A fork of ssh-copy-id that installs keys on Windows OpenSSH servers, for
both regular users and members of Administrators, while keeping the
standard behaviour on *nix targets.
Windows design constraints:
- Dispatches everything as `cmd.exe /c "<inner>"`, since a host's sshd
DefaultShell is unpredictable. PowerShell is never assumed present.
- Uses exactly one quote pair with no quotes inside <inner>. A PowerShell
DefaultShell re-escapes nested quotes as \", which cmd.exe cannot parse.
Staying quote-free means cd'ing to the base directory first and using
short relative paths, and deduping on the whitespace-free base64 blob.
- No hard-coded drive letters; %USERPROFILE% and %ProgramData% only.
- Administrators are written to administrators_authorized_keys with the
SYSTEM + Administrators ACL that Windows sshd requires, because the
stock Match Group administrators block makes it the only file consulted
for those accounts.
- Group and ACL checks match on SIDs, not names, so they work on
non-English Windows locales.
- All steps share one multiplexed connection, so password-auth hosts
prompt once rather than once per step.
Two cmd.exe parsing traps are worked around, both of which corrupted the
remote file with no error output:
- `echo KEY>>file && echo DONE` leaves the space before `&&` inside the
echoed text, appending a trailing space that defeats exact-match dedup
and duplicates the key on every run. Uses `(echo KEY)>>file` instead.
- An unparenthesised `if not exist ... & ...` swallows the rest of the
command chain when the directory already exists, silently skipping
everything after it.
Verified on Linux, Windows Administrator, and Windows regular-user
targets, each for both first install and duplicate detection.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
