ci: install PsExec directly with checksum verification

[Vladyslav Nikonov (vnikonov-devolutions)]

The pstools Chocolatey package downloads PSTools.zip from Microsoft at install time and pins a checksum that breaks whenever Microsoft updates the zip; the latest package version currently fails this way and breaks the PEDM simulator CI job, while older versions skip verification entirely. Download PSTools.zip directly from Microsoft and verify it against a checksum pinned in the workflow, so installs stay integrity-checked and the hash is bumped deliberately when Microsoft publishes a new PSTools.

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Vladyslav Nikonov (vnikonov-devolutions)]

Implementation notes:

• The pstools Chocolatey install script downloads https://download.sysinternals.com/files/PSTools.zip at install time. Version 1.2023.4.11 pins checksum a9ca77dfe03c..., but the live zip now hashes to 4f49964cc9cb..., so installation fails with a checksum mismatch.
• Version 1.2012.04.12 (the previous published version) installs the same HTTPS zip via Install-ChocolateyZipPackage with no pinned checksum, so it keeps working across upstream PSTools updates.
• Verified both by downloading the .nupkg files from the Chocolatey API and inspecting tools/chocolateyInstall.ps1, and by hashing the current upstream zip.

Note

LLM-assisted content (no human feedback).

[Copilot]

Pull request overview

Pins PSTools to an older Chocolatey package to restore the PEDM simulator CI job.

Changes:

• Pins PSTools to version 1.2012.04.12.
• Documents the checksum mismatch workaround.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Vladyslav Nikonov (vnikonov-devolutions)]

Follow-up: replaced the version pin with a proper fix. Pinning pstools 1.2012.04.12 avoided the broken checksum only because that old package does no checksum verification at all, which is worse.

New approach:

• Drop Chocolatey entirely; only psexec is needed by this job.
• Download PSTools.zip directly from https://download.sysinternals.com/files/PSTools.zip (same URL the choco package uses).
• Verify SHA256 against a hash pinned in the workflow (4F49964C..., hash of the current upstream zip), extract to $RUNNER_TEMP\PSTools, and add it to GITHUB_PATH.
• When Microsoft updates PSTools, the job fails with an explicit mismatch message and the hash gets bumped deliberately — no silent tampering window, no dependence on the community package's maintenance cadence.

Verified locally: download, checksum match, extraction, and PsExec.exe presence.

Note

LLM-assisted content (no human feedback).