fix: read the owner without Get-Acl in Windows PowerShell

A Windows PowerShell started by a program that pwsh started inherits
pwsh's PSModulePath, so autoloading Get-Acl picks PowerShell 7's
Microsoft.PowerShell.Security, which fails to load. Test-Mine swallowed
the error, so every checkout looked foreign and the installer downloaded
instead (CI: all Windows PowerShell checkout tests got a 404).

Windows PowerShell now reads the owner through .NET Framework's
File/Directory.GetAccessControl; pwsh keeps Get-Acl. An owner that
cannot be read still counts as foreign, but the note now says why.

Author: FridrichMethod

install.ps1

@@ -132,20 +132,36 @@ function Test-Link([string]$Path) {
 # $Path is no link and belongs to the user running this script: on Windows
 # its owner is this user or the owner this user's new files get (the
 # Administrators group in an elevated session on Windows Server); elsewhere
-# its uid is the one id -u prints.
+# its uid is the one id -u prints. An owner it cannot read is not the user's,
+# and the note says why.
 $Uid = $null
 function Test-Mine([string]$Path) {
     if (Test-Link $Path) { return $false }
     try {
         if ($OnWindows) {
-            $owner = (Get-Acl -LiteralPath $Path).GetOwner([Security.Principal.SecurityIdentifier])
+            if ($PSVersionTable.PSEdition -eq 'Desktop') {
+                # .NET Framework reads the owner itself. Get-Acl would autoload
+                # Microsoft.PowerShell.Security, which fails when PSModulePath
+                # lists PowerShell 7's modules first, as it does in a Windows
+                # PowerShell started by a program that pwsh started.
+                $sections = [Security.AccessControl.AccessControlSections]::Owner
+                $acl = if ([IO.Directory]::Exists($Path)) {
+                    [IO.Directory]::GetAccessControl($Path, $sections)
+                } else {
+                    [IO.File]::GetAccessControl($Path, $sections)
+                }
+            } else {
+                $acl = Get-Acl -LiteralPath $Path
+            }
+            $owner = $acl.GetOwner([Security.Principal.SecurityIdentifier])
             $me = [Security.Principal.WindowsIdentity]::GetCurrent()
             return ($null -ne $owner) -and (($owner -eq $me.User) -or ($owner -eq $me.Owner))
         }
         if ($null -eq $script:Uid) { $script:Uid = ([string](& id -u)).Trim() }
         $owner = [string](Get-Item -LiteralPath $Path -Force).UnixStat.UserId
         return ($script:Uid -ne '') -and ($owner -eq $script:Uid)
     } catch {
+        [Console]::Error.WriteLine("${Prog}: note: cannot read the owner of ${Path}: $($_.Exception.Message)")
         return $false
     }
 }

tests/test_install.py

@@ -425,6 +425,22 @@ class PwshInstallerTests(PowerShellContract, unittest.TestCase):
 class WindowsPowerShellInstallerTests(PowerShellContract, unittest.TestCase):
     exe = WINDOWS_POWERSHELL or ""
 
+    def test_checkout_mode_with_pwsh_modules_on_the_module_path(self):
+        # Windows PowerShell started by a program that pwsh started (python
+        # under a pwsh CI step, say) inherits pwsh's PSModulePath, so a cmdlet
+        # it autoloads, such as Get-Acl, comes from PowerShell 7's module and
+        # fails to load. The ownership check must not depend on one.
+        modules = Path(PWSH).resolve().parent / "Modules" if PWSH else None
+        if modules is None or not (modules / "Microsoft.PowerShell.Security").is_dir():
+            self.skipTest("no PowerShell 7 Microsoft.PowerShell.Security module")
+        env = {k: v for k, v in self.env.items() if k.upper() != "PSMODULEPATH"}
+        inherited = [v for k, v in self.env.items() if k.upper() == "PSMODULEPATH"]
+        env["PSModulePath"] = os.pathsep.join([str(modules), *inherited])
+        files = configs("checkout")
+        self.install(self.checkout(files), self.prefix_flag, str(self.prefix), env=env)
+        self.assert_installed(self.prefix, files)
+        self.assertEqual(self.server.requests, [])
+
 
 if __name__ == "__main__":
     unittest.main()