure).
|
||||
$message = ''
|
||||
$exception = $ErrorRecord.Exception
|
||||
while ($exception) {
|
||||
if ($exception.Message) { $message = $exception.Message }
|
||||
$exception = $exception.InnerException
|
||||
}
|
||||
return @{ Status = $status; Code = $code; PresentedPin = $presented; PinMatched = $matched; Message = $message }
|
||||
}
|
||||
|
||||
function Write-ShopDbAuthFailure($Failure) {
|
||||
switch ($Failure.Code) {
|
||||
'CREDENTIAL_INVALID' {
|
||||
Log ('ERROR 401 CREDENTIAL_INVALID: the server does not accept this PC''s endpoint credential ' +
|
||||
'(revoked or unknown). The endpoint agent deletes it and re-enrolls on its own.')
|
||||
}
|
||||
'SHARED_KEY_REFUSED' {
|
||||
Log ('ERROR 401 SHARED_KEY_REFUSED: the server refuses the shared key for this PC, because ' +
|
||||
'the PC is enrolled or the shared key is switched off. Reports need the endpoint agent ' +
|
||||
"credential: check agent 1.20+ is installed, running and enrolled ($ShopDbCredentialFile).")
|
||||
}
|
||||
'ASSET_MISMATCH' {
|
||||
Log ('ERROR 403 ASSET_MISMATCH: this PC''s credential belongs to a different asset than the ' +
|
||||
'hostname in the report. Check the hostname and the enrollment in ShopDB.')
|
||||
}
|
||||
default {
|
||||
if ($Failure.Status -eq 0 -and $Failure.PresentedPin) {
|
||||
# A pin was seen, but only an absent pin is a pin failure. A
|
||||
# matched pin means the handshake passed and something later
|
||||
# failed (server dropped mid-transfer, timeout).
|
||||
if ($Failure.PinMatched) {
|
||||
Log "ERROR request failed after the server key pin matched ($($Failure.PresentedPin)): $($Failure.Message)"
|
||||
} else {
|
||||
Log "ERROR TLS refused: server key pin $($Failure.PresentedPin) is not in ServerPins"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Server from the GE-Enforce config hive when not passed via Args. Any site
|
||||
# running this script is running the enforcement client, which cannot work
|
||||
# without BaseUrl, so it is present wherever this is deployed.
|
||||
@@ -102,11 +374,21 @@ if (-not $ApiKey) {
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
if (-not $ApiKey) {
|
||||
Log 'ERROR no collector key (HKLM:\SOFTWARE\GE\ShopDB CollectorKey or -ApiKey). Skipping.'
|
||||
$EndpointCredential = Get-ShopDbEndpointCredential $ApiUrl
|
||||
if (-not $EndpointCredential -and -not $ApiKey) {
|
||||
Log 'ERROR no endpoint credential and no collector key (HKLM:\SOFTWARE\GE\ShopDB CollectorKey or -ApiKey). Skipping.'
|
||||
exit 0
|
||||
}
|
||||
|
||||
$serverPins = Get-ShopDbServerPins
|
||||
if ($serverPins.Count -gt 0) {
|
||||
if (-not (Enable-ShopDbServerPins $serverPins)) {
|
||||
Log 'ERROR refusing to report without the server pin check. Skipping.'
|
||||
exit 0
|
||||
}
|
||||
Log "server pin check on ($($serverPins.Count) pin(s))"
|
||||
}
|
||||
|
||||
# -AllowedRanges and the CollectorRanges registry value are ACCEPTED AND
|
||||
# IGNORED. Deciding which NIC is the PC's address moved to the server, where
|
||||
# the site's addressing actually lives: this script now reports every NIC and
|
||||
@@ -326,14 +608,27 @@ $json = $body | ConvertTo-Json -Compress -Depth 4
|
||||
Log ("POST {0} host={1} serial={2} pcType={3} make={4} model={5} os={6} boot={7} machineNo={8} user={9} ip={10} deviceId={11}" -f `
|
||||
$ApiUrl, $hostname, $serialNumber, $pcType, $manufacturer, $model, $osVersion, $lastBootTime, $machineNo, $loggedInUser, $corpIp, $deviceId)
|
||||
|
||||
try {
|
||||
$resp = Invoke-RestMethod -Uri $ApiUrl -Method Post -Body $json `
|
||||
-ContentType 'application/json' `
|
||||
-Headers @{ 'X-API-Key' = $ApiKey } `
|
||||
-TimeoutSec $TimeoutSec -ErrorAction Stop
|
||||
Log ("RESPONSE {0}" -f ($resp | ConvertTo-Json -Compress -Depth 4))
|
||||
} catch {
|
||||
Log "ERROR POST failed: $($_.Exception.Message)"
|
||||
# Credential first; the shared key only when there is no credential, or when
|
||||
# the server has just refused the credential (revoked: the shared key is
|
||||
# admitted again for this PC until the agent re-enrolls). Never both at once.
|
||||
$attempts = @()
|
||||
if ($EndpointCredential) { $attempts += ,@('credential', @{ 'X-Endpoint-Credential' = $EndpointCredential }) }
|
||||
if ($ApiKey) { $attempts += ,@('shared key', @{ 'X-API-Key' = $ApiKey }) }
|
||||
|
||||
foreach ($attempt in $attempts) {
|
||||
try {
|
||||
$resp = Invoke-RestMethod -Uri $ApiUrl -Method Post -Body $json `
|
||||
-ContentType 'application/json' `
|
||||
-Headers $attempt[1] `
|
||||
-TimeoutSec $TimeoutSec -ErrorAction Stop
|
||||
Log ("RESPONSE ({0}) {1}" -f $attempt[0], ($resp | ConvertTo-Json -Compress -Depth 4))
|
||||
break
|
||||
} catch {
|
||||
Log "ERROR POST with $($attempt[0]) failed: $($_.Exception.Message)"
|
||||
$failure = Get-ShopDbHttpFailure $_
|
||||
Write-ShopDbAuthFailure $failure
|
||||
if ($failure.Code -ne 'CREDENTIAL_INVALID') { break }
|
||||
}
|
||||
}
|
||||
|
||||
exit 0
|
||||
|
||||
264
plugins/computers/client/Set-ShopDBDeviceId.ps1
Normal file
264
plugins/computers/client/Set-ShopDBDeviceId.ps1
Normal file
@@ -0,0 +1,264 @@
|
||||
#requires -Version 5.1
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Seed HKLM:\SOFTWARE\GE\ShopDB\DeviceId from whatever identity a bay already
|
||||
carries, so device identity can move off C:\Enrollment and into the
|
||||
registry.
|
||||
|
||||
.DESCRIPTION
|
||||
Phase 3 of docs/proposals/device-identity.md. The registry is the
|
||||
destination because it survives the profile cleanup and disk hygiene that
|
||||
eats C:\Enrollment, is readable as SYSTEM with no file ACL to get wrong, and
|
||||
is already where the collector looks for BaseUrl and ApiToken.
|
||||
|
||||
This script does the one-time backfill: it reads the identity a bay holds
|
||||
today and writes it to DeviceId. It is idempotent and safe to run every
|
||||
GE-Enforce cycle.
|
||||
|
||||
THE SOURCE DEPENDS ON THE PC TYPE, AND THAT IS THE WHOLE POINT.
|
||||
|
||||
DeviceId names the DEVICE hanging off this PC. A machine number is a
|
||||
different fact - "which bay is this" rather than "which device is this" -
|
||||
and the two coincide for exactly one family:
|
||||
|
||||
CMM bays the machine number IS the instrument id (CMM4), which is
|
||||
why cmmid.txt has always doubled as identity. Copying it
|
||||
is correct.
|
||||
|
||||
part markers the machine number is the OPERATION (0613), and several
|
||||
markers serve one operation. Copying it would name the
|
||||
operation as the device. The collector refuses that
|
||||
("asset X is not a Part Marker; not linked") because a
|
||||
machine filed under a device label reads as a marker
|
||||
everywhere downstream. So machine number is NEVER a
|
||||
source here.
|
||||
|
||||
Keyence, no per-bay id exists at all. asset-id.txt is the only
|
||||
Genspect, identity these have ever had.
|
||||
wax-trace
|
||||
|
||||
everything not a device bay. DeviceId is not consumed for these
|
||||
else pc-types, so writing one is a landmine for the day that
|
||||
pc-type gains a device spec. Writes nothing.
|
||||
|
||||
9999 is the unassigned placeholder and is skipped everywhere, matching
|
||||
Report-AssetToShopDB.ps1 and the server.
|
||||
|
||||
.PARAMETER Force
|
||||
Overwrite a DeviceId that is already set to a DIFFERENT value.
|
||||
|
||||
Off by default on purpose. asset-id.txt is written ONCE at imaging and
|
||||
nothing updates it when a device is swapped, so a stale file overwriting a
|
||||
corrected registry value would re-introduce the exact defect this move is
|
||||
meant to fix. A disagreement is reported and left alone for a human.
|
||||
|
||||
.PARAMETER PCType
|
||||
Override the pc-type instead of reading C:\Enrollment\pc-type.txt. For
|
||||
testing and for a bay whose file is missing.
|
||||
|
||||
.PARAMETER DeviceId
|
||||
Write this value directly, skipping resolution. Still honours -Force and
|
||||
the 9999 rule.
|
||||
|
||||
.PARAMETER LogPath
|
||||
Append a transcript here as well as writing to the pipeline.
|
||||
|
||||
.EXAMPLE
|
||||
.\Set-ShopDBDeviceId.ps1 -WhatIf
|
||||
Show what would be written on this bay without touching the registry.
|
||||
|
||||
.EXAMPLE
|
||||
.\Set-ShopDBDeviceId.ps1
|
||||
Seed DeviceId. Safe to run repeatedly and from a GE-Enforce PS1 entry.
|
||||
|
||||
.NOTES
|
||||
Exit codes:
|
||||
0 wrote a value, it was already correct, or this is not a device bay
|
||||
1 an error stopped the write
|
||||
2 an existing DeviceId disagrees with the resolved value; needs a human
|
||||
or -Force
|
||||
#>
|
||||
[CmdletBinding(SupportsShouldProcess = $true)]
|
||||
param(
|
||||
[switch]$Force,
|
||||
[string]$PCType,
|
||||
[string]$DeviceId,
|
||||
[string]$LogPath
|
||||
)
|
||||
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
$RegPath = 'HKLM:\SOFTWARE\GE\ShopDB'
|
||||
$RegValueName = 'DeviceId'
|
||||
$Placeholder = '9999'
|
||||
|
||||
function Log {
|
||||
param([string]$Message)
|
||||
$line = "{0} [Set-ShopDBDeviceId] {1}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $Message
|
||||
Write-Output $line
|
||||
if ($LogPath) {
|
||||
try { Add-Content -LiteralPath $LogPath -Value $line -ErrorAction Stop } catch { }
|
||||
}
|
||||
}
|
||||
|
||||
function Read-FirstLine {
|
||||
# One line, trimmed, empty when absent or unreadable. A bay missing a file
|
||||
# is the normal case, not an error.
|
||||
param([string]$Path)
|
||||
if (-not (Test-Path -LiteralPath $Path)) { return '' }
|
||||
try {
|
||||
$v = [string](Get-Content -LiteralPath $Path -First 1 -ErrorAction Stop)
|
||||
return $v.Trim()
|
||||
} catch {
|
||||
Log "WARN could not read ${Path}: $($_.Exception.Message)"
|
||||
return ''
|
||||
}
|
||||
}
|
||||
|
||||
function Get-MachineNoFromRegistry {
|
||||
# eDNC/NTLARS, WOW6432Node first, matching Report-AssetToShopDB.ps1.
|
||||
foreach ($rp in @(
|
||||
'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General',
|
||||
'HKLM:\SOFTWARE\GE Aircraft Engines\DNC\General'
|
||||
)) {
|
||||
try {
|
||||
if (Test-Path $rp) {
|
||||
$v = [string](Get-ItemProperty -Path $rp -Name MachineNo -ErrorAction Stop).MachineNo
|
||||
if ($v) {
|
||||
$v = $v.Trim()
|
||||
if ($v -and $v -ne $Placeholder) { return $v }
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
Log "WARN could not read MachineNo from ${rp}: $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
return ''
|
||||
}
|
||||
|
||||
# Which pc-types drive a device, and whether the machine number is a legitimate
|
||||
# identity for that device. Mirrors SUBORDINATE_DEVICE_MAP in
|
||||
# plugins/computers/pctypemap.py. A site that added its own device pc-type
|
||||
# through a subordinatedevice_<pctype> setting adds it here too.
|
||||
$DeviceFamilies = @{
|
||||
'gea-shopfloor-cmm' = @{ Label = 'CMM'; MachineNoIsDevice = $true }
|
||||
'gea-shopfloor-keyence' = @{ Label = 'Vision System'; MachineNoIsDevice = $false }
|
||||
'gea-shopfloor-genspect' = @{ Label = 'Genspect'; MachineNoIsDevice = $false }
|
||||
'gea-shopfloor-waxtrace' = @{ Label = 'Form Tracer'; MachineNoIsDevice = $false }
|
||||
'gea-shopfloor-partmarker'= @{ Label = 'Part Marker'; MachineNoIsDevice = $false }
|
||||
}
|
||||
|
||||
# --- 1. what kind of bay is this -------------------------------------------
|
||||
|
||||
if (-not $PCType) { $PCType = Read-FirstLine 'C:\Enrollment\pc-type.txt' }
|
||||
|
||||
if (-not $PCType) {
|
||||
Log 'no pc-type on this PC (C:\Enrollment\pc-type.txt missing or empty); nothing to do'
|
||||
exit 0
|
||||
}
|
||||
|
||||
if (-not $DeviceFamilies.ContainsKey($PCType)) {
|
||||
Log "pc-type '$PCType' does not drive a device; DeviceId not written"
|
||||
exit 0
|
||||
}
|
||||
|
||||
$family = $DeviceFamilies[$PCType]
|
||||
Log "pc-type '$PCType' drives a $($family.Label)"
|
||||
|
||||
# --- 2. resolve the identity ------------------------------------------------
|
||||
|
||||
$resolved = ''
|
||||
$source = ''
|
||||
|
||||
if ($DeviceId) {
|
||||
$resolved = $DeviceId.Trim()
|
||||
$source = '-DeviceId parameter'
|
||||
} else {
|
||||
# Most stable identity first, and the machine number only where it really
|
||||
# names the device.
|
||||
if ($family.MachineNoIsDevice) {
|
||||
$v = Read-FirstLine 'C:\Enrollment\cmm\cmmid.txt'
|
||||
if ($v -and $v -ne $Placeholder) { $resolved = $v; $source = 'C:\Enrollment\cmm\cmmid.txt' }
|
||||
|
||||
if (-not $resolved) {
|
||||
$v = Get-MachineNoFromRegistry
|
||||
if ($v) { $resolved = $v; $source = 'eDNC MachineNo registry' }
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $resolved) {
|
||||
$v = Read-FirstLine 'C:\Enrollment\asset-id.txt'
|
||||
if ($v -and $v -ne $Placeholder) { $resolved = $v; $source = 'C:\Enrollment\asset-id.txt' }
|
||||
}
|
||||
|
||||
if (-not $resolved) {
|
||||
# The 0.12.0 name, before the file was generalised.
|
||||
$v = Read-FirstLine 'C:\Enrollment\measuringtool-id.txt'
|
||||
if ($v -and $v -ne $Placeholder) { $resolved = $v; $source = 'C:\Enrollment\measuringtool-id.txt' }
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $resolved) {
|
||||
# Nothing to copy. Silence is the right answer: the collector still adopts
|
||||
# or mints as it does today, and inventing a value here would name a device
|
||||
# that nobody can account for.
|
||||
Log "no identity found for this $($family.Label) bay; DeviceId not written"
|
||||
exit 0
|
||||
}
|
||||
|
||||
if ($resolved -eq $Placeholder) {
|
||||
Log "resolved value is the $Placeholder placeholder; DeviceId not written"
|
||||
exit 0
|
||||
}
|
||||
|
||||
Log "resolved DeviceId '$resolved' from $source"
|
||||
|
||||
# --- 3. write it ------------------------------------------------------------
|
||||
|
||||
$existing = ''
|
||||
try {
|
||||
if (Test-Path $RegPath) {
|
||||
$prop = Get-ItemProperty -Path $RegPath -Name $RegValueName -ErrorAction SilentlyContinue
|
||||
if ($prop) { $existing = [string]$prop.$RegValueName; $existing = $existing.Trim() }
|
||||
}
|
||||
} catch {
|
||||
Log "WARN could not read existing ${RegValueName}: $($_.Exception.Message)"
|
||||
}
|
||||
|
||||
if ($existing -eq $resolved) {
|
||||
Log "DeviceId already '$resolved'; nothing to do"
|
||||
exit 0
|
||||
}
|
||||
|
||||
if ($existing -and -not $Force) {
|
||||
# The registry value wins by default. C:\Enrollment is written once at
|
||||
# imaging and never updated on a device swap, so the file is the more
|
||||
# likely one to be wrong.
|
||||
Log "REFUSING to overwrite: DeviceId is '$existing', $source says '$resolved'"
|
||||
Log 'Re-run with -Force if the file is right, or fix the file if the registry is.'
|
||||
exit 2
|
||||
}
|
||||
|
||||
try {
|
||||
if (-not (Test-Path $RegPath)) {
|
||||
if ($PSCmdlet.ShouldProcess($RegPath, 'Create registry key')) {
|
||||
New-Item -Path $RegPath -Force | Out-Null
|
||||
Log "created $RegPath"
|
||||
}
|
||||
}
|
||||
$action = if ($existing) { "Set $RegValueName '$existing' -> '$resolved'" }
|
||||
else { "Set $RegValueName '$resolved'" }
|
||||
if ($PSCmdlet.ShouldProcess($RegPath, $action)) {
|
||||
New-ItemProperty -Path $RegPath -Name $RegValueName -Value $resolved `
|
||||
-PropertyType String -Force | Out-Null
|
||||
Log "wrote $RegPath\$RegValueName = '$resolved'"
|
||||
} else {
|
||||
Log "WHATIF would write $RegPath\$RegValueName = '$resolved'"
|
||||
}
|
||||
} catch {
|
||||
Log "ERROR could not write ${RegValueName}: $($_.Exception.Message)"
|
||||
exit 1
|
||||
}
|
||||
|
||||
exit 0
|
||||
Reference in New Issue
Block a user