add root build-info and scripts for internal signing pipeline

Author: rodchristiansen

build-info.yaml

@@ -0,0 +1,9 @@
+product:
+  name: Crypt
+  version: ${TIMESTAMP}
+  developer: Windows Admins Open Source
+  identifier: ca.ecuad.crypt
+  description: BitLocker recovery key escrow to Crypt Server with key rotation support
+signing_certificate: EmilyCarrU Intune Windows Enterprise Certificate
+postinstall_action: none
+install_location: 'C:\Program Files\Crypt'

scripts/postinstall.ps1

@@ -0,0 +1,72 @@
+# Crypt postinstall script
+
+$installPath = 'C:\Program Files\Crypt'
+$configDir = 'C:\ProgramData\ManagedEncryption'
+$configFile = Join-Path $configDir 'config.yaml'
+
+Write-Host "Crypt - Post-installation" -ForegroundColor Cyan
+
+# Add to system PATH
+$currentPath = [Environment]::GetEnvironmentVariable('PATH', 'Machine')
+if ($currentPath -notlike "*$installPath*") {
+    $newPath = "$currentPath;$installPath"
+    [Environment]::SetEnvironmentVariable('PATH', $newPath, 'Machine')
+    Write-Host "Added $installPath to system PATH" -ForegroundColor Green
+} else {
+    Write-Host "PATH already configured" -ForegroundColor Cyan
+}
+
+# Create config directory
+if (-not (Test-Path $configDir)) {
+    New-Item -ItemType Directory -Path $configDir -Force | Out-Null
+    Write-Host "Created config directory: $configDir" -ForegroundColor Green
+}
+
+# Create logs directory
+$logsDir = Join-Path $configDir 'logs'
+if (-not (Test-Path $logsDir)) {
+    New-Item -ItemType Directory -Path $logsDir -Force | Out-Null
+}
+
+# Configure from environment variable if set
+$serverUrl = [Environment]::GetEnvironmentVariable('CRYPT_ESCROW_SERVER_URL', 'Machine')
+if ($serverUrl -and -not (Test-Path $configFile)) {
+    Write-Host "Configuring Crypt server: $serverUrl" -ForegroundColor Cyan
+    $config = @"
+server:
+  url: $serverUrl
+  skip_cert_check: false
+
+escrow:
+  auto_rotate: true
+  cleanup_old_protectors: true
+  key_escrow_interval_hours: 24
+  validate_key: true
+
+logging:
+  level: Info
+  file_path: $configDir\logs\crypt.log
+"@
+    Set-Content -Path $configFile -Value $config -Encoding UTF8
+    Write-Host "Created config file: $configFile" -ForegroundColor Green
+}
+
+# Register scheduled task for automatic key rotation
+try {
+    $cryptExe = Join-Path $installPath 'checkin.exe'
+    if (Test-Path $cryptExe) {
+        Write-Host "Registering hourly scheduled task..." -ForegroundColor Cyan
+        & $cryptExe register-task --frequency hourly 2>&1 | Out-Null
+        if ($LASTEXITCODE -eq 0) {
+            Write-Host "Scheduled task registered successfully" -ForegroundColor Green
+        }
+    }
+} catch {
+    Write-Host "Could not register scheduled task: $_" -ForegroundColor Yellow
+}
+
+Write-Host "`nCrypt installation complete!" -ForegroundColor Green
+Write-Host "Usage: checkin --help" -ForegroundColor Cyan
+if (-not (Test-Path $configFile)) {
+    Write-Host "Configure: checkin config set server.url https://your-crypt-server" -ForegroundColor Yellow
+}

scripts/preinstall.ps1

@@ -0,0 +1,29 @@
+# Crypt preinstall script
+
+Write-Host "Crypt - Pre-installation checks" -ForegroundColor Cyan
+
+# Check for BitLocker support
+try {
+    $tpm = Get-WmiObject -Namespace "Root\CIMv2\Security\MicrosoftTpm" -Class Win32_Tpm -ErrorAction SilentlyContinue
+    if ($tpm) {
+        Write-Host "TPM detected: Ready for BitLocker key escrow" -ForegroundColor Green
+    } else {
+        Write-Host "No TPM detected - BitLocker may use password-only mode" -ForegroundColor Yellow
+    }
+} catch {
+    Write-Host "Could not check TPM status" -ForegroundColor Yellow
+}
+
+# Stop any existing scheduled tasks
+try {
+    $task = Get-ScheduledTask -TaskName "Crypt*" -ErrorAction SilentlyContinue
+    if ($task) {
+        Write-Host "Stopping existing Crypt scheduled task..." -ForegroundColor Cyan
+        $task | Stop-ScheduledTask -ErrorAction SilentlyContinue
+        $task | Unregister-ScheduledTask -Confirm:$false -ErrorAction SilentlyContinue
+    }
+} catch {
+    # Ignore errors
+}
+
+Write-Host "Pre-installation checks complete" -ForegroundColor Green