|
|
|
|
# Lab acceptance of 5.0.0-rc6
|
|
|
|
|
|
|
|
|
|
Acceptance of the release candidate 5.0.0-rc6 in the lab, on 2026-10-08,
|
|
|
|
|
before the pull request. It follows the procedure in the
|
|
|
|
|
[README](README.md#acceptance-of-a-release-candidate).
|
|
|
|
|
|
|
|
|
|
The candidate changed twice during the acceptance. The run of `acfe3af`
|
|
|
|
|
passed; the coverage report of the candidate then found three defects,
|
|
|
|
|
which `0df2482` and `1b9edbb` fix, and the run of `1b9edbb` passed as
|
|
|
|
|
well; a second review led to `7b0781f`. This record describes the run of
|
|
|
|
|
`7b0781f`, the last commit of the pull request that changes the module,
|
|
|
|
|
and names the results of the earlier runs.
|
|
|
|
|
|
|
|
|
|
## Candidate
|
|
|
|
|
|
|
|
|
|
- Branch `ai/release-5.0.0-rc6`, commit
|
|
|
|
|
`7b0781ff8bb2c1ee4087a16411acd4c7070ba1fa`, 31 commits on `fcb370e`
|
|
|
|
|
(5.0.0-rc5).
|
|
|
|
|
- Release build of that commit, packaged with
|
|
|
|
|
`.github\scripts\New-ModulePackage.ps1`. The live tests imported the
|
|
|
|
|
module from the extracted `NTFSSecurity.zip`. CI builds the packages that
|
|
|
|
|
the tag publishes again, so their hashes differ; the live tests run once
|
|
|
|
|
more against the published package.
|
|
|
|
|
|
|
|
|
|
| SHA-256 | File |
|
|
|
|
|
| --- | --- |
|
|
|
|
|
| `E99B5123F45E4F56AC005C629C2241DC616B2AAC152C17EA57A67C0823FFCA10` | `NTFSSecurity.5.0.0-rc6.nupkg` |
|
|
|
|
|
| `53C020EAD59467A407ED755F3D9296E9C70AFFAB184CF9CDF27AF92117FBBEE0` | `NTFSSecurity.zip` |
|
|
|
|
|
| `F438D7FDB3F5A1D75F5CA48D7B610EED31215FF1BF9C185C6856AA365D195C8D` | `NTFSSecurity\NTFSSecurity.dll` |
|
|
|
|
|
| `EE1B0DF9619C998A4482F3F79DCB2191BBEAD859660D6D924D1F333DBE7CBBCE` | `NTFSSecurity\Security2.dll` |
|
|
|
|
|
| `902157ABBD2E0B76DA744A918BDD174D5226C3494908ABA75F9E5DE28AE6A008` | `NTFSSecurity\ProcessPrivileges.dll` |
|
|
|
|
|
| `E2077AFEB38703345AE7857C1266F8B26E167ED887BFFAC8C8169A8F267BE6E9` | `NTFSSecurity\PrivilegeControl.dll` |
|
|
|
|
|
| `A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8` | `NTFSSecurity\AlphaFS.dll` |
|
|
|
|
|
| `75DA9F7A54DF7011968BACB3FDF5E30B33F4C078861D1DF87BC06F5E64A962D8` | `NTFSSecurity\NTFSSecurity.psd1` |
|
|
|
|
|
| `3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8` | `NTFSSecurity\NTFSSecurity.psm1` |
|
|
|
|
|
| `59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC` | `NTFSSecurity\NTFSSecurity.Init.ps1` |
|
|
|
|
|
| `FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197` | `NTFSSecurity\NTFSSecurity.format.ps1xml` |
|
|
|
|
|
| `CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B` | `NTFSSecurity\NTFSSecurity.types.ps1xml` |
|
|
|
|
|
| `5115D0D76CA2A06795CD754539AC7EC19A70591E8C5616E7BEB5AE66E6971E6D` | `NTFSSecurity\en-US\NTFSSecurity.dll-Help.xml` |
|
|
|
|
|
|
|
|
|
|
## Tests without a lab
|
|
|
|
|
|
|
|
|
|
The Pester suite of the commit, 684 tests, against the same build. No test
|
|
|
|
|
failed, and every test ran in at least one configuration.
|
|
|
|
|
|
|
|
|
|
| Configuration | Passed | Failed | Skipped |
|
|
|
|
|
| --- | ---: | ---: | ---: |
|
|
|
|
|
| Windows PowerShell 5.1, elevated | 662 | 0 | 22 |
|
|
|
|
|
| PowerShell 7, elevated | 632 | 0 | 52 |
|
|
|
|
|
| Windows PowerShell 5.1, basic user | 590 | 0 | 94 |
|
|
|
|
|
| PowerShell 7, basic user | 560 | 0 | 124 |
|
|
|
|
|
|
|
|
|
|
The C# coverage of the four configurations, measured with AltCover on
|
|
|
|
|
`1b9edbb`: 68.1% of the lines and 44.3% of the branches.
|
|
|
|
|
|
|
|
|
|
## Lab
|
|
|
|
|
|
|
|
|
|
`WindowsAccessControlLab` (AutomatedLab on Hyper-V). Every machine runs
|
|
|
|
|
Windows Server 2025 Datacenter (10.0.26100).
|
|
|
|
|
|
|
|
|
|
| Machine | Domain | Role in the tests |
|
|
|
|
|
| --- | --- | --- |
|
|
|
|
|
| `F1ADC1` | `a.forest1.net` | Domain controller of the accounts |
|
|
|
|
|
| `F1AFile1` | `a.forest1.net` | Client that runs the tests |
|
|
|
|
|
| `F1AFile2` | `a.forest1.net` | File server with the share |
|
|
|
|
|
| `F1BDC1` | `b.forest1.net` | Account of another domain of the forest |
|
|
|
|
|
| `F2DC1` | `forest2.net` | Account of another forest |
|
|
|
|
|
| `F3DC1` | `forest3.net` | Account of another forest |
|
|
|
|
|
|
|
|
|
|
Readiness, checked before each run: WinRM answered on all six machines.
|
|
|
|
|
The four domain controllers answered LDAP (RootDSE, synchronized) and
|
|
|
|
|
issued a Kerberos ticket for `krbtgt`. The client and the file server
|
|
|
|
|
found a domain controller, had a working secure channel, and got a service
|
|
|
|
|
ticket for each other. The clocks were 4.3 to 5.0 seconds ahead of the
|
|
|
|
|
host.
|
|
|
|
|
|
|
|
|
|
Checkpoints (Production) of the six machines, taken before each run:
|
|
|
|
|
`ntfs-rc6-acfe3af-before-acceptance` (11:07 UTC),
|
|
|
|
|
`ntfs-rc6-1b9edbb-before-acceptance` (12:21 UTC), and
|
|
|
|
|
`ntfs-rc6-7b0781f-before-acceptance` (12:50 UTC).
|
|
|
|
|
|
|
|
|
|
## Results
|
|
|
|
|
|
|
|
|
|
`Invoke-NTFSSecurityLabTest.ps1 -ModulePath <extracted package>` in both
|
|
|
|
|
editions, 12:51 to 13:07 UTC. The module reported version 5.0.0-rc6 in
|
|
|
|
|
every role that loads it.
|
|
|
|
|
|
|
|
|
|
| Edition | Role | Passed | Failed | Skipped |
|
|
|
|
|
| --- | --- | ---: | ---: | ---: |
|
|
|
|
|
| Windows PowerShell 5.1 | Delegate | 38 | 0 | 0 |
|
|
|
|
|
| Windows PowerShell 5.1 | ServerAdmin | 13 | 0 | 0 |
|
|
|
|
|
| Windows PowerShell 5.1 | Admin | 40 | 0 | 0 |
|
|
|
|
|
| Windows PowerShell 5.1 | Server | 72 | 0 | 1 |
|
|
|
|
|
| PowerShell 7 | Delegate | 38 | 0 | 0 |
|
|
|
|
|
| PowerShell 7 | ServerAdmin | 13 | 0 | 0 |
|
|
|
|
|
| PowerShell 7 | Admin | 40 | 0 | 0 |
|
|
|
|
|
| PowerShell 7 | Server | 72 | 0 | 1 |
|
|
|
|
|
|
|
|
|
|
The role Server skips the check of the module version, because it doesn't
|
|
|
|
|
load the module. The accounts of the other domain and forests were
|
|
|
|
|
`B\NtfsLiveForeign`, `forest2\NtfsLiveForeign`, and
|
|
|
|
|
`forest3\NtfsLiveForeign`; their 13 tests passed in both editions.
|
|
|
|
|
|
|
|
|
|
The earlier runs had the same counts and no failure: `acfe3af` from 11:08
|
|
|
|
|
to 11:25 UTC, and `1b9edbb` from 12:23 to 12:39 UTC.
|
|
|
|
|
|
|
|
|
|
## Baseline
|
|
|
|
|
|
|
|
|
|
The published 5.0.0-rc5 from the PowerShell Gallery, whose hash the script
|
|
|
|
|
checks against the one the Gallery publishes, in Windows PowerShell 5.1,
|
|
|
|
|
11:26 to 11:34 UTC: Delegate 38 passed, ServerAdmin 13, Admin 38 passed and
|
|
|
|
|
2 failed, Server 72 passed and 1 skipped. The two failures are the defect
|
|
|
|
|
that 5.0.0-rc6 fixes: on the share, `Get-NTFSHardLink` and
|
|
|
|
|
`New-NTFSHardLink -PassThru` stopped with the terminating error "(50) The
|
|
|
|
|
request is not supported" instead of writing a `GetHardLinkError`. The new
|
|
|
|
|
cases find no other difference between the two versions; the local tests
|
|
|
|
|
cover the other fixes of 5.0.0-rc6.
|
|
|
|
|
|
|
|
|
|
## Cleanup
|
|
|
|
|
|
|
|
|
|
`Invoke-NTFSSecurityLabTest.ps1 -RemoveFixture` after each run: at 11:38
|
|
|
|
|
UTC after the first run and the baseline, at 12:48 UTC after the second,
|
|
|
|
|
and at 13:09 UTC after the third. Each check compared the lab with the 10
|
|
|
|
|
SIDs of the fixture's accounts and groups, read before the removal; the
|
|
|
|
|
same check had found the fixture before the first removal. After each
|
|
|
|
|
removal:
|
|
|
|
|
|
|
|
|
|
- No domain has the organizational unit `NTFSSecurityLive` or an account
|
|
|
|
|
whose name starts with `NtfsLive`.
|
|
|
|
|
- The file server has no share `NTFSSecurityLive`, no folder
|
|
|
|
|
`C:\NTFSSecurityLive` or `C:\NTFSSecurityLab`, and no local group
|
|
|
|
|
`NtfsLiveLocal`.
|
|
|
|
|
- The client has no folder `C:\NTFSSecurityLab`.
|
|
|
|
|
- On both machines, Administrators, Access Control Assistance Operators,
|
|
|
|
|
and Remote Management Users have no member of the fixture, and no
|
|
|
|
|
profile of the fixture's accounts is left.
|
|
|
|
|
|
|
|
|
|
The three checkpoints stay on the six machines until the maintainer
|
|
|
|
|
deletes them.
|
|
|
|
|
|
|
|
|
|
## Not covered
|
|
|
|
|
|
|
|
|
|
- Other operating systems than Windows Server 2025, such as a Windows 11
|
|
|
|
|
client and Server 2019 or 2022 file servers: Phase 3 of the quality
|
|
|
|
|
gate.
|
|
|
|
|
- File servers that aren't Windows, such as the IBM ESS system of #34:
|
|
|
|
|
only the feedback of the reporter covers them.
|
|
|
|
|
|
|
|
|
|
## After the release
|
|
|
|
|
|
|
|
|
|
The tag `5.0.0-rc6` on `b51d970`, the merge of #115, published the package
|
|
|
|
|
to the PowerShell Gallery on 2026-10-08 at 20:40 UTC. The **Release** job
|
|
|
|
|
failed after the upload: `Publish-PSResource` stopped waiting for the
|
|
|
|
|
Gallery after 100 seconds while the Gallery accepted the package, and its
|
|
|
|
|
second attempt got the error 409, "already exists". So the job didn't
|
|
|
|
|
create the GitHub release; rerunning the failed job creates it, as
|
|
|
|
|
[If a release fails](../../Docs/Contributing/05-Releasing.md#if-a-release-fails)
|
|
|
|
|
describes.
|
|
|
|
|
|
|
|
|
|
`Invoke-NTFSSecurityLabTest.ps1 -Version 5.0.0-rc6` downloaded the package
|
|
|
|
|
from the Gallery, checked it against the SHA-512 that the Gallery
|
|
|
|
|
publishes, and ran in both editions, 20:43 to 21:00 UTC. The SHA-256 of
|
|
|
|
|
`NTFSSecurity.5.0.0-rc6.nupkg` is
|
|
|
|
|
`83EBCADEE0698A9523661352A69B9D25F6EB2903F45A6C4FAB36F5BF4B139100`.
|
|
|
|
|
|
|
|
|
|
The live tests came from the branch of 5.0.0-rc7, which expects the
|
|
|
|
|
warning of `Get-NTFSEffectiveAccess` for a computer that can't be reached
|
|
|
|
|
to name the computer. The package failed only that test, in the role Admin
|
|
|
|
|
of both editions, with exactly the text that the live tests of 5.0.0-rc6
|
|
|
|
|
expect; every other test passed: Delegate 38, ServerAdmin 13, Admin 39,
|
|
|
|
|
and Server 72 with 1 skipped, in each edition. The fixture was removed at
|
|
|
|
|
21:03 UTC, and its removal checked as above.
|
