From b39eeac0e7d3be5aea462362ce224cfe2eb7f007 Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Tue, 20 Oct 2026 11:59:18 +0000 Subject: [PATCH] test(lab): record the acceptance of the published 5.0.0-rc8 The published rc8 passed the identity check (tag, CI run, Gallery hash, GitHub zip), the three cells of the operating-system matrix (1,374 passed, 0 failed, 12 skipped, every end state CLEAN), the module's own suite on six machine classes (24 runs, 0 failed, the same skipped tests as the host), and the first lab with case 9 (245 passed, 0 failed, 1 skipped per edition, CLEAN). The counts of the live controller equal those of the published rc7, and the live tests and the controller are the same Git blobs, so the cells measure the changed module. The record also shows that the boundary of the new GetEffectiveAccessError, a computer name of 32,718 characters, holds on Windows Server 2019, 2022, and 2025 and on Windows 11 26H1, which backs the wording of the CHANGELOG and the cmdlet page. The four tables follow the record of the published rc7. The README names the record and says that saved machines are restored first, the domain controllers before the others. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- ...eptance-2026-10-20-published-rc8-Cells.csv | 25 ++ ...ance-2026-10-20-published-rc8-FirstLab.csv | 9 + ...ce-2026-10-20-published-rc8-LocalSuite.csv | 25 ++ ...e-2026-10-20-published-rc8-ModuleFiles.csv | 12 + .../Acceptance-2026-10-20-published-rc8.md | 286 ++++++++++++++++++ Tests/Lab/README.md | 14 +- 6 files changed, 366 insertions(+), 5 deletions(-) create mode 100644 Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv create mode 100644 Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv create mode 100644 Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv create mode 100644 Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv create mode 100644 Tests/Lab/Acceptance-2026-10-20-published-rc8.md diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv new file mode 100644 index 0000000..995c9a8 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv @@ -0,0 +1,25 @@ +"Run","Candidate","FileServer","FileServerOs","Client","ClientOs","Edition","Role","Account","ExitCode","Passed","Failed","Skipped" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1" diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv new file mode 100644 index 0000000..eafa145 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv @@ -0,0 +1,9 @@ +"Version","Edition","Role","Account","ExitCode","Passed","Failed","Skipped" +"5.0.0-rc8","Desktop","Delegate","A\NtfsLiveDelegate","0","69","0","0" +"5.0.0-rc8","Desktop","ServerAdmin","A\NtfsLiveServerAdmin","0","36","0","0" +"5.0.0-rc8","Desktop","Admin","A\NtfsLiveAdmin","0","64","0","0" +"5.0.0-rc8","Desktop","Server","A\install","0","76","0","1" +"5.0.0-rc8","Core","Delegate","A\NtfsLiveDelegate","0","69","0","0" +"5.0.0-rc8","Core","ServerAdmin","A\NtfsLiveServerAdmin","0","36","0","0" +"5.0.0-rc8","Core","Admin","A\NtfsLiveAdmin","0","64","0","0" +"5.0.0-rc8","Core","Server","A\install","0","76","0","1" diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv new file mode 100644 index 0000000..0727ffa --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv @@ -0,0 +1,25 @@ +"Candidate","Machine","Os","Mode","Edition","PowerShell","Result","Passed","Failed","Skipped","Total","Seconds" +"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Basic","Core","7.6.3","Passed","905","0","286","1191","144" +"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Basic","Desktop","5.1.17763.1007","Passed","907","0","284","1191","175" +"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Elevated","Core","7.6.3","Passed","1170","0","21","1191","214" +"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Elevated","Desktop","5.1.17763.1007","Passed","1172","0","19","1191","110" +"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Basic","Core","7.6.3","Passed","905","0","286","1191","167" +"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Basic","Desktop","5.1.20348.4294","Passed","907","0","284","1191","181" +"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Elevated","Core","7.6.3","Passed","1170","0","21","1191","236" +"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Elevated","Desktop","5.1.20348.4294","Passed","1172","0","19","1191","124" +"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Basic","Core","7.6.3","Passed","905","0","286","1191","109" +"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Basic","Desktop","5.1.26100.32684","Passed","907","0","284","1191","152" +"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Elevated","Core","7.6.3","Passed","1170","0","21","1191","222" +"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Elevated","Desktop","5.1.26100.32684","Passed","1172","0","19","1191","262" +"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Basic","Core","7.6.3","Passed","905","0","286","1191","34" +"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Basic","Desktop","5.1.22621.169","Passed","907","0","284","1191","191" +"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Elevated","Core","7.6.3","Passed","1170","0","21","1191","109" +"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Elevated","Desktop","5.1.22621.169","Passed","1172","0","19","1191","130" +"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Basic","Core","7.6.3","Passed","905","0","286","1191","36" +"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Basic","Desktop","5.1.28000.1830","Passed","907","0","284","1191","173" +"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Elevated","Core","7.6.3","Passed","1170","0","21","1191","103" +"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Elevated","Desktop","5.1.28000.1830","Passed","1172","0","19","1191","171" +"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Basic","Core","7.6.7","Passed","904","0","286","1190","21" +"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Basic","Desktop","5.1.26100.33648","Passed","906","0","284","1190","23" +"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Elevated","Core","7.6.7","Passed","1169","0","21","1190","92" +"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Elevated","Desktop","5.1.26100.33648","Passed","1171","0","19","1190","111" diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv new file mode 100644 index 0000000..8e1f6e0 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv @@ -0,0 +1,12 @@ +"File","ZipSha256","NupkgSha256","Equal" +"AlphaFS.dll","A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8","A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8","True" +"NTFSSecurity.dll","D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79","D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79","True" +"NTFSSecurity.format.ps1xml","FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197","FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197","True" +"NTFSSecurity.Init.ps1","59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC","59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC","True" +"NTFSSecurity.psd1","5830FFD90D50F1120CE698A9F276CA4D8E1DD05284ECAFB4AA0094E8BD98E015","5830FFD90D50F1120CE698A9F276CA4D8E1DD05284ECAFB4AA0094E8BD98E015","True" +"NTFSSecurity.psm1","3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8","3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8","True" +"NTFSSecurity.types.ps1xml","CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B","CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B","True" +"PrivilegeControl.dll","F789CC92F763EAD2C77EA72E136CB19DFBF41EC0116842270207B44312DC7236","F789CC92F763EAD2C77EA72E136CB19DFBF41EC0116842270207B44312DC7236","True" +"ProcessPrivileges.dll","1A7EFE3189B0BFEFEF86B0E8DF91551BAD1AC9DBF611ECC1019EF77C3FF8798B","1A7EFE3189B0BFEFEF86B0E8DF91551BAD1AC9DBF611ECC1019EF77C3FF8798B","True" +"Security2.dll","8ED7F6FFD8ABF14DE0EDED3AFB64FD0AB8273D7DDE48F62D6F860CF7B8BA9BEC","8ED7F6FFD8ABF14DE0EDED3AFB64FD0AB8273D7DDE48F62D6F860CF7B8BA9BEC","True" +"en-US\NTFSSecurity.dll-Help.xml","F8F2BD9FA913437E2F745D7DFE8A3B995C59178A9E956D28E1568357ACF8CE76","F8F2BD9FA913437E2F745D7DFE8A3B995C59178A9E956D28E1568357ACF8CE76","True" diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8.md b/Tests/Lab/Acceptance-2026-10-20-published-rc8.md new file mode 100644 index 0000000..8a940f1 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8.md @@ -0,0 +1,286 @@ +# Acceptance of the published 5.0.0-rc8, 2026-10-20 + +Live and local acceptance of the exact prerelease that the PowerShell Gallery +has, in the operating-system matrix and in the first lab. It repeats the +[acceptance of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md) +with the bytes of rc8, which carries the module changes of the coverage work +since rc7 and the fix of the swallowed initialization errors of +`Get-NTFSEffectiveAccess`. This record doesn't repeat the machines, the +defects, or the method of the earlier records; it adds what differs. It isn't a +claim that the quality gate is complete (see the limits at the end). + +## Result + +- The published 5.0.0-rc8 passed every stage. The identity check (tag, CI run, + Gallery hash, GitHub zip) passed before the runs. The live controller passed + in the three cells of the matrix, both editions, every role: 1,374 passed, 0 + failed, 12 skipped, and the independent end-state check of every cell said + CLEAN. The module's own suite passed in all 24 runs (six machine classes, two + editions, elevated and as a basic user), and every skipped test is also + skipped on the host. The live controller passed in the first lab, where case 9 + runs: 245 passed, 0 failed, 1 skipped in each edition, and the independent + checks found both labs clean after the run and again at the end. +- The live counts equal those of the published rc7: 1,374 / 0 / 12 in the cells + and 245 / 0 / 1 per edition in the first lab. The live tests and the + controller are the same Git blobs as in that run, so the cells measure the + changed module, not changed tests. The module's suite has 1,191 cases per + configuration on the machines of the domain (rc7: 1,011), because the + coverage work added tests. +- The changes of the module since rc7 are listed below. The unit suites on six + machine classes ran their tests; the live tests of + `Get-NTFSEffectiveAccess -ServerName` (a computer that can't be reached, and + a computer that refuses the user) passed unchanged in every cell. +- On Windows Server 2019, 2022, and 2025 and on Windows 11 26H1, a computer name + of 32,718 characters or more fails with error 14 and a shorter one with error + 1722, the boundary that the CHANGELOG names for the new + `GetEffectiveAccessError` (see "The long name of -ServerName"). +- The run changed nothing in the module, the tests, or the kit: it used the + files of the tag. + +## What differs from the published rc7 + +The tag has 36 commits without merges after `5.0.0-rc7`, most of them tests and +documents. The module changed in nine C# files and in the manifest: + +| Change | Files | Commits | +| --- | --- | --- | +| The `AppliesTo` property of a piped object binds for a path, and the scope of one piped object no longer reaches the next | `AddAccess.cs`, `RemoveAccess.cs`, `AddAudit.cs`, `RemoveAudit.cs` | `93ed2c7`, `9783d2a` | +| `Get-ChildItem2` enumerates and filters without the culture of the thread (the filter missed files under `tr-TR`) | `GetChildItem2.cs` | `0028ccd`, `fbe0289`, `8a625c8` | +| An identity compares with a name without the culture of the thread | `IdentityReference2.cs` | `419cfb3` | +| `Get-NTFSEffectiveAccess` writes a `GetEffectiveAccessError` when Windows refuses to start the authorization manager, and warns that the result is based on this computer only when it calculated one | `GetEffectiveAccess.cs`, `Lib.cs` | `25fe775` | +| The prerelease label | `NTFSSecurity.psd1` | `e2e9324` | + +No changed line writes or selects a section (owner, group, DACL, or SACL) of a +security descriptor: the first three rows change how a parameter or a name is +read, and the fourth changes only the read of the effective access. + +## Candidate and artifact identity + +`Test-PublishedRelease.ps1 -Version 5.0.0-rc8` ran at 10:42 UTC, before the +runs, and printed `PUBLISHED_IDENTITY_VERIFIED`. It changes nothing on GitHub or +in the Gallery. + +| | Published 5.0.0-rc8 | +| --- | --- | +| Tag | `5.0.0-rc8`, commit `c71919700c3fc48ac910f86f94f59ab2f5731add`, on `master` (the merge of #127) | +| CI run of the tag | `39408140862` (started 10:28:05 UTC): Build and test and Release succeeded | +| PowerShell Gallery | published 10:40:58 UTC; the SHA-512 that the Gallery publishes matches the downloaded package | +| GitHub prerelease | published 10:41:07 UTC | +| `NTFSSecurity.5.0.0-rc8.nupkg` SHA-256 | `EA90E16F2152016E97BFB3D2413D29F8944704E9D4FBD5101D0A263841BC0510` | +| `NTFSSecurity.zip` SHA-256 | `288152E20F8CFB1B029BAC055345339970C65BD57C8BA814C2616C32D9F812BC` | +| `NTFSSecurity.dll` SHA-256 | `D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79` | +| Manifest | `5.0.0` with `Prerelease = 'rc8'` | + +The 11 module files of the nupkg and of the zip are byte for byte equal +([the hashes](Acceptance-2026-10-20-published-rc8-ModuleFiles.csv)). The +controller checks the SHA-512 that the Gallery publishes before it runs a +package, and it kept the package that it downloaded in each of its five runs +(the three cells and the two editions of the first lab): all five nupkg files +and all five DLLs equal the values above. The suites staged the extracted zip, +and their logs record the same DLL hash on all six machine classes. The build +isn't byte-reproducible, so these hashes belong to this one build. + +## Method + +The method of the records of the matrix and of the published rc7 applies. What +differs: + +- **Frozen kit.** The kit, the controller, and the live tests are the files of + the tag, in an isolated worktree, so that no change of the working tree could + affect a run in progress. The live tests are the Git blob + `efe36e5073b9b10742ca7de242ddcbe90d8eda62` and the controller the blob + `635bf162421b4df4efc76d5677212e8782e8bf77`, the same as in the acceptance of + the published rc7. +- **Machines from the saved state.** Every machine of both labs had been saved + since 2026-10-11 14:17 UTC. A script restored them in waves (the domain + controllers first, then the other domain controllers and the certification + authority, then the file servers and clients), and the readiness check of both + labs passed at its first attempt (10:43 UTC, clock skew 4 to 5 seconds). The + evaluation client `OSWin11E` started at 10:43:41 UTC, because it shuts itself + down an hour after each start. After the run, the machines were saved again, + as they were found. +- **Order.** One detached driver ran the stages in this order: the identity + check, the readiness of both labs, the three cells of the matrix, the module's + suite on six machine classes, the check of what the suites left in the matrix + lab, and the first lab. The driver only calls the scripts of the kit and a few + helper scripts (see the evidence). +- **Live controller.** `Run-MatrixSequence.ps1 -Version 5.0.0-rc8 -FileServer + OSFile19,OSFile22,OSFile25`, with the client `OSWin11E`: the readiness of + every machine, the controller in both editions, `Validate-LabResults.ps1` for + every role from the result files (`-Expect Candidate`), a snapshot of the + fixture SIDs, `-RemoveFixture`, and `Test-MatrixCleanup.ps1`. In the first lab + the same stages ran with the foreign domain controllers of case 9, with + `-Version` for each edition in its own run. +- **Suite.** `Run-MatrixLocalSuite.ps1 -ModulePath` with the extracted zip, + `-Mode Elevated,Basic`, both editions, on OSWin11E, OSFile19, OSFile22, + OSFile25, OSWin11 (with the local installation account), and the host as the + reference. The processes started 75 seconds apart, because AutomatedLab + imports one lab at a time. +- **No checkpoint.** The procedure in the README takes a checkpoint of the + machines before a run. This run took none: the machines were restored from + their saved state, and the end state of every cell was verified instead. + +## Results + +### Live controller in the matrix + +The Windows 11 client `OSWin11E` with each file server, one sequence (`rc8`), +10:47 to 11:08 UTC. Every role was checked from the result files, and +`Validate-LabResults.ps1` printed `LIVE_RESULT_VERIFIED (Candidate)` for each +cell. The counts are the same in both editions and in all three cells +([Cells.csv](Acceptance-2026-10-20-published-rc8-Cells.csv)): + +| Role | Passed / failed / skipped | +| --- | --- | +| Delegate | 69 / 0 / 0 | +| ServerAdmin | 36 / 0 / 0 | +| Admin | 51 / 0 / 1 | +| Server | 73 / 0 / 1 | + +That is 229 passed, 0 failed, and 2 skipped per edition and cell, and 1,374 +passed, 0 failed, 12 skipped for the three cells. The skipped tests are those +of the earlier records: case 9 (the matrix lab has no foreign domain) and the +test of the module version in the Server role (that role runs without the +module). + +| File server | Cell | Controller | End-state check | +| --- | --- | --- | --- | +| OSFile19 (Windows Server 2019) | 10:47:42 to 10:53:53 | 10:48:10 to 10:52:54 | CLEAN | +| OSFile22 (Windows Server 2022) | 10:53:53 to 10:59:45 | 10:54:16 to 10:58:54 | CLEAN | +| OSFile25 (Windows Server 2025) | 10:59:45 to 11:08:42 | 11:00:08 to 11:07:51 | CLEAN | + +### First lab (case 9) + +`WindowsAccessControlLab`, both editions, 11:26 to 11:46 UTC: the domain +controller `F1ADC1`, the file server `F1AFile2`, and the client `F1AFile1` +(domain `a.forest1.net`), with the foreign domain controllers `F1BDC1`, +`F2DC1`, and `F3DC1`. `Validate-LabResults.ps1` printed +`LIVE_RESULT_VERIFIED (Candidate)` for each edition. The counts are the same in +both editions +([FirstLab.csv](Acceptance-2026-10-20-published-rc8-FirstLab.csv)): + +| Role | Passed / failed / skipped | +| --- | --- | +| Delegate | 69 / 0 / 0 | +| ServerAdmin | 36 / 0 / 0 | +| Admin | 64 / 0 / 0 | +| Server | 76 / 0 / 1 | + +That is 245 passed, 0 failed, and 1 skipped per edition; the skipped test is +the test of the module version in the Server role. The Windows PowerShell run +took 11:27 to 11:36 UTC and the PowerShell 7 run 11:36 to 11:44 UTC. The +fixture was removed with `-RemoveFixture`, and the independent check found the +four domains and both machines clean: no organizational unit, account, share, +folder, local group, membership, or profile of the fixture, and none of the +residue that the check counts. Its verdict was CLEAN (11:45 UTC). The final +read-only check of both labs after the whole run said CLEAN for the matrix lab +(11:46 UTC) and for the first lab (11:46 UTC). + +### The module's own suite + +Passed / failed / skipped. Every configuration has 1,191 cases on the machines +of the domain and on `OSWin11`, and 1,190 on the host, which has no DNS domain, +so the test of the fully qualified name of this computer doesn't exist there +([LocalSuite.csv](Acceptance-2026-10-20-published-rc8-LocalSuite.csv)). + +| Machine | Elevated, Windows PowerShell | Elevated, PowerShell 7 | Basic user, Windows PowerShell | Basic user, PowerShell 7 | +| --- | --- | --- | --- | --- | +| OSFile19 (Server 2019) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 | +| OSFile22 (Server 2022) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 | +| OSFile25 (Server 2025) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 | +| OSWin11E (Windows 11 22H2) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 | +| OSWin11 (Windows 11 26H1) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 | +| Host (reference) | 1,171 / 0 / 19 | 1,169 / 0 / 21 | 906 / 0 / 284 | 904 / 0 / 286 | + +In all 20 comparisons with the host, the skipped tests are the same, name for +name, as multisets (`Export-MatrixResults.ps1` found no difference). No run has +a failed test, a failed container, or a test that didn't run. The operating +system builds are those of the readiness checks (Windows Server 2019 +17763.1217, 2022 20348.4773, and 2025 26100.32690 on the domain controller and +the file servers; Windows 11 22H2 22621.525 and 26H1 28000); the host has +PowerShell 7.6.7, the virtual machines 7.6.3. + +After the suites, `Test-MatrixCleanup.ps1 -Mode Verify` checked the domain and +the machines OSFile19, OSFile22, OSFile25, and OSWin11E again (11:26 UTC): +CLEAN at the first check, so no repair was needed. A read-only script checked +`OSWin11` with its local account (11:26 UTC): no scheduled task, stage item, +probe user, profile, share, folder, or live user. + +### The long name of -ServerName + +The CHANGELOG says that `Get-NTFSEffectiveAccess` now writes a +`GetEffectiveAccessError` for a computer name of 32,718 characters or more, +because Windows refuses to start the authorization manager for it. A probe with +the call and the structure of `Security2\Win32\Lib.cs` +(`AuthzInitializeRemoteResourceManager`), run on the machines of the matrix lab +after the acceptance, shows the same boundary on every one of them: + +| Machine | Operating system | 1 to 32,717 characters | 32,718 characters and more (also 32,768 and 70,000) | +| --- | --- | --- | --- | +| OSFile19 | Windows Server 2019 Datacenter 10.0.17763 | 1722 (RPC server unavailable) | 14 | +| OSFile22 | Windows Server 2022 Datacenter 10.0.20348 | 1722 | 14 | +| OSFile25 | Windows Server 2025 Datacenter 10.0.26100 | 1722 | 14 | +| OSWin11 | Windows 11 Pro 10.0.28000 | 1722 | 14 | + +The probed lengths were 1, 255, 16,000, 32,717, 32,718, 32,768, and 70,000. On +the host (Windows Server 2025), a bisection in both editions found the same +boundary. Error 1722 keeps the fallback to this computer with its warning, and +error 14 is the new error, so the regression test of the fix, which accepts +either outcome, takes its error branch on each of these systems. `OSWin11E` +was off when the probe ran and wasn't probed. + +## Limits and open items + +- This is one run of one binary. A changed binary needs the same cells again; + results of different binaries don't combine into one matrix. A stable 5.0.0 + is a new build, because its manifest has no `Prerelease` value, so the + identity of the tested bytes doesn't carry over to it. The release procedure + (`Docs/Contributing/05-Releasing.md`) accepts the last prerelease instead; + that is the maintainer's decision, not this record's. +- Case 9 (accounts of other domains and forests) needs trusts that the matrix + lab doesn't have, so the cells skip it, and it ran only in the first lab, on + Windows Server 2025. The first lab has no other operating system. +- Windows 11 26H1 has no live cell: its secure channel to the Windows Server + 2025 domain controller of the lab fails, so it runs the suite only. The client + of the cells is the Windows 11 22H2 evaluation build. +- The file servers are Windows. A server of another kind is the subject of + Decision 23 (issue #34) and wasn't tested. +- The matrix and its decision (Decision 24) are the maintainer's. This record is + the acceptance of the published rc8 on that matrix; whether the matrix is the + right one, and whether the gate is closed, are the maintainer's decisions. +- `Test-MatrixCleanup.ps1` can't reach `OSWin11` with the domain account. The + read-only script that checked it with the local account is a helper of this + run (see the evidence), not a script of the kit. +- `OSWin11E` shut itself down by itself after the run, as it does an hour after + every start (it was off at 11:51 UTC), and was left off. All the other + machines of both labs were saved again at 11:52 to 11:53 UTC; neither lab has + a fixture. +- Of the two LOW findings of the security review in the record of the matrix, + the swallowed initialization exceptions of `GetEffectiveAccess` are fixed in + this build (#127). The ACL of the staging folders under `C:\` is unchanged and + wasn't part of this run. +- The effective-access state that outlives a re-created account name wasn't + investigated again; the three cells of one sequence are no test of it. The + failures that the earlier record traced to it didn't recur. + +## Evidence + +The raw logs, result files, the downloaded packages, and the driver are local, +outside Git, in the session files of the run (the folder `rc8-published`). +`evidence-manifest.csv` there lists the size and the SHA-256 of every file +except itself and the worktree of the tag, which holds the files of the commit +that Git has. The helper scripts of the run are in the folder `scripts` next to +it: the driver (`Chain-Published.ps1`), the restore of the machines +(`Start-LabMachines.ps1`), the first-lab run with `-Version` +(`Run-LiveAcceptancePublished.ps1`), the check of `OSWin11` +(`Verify-Client.ps1`), and the exporter of the tables of this record +(`Build-RecordTables.ps1`); the probe of the long name is +`p-authz-init-lab.ps1` in `probes`. The tables of this record are next to it: + +- [the identity of the module files](Acceptance-2026-10-20-published-rc8-ModuleFiles.csv), +- [the controller cells](Acceptance-2026-10-20-published-rc8-Cells.csv), +- [the counts of the first-lab run](Acceptance-2026-10-20-published-rc8-FirstLab.csv), +- [the suite results](Acceptance-2026-10-20-published-rc8-LocalSuite.csv). + +The scripts of the kit that ran are in [Acceptance](Acceptance); the decision is +`.memory-bank\decisions\0024-os-matrix-lab.md`. diff --git a/Tests/Lab/README.md b/Tests/Lab/README.md index 9fc2a1d..e745638 100644 --- a/Tests/Lab/README.md +++ b/Tests/Lab/README.md @@ -164,7 +164,9 @@ and record the evidence in this folder: `.github\scripts\New-ModulePackage.ps1`, and record the SHA-256 of the packages and of the module files. 2. Check that WinRM, LDAP, Kerberos, the secure channel, and the clocks of - the lab machines work. + the lab machines work. Machines that were saved (`Save-VM`) come first: restore + the domain controllers, wait a minute for the directory services, then restore + the other machines, and run the readiness check until it passes. 3. Take a checkpoint of the machines, named after the candidate and its commit. 4. Run the tests with `-ModulePath` of the extracted `NTFSSecurity.zip` in @@ -249,15 +251,17 @@ module of the release (`Test-PublishedRelease.ps1` leaves it in the folder controller with `-Version` in the first lab, where case 9 runs. Start the suites a minute or more apart, because AutomatedLab imports one lab at a time, and never together with a controller. The -[record of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md) ran -the stages that way. +[record of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md) and +the [record of the published 5.0.0-rc8](Acceptance-2026-10-20-published-rc8.md) +ran the stages that way. Records: [5.0.0-rc6](Acceptance-2026-10-08-5.0.0-rc6.md), [5.0.0-rc7](Acceptance-2026-10-08-5.0.0-rc7.md), [quality-gate follow-up](Acceptance-2026-10-09-quality-gate.md), [quality-gate paths follow-up](Acceptance-2026-10-09-quality-gate-paths.md), -[operating-system matrix](Acceptance-2026-10-10-os-matrix.md), and -[the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md). +[operating-system matrix](Acceptance-2026-10-10-os-matrix.md), +[the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md), and +[the published 5.0.0-rc8](Acceptance-2026-10-20-published-rc8.md). The review of the code that no unit test visits, with the fixes that the lab has to repeat, is in [Tests/Coverage](../Coverage/Quality-Gate-Paths-2026-10-09.md).