Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion bin/powershell7.5.4/deps.properties
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
oh_my_posh = https://github.com/JanDeDobbeleer/oh-my-posh/releases/download/v29.14.0/posh-windows-amd64.exe
oh_my_posh = https://github.com/JanDeDobbeleer/oh-my-posh/releases/download/v29.18.0/posh-windows-amd64.exe
oh_my_posh_theme = https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/paradox.omp.json

# Cascadia Mono Nerd Font - Nerd Font required for Oh My Posh glyphs/icons in the terminal
Expand Down
4 changes: 2 additions & 2 deletions bin/powershell7.5.4/powershell.bat
Original file line number Diff line number Diff line change
Expand Up @@ -178,10 +178,10 @@ REM Launch PowerShell with custom profile and parameters
REM We use cmd /c start to launch in a new process which reliably picks up registry font settings
REM then we exit the current (incorrectly fonted) window.
if "%NO_EXIT%"=="1" (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -Command "!PS_COMMAND!"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!"
exit
) else (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -Command "!PS_COMMAND!; exit"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!; exit"
exit
)
popd
Expand Down
2 changes: 1 addition & 1 deletion bin/powershell7.6.0/bearsampp.conf
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ powershellVersion = "7.6.0"
powershellExe = "pwsh.exe"
powershellLaunchExe = "powershell.bat"
powershellConf = "config\Microsoft.PowerShell_profile.ps1"
powershellFont = "Cascadia Mono NF"
powershellFont = "CaskaydiaMono NF"
powershellRows = "33"
powershellCols = "110"

Expand Down
4 changes: 2 additions & 2 deletions bin/powershell7.6.0/powershell.bat
Original file line number Diff line number Diff line change
Expand Up @@ -178,10 +178,10 @@ REM Launch PowerShell with custom profile and parameters
REM We use cmd /c start to launch in a new process which reliably picks up registry font settings
REM then we exit the current (incorrectly fonted) window.
if "%NO_EXIT%"=="1" (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -Command "!PS_COMMAND!"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!"
exit
) else (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -Command "!PS_COMMAND!; exit"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!; exit"
exit
)
popd
Expand Down
4 changes: 2 additions & 2 deletions bin/powershell7.6.1/powershell.bat
Original file line number Diff line number Diff line change
Expand Up @@ -178,10 +178,10 @@ REM Launch PowerShell with custom profile and parameters
REM We use cmd /c start to launch in a new process which reliably picks up registry font settings
REM then we exit the current (incorrectly fonted) window.
if "%NO_EXIT%"=="1" (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -Command "!PS_COMMAND!"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!"
exit
) else (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -Command "!PS_COMMAND!; exit"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!; exit"
exit
)
popd
Expand Down
4 changes: 2 additions & 2 deletions bin/powershell7.6.2/powershell.bat
Original file line number Diff line number Diff line change
Expand Up @@ -178,10 +178,10 @@ REM Launch PowerShell with custom profile and parameters
REM We use cmd /c start to launch in a new process which reliably picks up registry font settings
REM then we exit the current (incorrectly fonted) window.
if "%NO_EXIT%"=="1" (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -Command "!PS_COMMAND!"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoExit -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!"
exit
) else (
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -Command "!PS_COMMAND!; exit"
start "!WINDOW_TITLE!" "!PS_EXE!" -NoProfile -ExecutionPolicy Bypass -Command "!PS_COMMAND!; exit"
exit
)
popd
Expand Down
9 changes: 9 additions & 0 deletions bin/powershell7.6.3/bearsampp.conf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
powershellVersion = "7.6.3"
powershellExe = "pwsh.exe"
powershellLaunchExe = "powershell.bat"
powershellConf = "config\Microsoft.PowerShell_profile.ps1"
powershellFont = "CaskaydiaMono NF"
powershellRows = "33"
powershellCols = "110"

bundleRelease = "@RELEASE_VERSION@"
52 changes: 52 additions & 0 deletions bin/powershell7.6.3/config/Microsoft.PowerShell_profile.ps1
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# Bearsampp PowerShell Profile
# This profile configures PowerShell with enhanced console features
# PowerShell 7+ includes PSReadLine by default for command-line editing

# Get the shell root directory
$SHELL_ROOT = Split-Path -Parent $PSScriptRoot

# Set environment variables for Oh My Posh
$env:POSH_ROOT = Join-Path $SHELL_ROOT "vendor\oh-my-posh"

# Set PowerShell module path to include bundled modules
$env:PSModulePath = (Join-Path $SHELL_ROOT "vendor\modules") + ";" + $env:PSModulePath

# Configure console to use Nerd Font (Cascadia Mono NF)
# This is required for Oh My Posh icons and glyphs to display correctly
# Note: Font configuration is handled by the launcher (powershell.bat) via registry.

# Initialize Oh My Posh with theme
$ohMyPoshExe = "$env:POSH_ROOT\posh-windows-amd64.exe"
$ohMyPoshTheme = "$env:POSH_ROOT\themes\paradox.omp.json"

if (Test-Path $ohMyPoshExe -PathType Leaf) {
& $ohMyPoshExe init pwsh --config $ohMyPoshTheme | Invoke-Expression
}

# Import Terminal-Icons for colorful file/folder icons
Import-Module Terminal-Icons -ErrorAction SilentlyContinue

# Set PowerShell options for better experience
if ($PSVersionTable.PSVersion.Major -ge 5) {
# Use a single call to Set-PSReadLineOption for speed if possible (not all options can be combined)
Set-PSReadLineOption -EditMode Windows -HistorySearchCursorMovesToEnd -MaximumHistoryCount 10000 -HistoryNoDuplicates
Set-PSReadLineOption -PredictionSource History -ErrorAction SilentlyContinue
Set-PSReadLineOption -Colors @{
Command = 'Green'
Parameter = 'Gray'
String = 'DarkCyan'
}

# Key bindings
Set-PSReadLineKeyHandler -Key UpArrow -Function HistorySearchBackward
Set-PSReadLineKeyHandler -Key DownArrow -Function HistorySearchForward
Set-PSReadLineKeyHandler -Key Tab -Function MenuComplete
}

# Welcome message
# Only show banner in interactive ConsoleHost and not when running commands
if ($Host.Name -eq "ConsoleHost" -and $ExecutionContext.SessionState.LanguageMode -eq "FullLanguage" -and -not $MyInvocation.BoundParameters.ContainsKey('Command')) {
Write-Host "Bearsampp PowerShell" -ForegroundColor Cyan
Write-Host "Enhanced with PSReadLine, Oh My Posh, and Terminal-Icons" -ForegroundColor Gray
Write-Host ""
}
67 changes: 67 additions & 0 deletions bin/powershell7.6.3/config/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
# Bearsampp PowerShell Configuration

## Font Requirement

This PowerShell module requires a **Nerd Font** to display Oh My Posh icons and glyphs correctly.

### Required Font
- **Font Name**: Cascadia Mono NF
- **Installation**: Should be installed system-wide via Bearsampp prerequisites

### Configuring the Font

#### Windows Terminal (Recommended)
If using Windows Terminal, add this to your `settings.json`:

```json
{
"profiles": {
"defaults": {
"font": {
"face": "Cascadia Mono NF",
"size": 10
}
}
}
}
```

#### Windows Console Host (conhost.exe)
1. Right-click the title bar → Properties
2. Go to the Font tab
3. Select "Cascadia Mono NF" from the font list
4. Click OK

#### PowerShell Console
The font is automatically used if it's set as the default console font in Windows.

## Files

- **Microsoft.PowerShell_profile.ps1** - Main PowerShell profile
- Configures PSReadLine (command-line editing)
- Initializes Oh My Posh with paradox theme
- Sets up history and key bindings
- Requires Cascadia Mono NF font for proper icon display

## Environment Variables

The profile sets these environment variables:
- `POSH_ROOT` - Path to Oh My Posh installation
- `POSH_THEMES_PATH` - Path to Oh My Posh themes directory

## Customization

### Change Oh My Posh Theme
Edit the profile and change the theme file:
```powershell
$ohMyPoshTheme = Join-Path $env:POSH_ROOT "themes\YOUR_THEME.omp.json"
```

Available themes are in `vendor/oh-my-posh/themes/`

### Modify PSReadLine Settings
Edit the `Set-PSReadLineOption` calls in the profile to customize:
- Colors
- Key bindings
- History behavior
- Prediction settings
137 changes: 137 additions & 0 deletions bin/powershell7.6.3/config/register-fonts.ps1
Original file line number Diff line number Diff line change
@@ -0,0 +1,137 @@
Add-Type -AssemblyName System.Drawing

$fontsSrc = $args[0]
$fontsDest = $args[1]

if (Test-Path $fontsSrc) {
if (-not (Test-Path $fontsDest)) {
try {
New-Item -ItemType Directory -Path $fontsDest -Force | Out-Null
} catch {
Write-Error "Failed to create fonts destination directory"
}
}

$fontFiles = @(Get-ChildItem -Path $fontsSrc -Include *.ttf, *.otf -Recurse)
if ($fontFiles.Count -eq 0) {
Write-Warning "No font files found in $fontsSrc"
exit 0
}

# Fast Path: If there's only one font file, we can potentially skip expensive collection loading
# if we can determine the name simply. But for Nerd Fonts, the file name != family name often.

# Explicitly load and extract font names
$fc = New-Object System.Drawing.Text.PrivateFontCollection
foreach ($file in $fontFiles) {
try {
$fc.AddFontFile($file.FullName)
} catch {
Write-Warning ("Failed to load font file: " + $file.FullName)
}
}

if ($fc.Families.Count -eq 0) {
foreach ($file in $fontFiles) {
try {
$fileBytes = [System.IO.File]::ReadAllBytes($file.FullName)
$handle = [System.Runtime.InteropServices.GCHandle]::Alloc($fileBytes, 'Pinned')
$fc.AddMemoryFont($handle.AddrOfPinnedObject(), $fileBytes.Length)
$handle.Free()
} catch {}
}
}

if ($fc.Families.Count -eq 0) {
Write-Warning "No font families found in $fontsSrc"
exit 0
}

$allNames = @($fc.Families | ForEach-Object { $_.Name } | Select-Object -Unique)
# Prefer Nerd Font Mono (NFM) or Mono variants for console
$detectedName = $allNames | Where-Object { $_ -match "NFM|NF|Mono" } | Select-Object -First 1
$fallbackName = $allNames | Select-Object -First 1

$regPath = "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Fonts"
if (-not (Test-Path $regPath)) {
New-Item -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion" -Name "Fonts" -Force | Out-Null
}

$fontFiles | ForEach-Object {
$fontFile = $_.FullName
$destFile = Join-Path $fontsDest $_.Name

$fileFc = New-Object System.Drawing.Text.PrivateFontCollection
try {
$fileFc.AddFontFile($fontFile)
$internalName = $fileFc.Families[0].Name
} catch {
$internalName = $null
}

if ($internalName) {
$regValueName = "$internalName (TrueType)"
$currentRegValue = Get-ItemProperty -Path $regPath -Name $regValueName -ErrorAction SilentlyContinue | Select-Object -ExpandProperty $regValueName -ErrorAction SilentlyContinue

$needsInstall = $false
if (-not (Test-Path $destFile)) {
$needsInstall = $true
} else {
$srcFileItem = Get-Item $fontFile
$destFileItem = Get-Item $destFile
if ($srcFileItem.Length -ne $destFileItem.Length -or $srcFileItem.LastWriteTime -gt $destFileItem.LastWriteTime) {
$needsInstall = $true
}
}

if ($null -eq $currentRegValue -or ($currentRegValue -ne $destFile -and $currentRegValue -ne $_.Name)) {
$needsInstall = $true
}

if ($needsInstall) {
try {
Copy-Item $fontFile $destFile -Force
Set-ItemProperty -Path $regPath -Name $regValueName -Value $destFile -Force

$signature = @'
[DllImport("gdi32.dll", CharSet = CharSet.Auto)]
public static extern int AddFontResourceEx(string lpszFilename, uint fl, IntPtr res);
'@
$gdi32 = Add-Type -MemberDefinition $signature -Name "Gdi32" -Namespace "Win32" -PassThru
$gdi32::AddFontResourceEx($destFile, 0, [IntPtr]::Zero) | Out-Null
} catch {
Write-Error "Failed to install font $internalName"
}
}
}
}

$finalName = if ($detectedName) { $detectedName } else { $fallbackName }
if ($finalName) {
# Ensure the font is also registered in Console\TrueTypeFont
$trueTypeFontKey = "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont"
if (-not (Test-Path $trueTypeFontKey)) {
New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Console" -Name "TrueTypeFont" -Force | Out-Null
}
Set-ItemProperty -Path $trueTypeFontKey -Name "00" -Value $finalName -Force

$signature = @'
[DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, IntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out IntPtr lpdwResult);
'@
try {
$user32 = Add-Type -MemberDefinition $signature -Name "User32" -Namespace "Win32" -PassThru
$HWND_BROADCAST = [IntPtr]0xffff
$WM_SETTINGCHANGE = 0x001A
$SMTO_ABORTIFHUNG = 0x0002
$result = [IntPtr]::Zero
$user32::SendMessageTimeout($HWND_BROADCAST, $WM_SETTINGCHANGE, [IntPtr]::Zero, "Fonts", $SMTO_ABORTIFHUNG, 1000, [ref]$result) | Out-Null
} catch {}

Write-Output $finalName
} else {
Write-Warning "No valid fonts detected in $fontsSrc"
}
} else {
Write-Error "Fonts source path does not exist: $fontsSrc"
}
16 changes: 16 additions & 0 deletions bin/powershell7.6.3/deps.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
oh_my_posh = https://github.com/JanDeDobbeleer/oh-my-posh/releases/latest/download/posh-windows-amd64.exe
oh_my_posh_theme = https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/paradox.omp.json

# Cascadia Mono Nerd Font - Nerd Font required for Oh My Posh glyphs/icons in the terminal
# font_name - must be the windows system name for the font
oh_my_posh_font_name = "CaskaydiaMono NF"

# Terminal-Icons - PowerShell module for colorful file/folder icons
# Automatically downloads the latest version from PowerShell Gallery during build
terminal_icons = https://www.powershellgallery.com/api/v2/package/Terminal-Icons

# PSReadLine - Enhanced command-line editing with syntax highlighting, predictive IntelliSense, and history search
# Provides advanced editing features like multi-line editing, undo/redo, and customizable key bindings
# Automatically updated to the latest version from PowerShell Gallery during build process
# Note: PowerShell 7+ includes PSReadLine by default, but this ensures the latest version with newest features
psreadline = https://www.powershellgallery.com/api/v2/package/PSReadLine
Comment on lines +1 to +16

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Unpinned dependency downloads 🐞 Bug ⛨ Security

The 7.6.3 deps use moving targets (GitHub releases/latest, PowerShell Gallery unversioned package
endpoints, and a theme from main), and the build downloads them without any integrity
verification; the profile then executes oh-my-posh init output via Invoke-Expression, turning any
upstream change/compromise into startup-time code execution. This also makes builds non-reproducible
because the same versioned bundle can contain different binaries over time.
Agent Prompt
### Issue description
`bin/powershell7.6.3/deps.properties` references moving URLs (e.g., GitHub `releases/latest`, PowerShell Gallery `.../package/<Name>`, and a theme from the `main` branch). `build.gradle` downloads these artifacts with `downloadFile()` but does not verify hashes/signatures, and `Microsoft.PowerShell_profile.ps1` executes oh-my-posh init output via `Invoke-Expression`, amplifying any upstream compromise into code execution at shell startup.

### Issue Context
This is both a reproducibility problem (different artifacts for the same bundle version) and a supply-chain risk (remote executable/modules fetched at build time without integrity checks).

### Fix Focus Areas
- bin/powershell7.6.3/deps.properties[1-16]
- build.gradle[659-689]
- build.gradle[888-943]
- build.gradle[165-206]
- bin/powershell7.6.3/config/Microsoft.PowerShell_profile.ps1[18-24]

### Suggested remediation
- Replace moving URLs with version-pinned URLs:
  - Oh My Posh: use a specific tag URL (like the 7.5.4 approach) instead of `releases/latest`.
  - Theme: pin to a specific commit/tag (avoid `main`), or vendor the theme into the repo/build inputs.
  - PowerShell Gallery modules: use versioned package URLs (`.../package/Terminal-Icons/<version>`, `.../package/PSReadLine/<version>`).
- Add integrity verification in `build.gradle`:
  - Extend `deps.properties` with SHA256 (or similar) fields per artifact and have `downloadFile()` verify the hash before copying/using.
- (Optional hardening) If feasible, reduce reliance on `Invoke-Expression` by using oh-my-posh’s recommended safer initialization pattern, or at minimum only run it when the binary/theme hash matches expected values.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Loading
Loading