OpenSSH: install as part of VM setup, not WinRM

aramprice · aramprice · commit a3c2d388370e · 2025-08-01T16:18:58.000-07:00
It appears that executing `Add-WindowsCapability` via WinRM is not viable, this commit moves the installation of OpenSSH.Server to the various IaaS pre-boot scrips which are not executed via WinRM. The installation of OpenSSSH.Server was added as follows: Azure: add a `custom_script` parameter to packer config AWS: added to `setup_winrm.txt` GCP: add to `setup-winrm.ps1` and use `sysprep-specialize-script-ps1` As of July 2025 windows stemcells have converted to using Microsoft's official OpenSSH installation method[1]. This commit remove the remnants of previous installation methods, and switches to the above non-WinRM method for installation. [1] https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
diff --git a/ci/pipelines/stemcells-windows.yml b/ci/pipelines/stemcells-windows.yml
@@ -208,13 +208,6 @@ resources:
     password: ((docker.password))
 
 # type: github-release
-- name: openssh-release
-  type: github-release
-  source:
-    owner: PowerShell
-    repository: Win32-OpenSSH
-    access_token: ((github_public_repo_token))
-    tag_filter: v([^v].*)
 - name: stemcell-builder-github-release
   type: github-release
   source:
@@ -797,8 +790,6 @@ jobs:
         tags: [*worker_tag]
       - get: bosh-windows-stemcell-builder-ci-image
         tags: [*worker_tag]
-      - get: open-ssh
-        resource: openssh-release
       - get: stemcell-builder
         passed: [build]
         tags: [*worker_tag]
@@ -910,8 +901,6 @@ jobs:
         tags: [*worker_tag]
       - get: bosh-windows-stemcell-builder-ci-image
         tags: [*worker_tag]
-      - get: open-ssh
-        resource: openssh-release
       - get: stemcell-builder
         passed: [build]
         tags: [*worker_tag]
@@ -1369,8 +1358,6 @@ jobs:
       - get: main-version
         passed: [build]
         tags: [*worker_tag]
-      - get: sshd
-        resource: openssh-release
       - get: bosh-agent-release
         passed: [build]
       - get: blobstore-dav-cli
@@ -1550,8 +1537,6 @@ jobs:
       - get: main-version
         passed: [wuts-aws]
         tags: [*worker_tag]
-      - get: sshd
-        resource: openssh-release
       - get: bosh-agent-release
         passed: [wuts-aws]
       - get: blobstore-dav-cli
@@ -1711,8 +1696,6 @@ jobs:
       - get: main-version
         passed: [build]
         tags: [*worker_tag]
-      - get: sshd
-        resource: openssh-release
       - get: bosh-agent-release
         passed: [build]
       - get: blobstore-dav-cli
@@ -1908,8 +1891,6 @@ jobs:
       - get: main-version
         passed: [build]
         tags: [*worker_tag]
-      - get: sshd
-        resource: openssh-release
       - get: bosh-agent-release
         passed: [build]
       - get: blobstore-dav-cli
diff --git a/ci/tasks/create-azure-stemcell/task.yml b/ci/tasks/create-azure-stemcell/task.yml
@@ -6,7 +6,6 @@ inputs:
   - name: version
   - name: stemcell-builder
   - name: lgpo-binary
-  - name: sshd
   - name: bosh-agent-release
   - name: blobstore-dav-cli
   - name: blobstore-s3-cli
diff --git a/ci/tasks/create-gcp-stemcell/task.yml b/ci/tasks/create-gcp-stemcell/task.yml
@@ -7,7 +7,6 @@ inputs:
   - name: base-gcp-image
   - name: version
   - name: lgpo-binary
-  - name: sshd
   - name: bosh-agent-release
   - name: blobstore-dav-cli
   - name: blobstore-s3-cli
diff --git a/ci/tasks/generate-deps-file/run.bash b/ci/tasks/generate-deps-file/run.bash
@@ -1,9 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-openssh_win64_sha256="$(shasum -a 256 open-ssh/OpenSSH-Win64.zip | cut -d " " -f 1)"
-openssh_win64_version="$(cat open-ssh/version)"
-
 psmodules_sha256="$(shasum -a 256 psmodules-zip-output/bosh-psmodules.zip | cut -d " " -f 1)"
 psmodules_version="$(cat version/version)"
 
@@ -15,10 +12,6 @@ lgpo_version="3"
 
 cat <<EOF > deps-file/deps.json
 {
-  "OpenSSH-Win64.zip": {
-    "sha": "${openssh_win64_sha256}",
-    "version": "${openssh_win64_version}"
-  },
   "bosh-psmodules.zip": {
     "sha": "${psmodules_sha256}",
     "version": "${psmodules_version}"
diff --git a/ci/tasks/generate-deps-file/task.yml b/ci/tasks/generate-deps-file/task.yml
@@ -4,7 +4,6 @@ platform: linux
 inputs:
   - name: bosh-windows-stemcell-builder-ci
   - name: stemcell-builder
-  - name: open-ssh
   - name: lgpo-binary
   - name: version
   - name: bosh-agent
diff --git a/ci/tasks/zip-files/run.bash b/ci/tasks/zip-files/run.bash
@@ -6,7 +6,6 @@ ROOT_DIR=$(pwd)
 REPO_ROOT="${REPO_ROOT:-"$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"}"
 ZIP_FILE_DESTINATION="${ZIP_FILE_DESTINATION:-"${ROOT_DIR}/zip-file/StemcellAutomation-$(date +"%s").zip"}"
 
-OPENSSH_ZIP="${OPENSSH_ZIP:-"${ROOT_DIR}/open-ssh/OpenSSH-Win64.zip"}"
 BOSH_PSMODULES_ZIP="${BOSH_PSMODULES_ZIP:-"${ROOT_DIR}/psmodules-zip-output/bosh-psmodules.zip"}"
 AGENT_ZIP="${AGENT_ZIP:-"${ROOT_DIR}/bosh-agent/agent.zip"}"
 DEPS_JSON="${DEPS_JSON:-"${ROOT_DIR}/deps-file/deps.json"}"
@@ -20,7 +19,7 @@ mkdir -p "${stemcell_automation_dir}"
 
 declare -a files_to_zip
 mapfile -t files_to_zip < <(find "${REPO_ROOT}/stembuild/stemcell-automation" -type f -not -name "*Test*" -name "*.ps*1")
-files_to_zip+=("${OPENSSH_ZIP}" "${BOSH_PSMODULES_ZIP}" "${AGENT_ZIP}" "${DEPS_JSON}")
+files_to_zip+=("${BOSH_PSMODULES_ZIP}" "${AGENT_ZIP}" "${DEPS_JSON}")
 
 cp "${files_to_zip[@]}" "${stemcell_automation_dir}"
 
diff --git a/ci/tasks/zip-files/task.yml b/ci/tasks/zip-files/task.yml
@@ -4,7 +4,6 @@ platform: linux
 inputs:
   - name: bosh-windows-stemcell-builder-ci
   - name: stemcell-builder
-  - name: open-ssh
   - name: deps-file
   - name: bosh-agent
   - name: psmodules-zip-output
diff --git a/lib/packer/config/azure.rb b/lib/packer/config/azure.rb
@@ -45,7 +45,8 @@ def builders
                 'winrm_use_ssl' => 'true',
                 'winrm_insecure' => 'true',
                 'winrm_timeout' => '1h',
-                'winrm_username' => 'packer'
+                'winrm_username' => 'packer',
+                'custom_script' => 'powershell -ExecutionPolicy Unrestricted -NoProfile -NonInteractive -Command "Add-WindowsCapability -Online -Name (Get-WindowsCapability -Online -Name OpenSSH.Server* | ForEach-Object Name)"'
             }
         ]
       end
diff --git a/lib/packer/config/gcp.rb b/lib/packer/config/gcp.rb
@@ -39,6 +39,7 @@ def initialize(
       end
 
       def builders
+        stemcell_builder_dir = File.expand_path('../../../../', __FILE__)
         [
           {
             'type' => 'googlecompute',
@@ -62,7 +63,7 @@ def builders
             'winrm_timeout' => '1h',
             'state_timeout' => '10m',
             'metadata' => {
-              'sysprep-specialize-script-url' => 'https://raw.githubusercontent.com/cloudfoundry/bosh-windows-stemcell-builder/master/scripts/gcp/setup-winrm.ps1',
+              'sysprep-specialize-script-ps1' => File.read(File.join(stemcell_builder_dir, 'scripts', 'gcp', 'setup-winrm.ps1')),
               'name' => "#{@vm_prefix}-#{Time.now.to_i}",
             }.compact_blank!
           }
diff --git a/lib/packer/config/templates/provision_windows2019.json.erb b/lib/packer/config/templates/provision_windows2019.json.erb
@@ -137,11 +137,6 @@
       "Protect-CFCell -IaaS <%= iaas %>"
     ]
   },
-  {
-    "type": "file",
-    "source": "../sshd/OpenSSH-Win64.zip",
-    "destination": "C:\\provision\\OpenSSH-Win64.zip"
-  },
   {
     "type": "powershell",
     "inline": [
diff --git a/modules/BOSH.SSH/BOSH.SSH.Tests.ps1 b/modules/BOSH.SSH/BOSH.SSH.Tests.ps1
@@ -60,53 +60,6 @@ Describe "BOSH.SSH" {
         BeforeEach {
             Mock Set-Service { } -ModuleName BOSH.SSH
             Mock Edit-DefaultOpenSSHConfig { } -ModuleName BOSH.SSH
-
-            Mock -ModuleName BOSH.SSH -CommandName Get-WindowsCapability { }
-        }
-
-        Context "when 'Get-OSVersion' returns 'windows2019'" {
-            BeforeEach {
-                Mock -ModuleName BOSH.SSH -CommandName Get-OSVersion { "windows2019" }
-            }
-
-            Context "When OpenSSH components are installed" {
-                BeforeEach {
-                    Mock -ModuleName BOSH.SSH -CommandName Get-WindowsCapability {
-                        [PSCustomObject]@{
-                            State = "NotPresent"
-                            Name = "$Name"
-                        }
-                    }
-
-                    Mock -ModuleName BOSH.SSH -CommandName Add-WindowsCapability { } -Verifiable
-                }
-
-                It "attempts to install the packages" {
-                    Install-SSHD
-
-                    Should -Invoke -ModuleName BOSH.SSH -CommandName Add-WindowsCapability -Times 1 -ParameterFilter {
-                        $Name -like "OpenSSH.Client*"
-                    }
-                    Should -Invoke -ModuleName BOSH.SSH -CommandName Add-WindowsCapability -Times 1 -ParameterFilter {
-                        $Name -like "OpenSSH.Server*"
-                    }
-                }
-            }
-
-            Context "When OpenSSH components are NOT installed" {
-                BeforeEach {
-                    Mock -ModuleName BOSH.SSH -CommandName Get-WindowsCapability {
-                        [PSCustomObject]@{ State = "NOT-NotPresent" }
-                    }
-                    Mock -ModuleName BOSH.SSH -CommandName Add-WindowsCapability { } -Verifiable
-                }
-
-                It "does not attempt to install the packages" {
-                    Install-SSHD
-
-                    Should -Not -Invoke -ModuleName BOSH.SSH -CommandName Add-WindowsCapability
-                }
-            }
         }
 
         It "sets the startup type of sshd to disabled" {
diff --git a/modules/BOSH.SSH/BOSH.SSH.psm1 b/modules/BOSH.SSH/BOSH.SSH.psm1
@@ -1,19 +1,5 @@
 ﻿function Install-SSHD
 {
-    if (Get-OSVersion == "windows2019") {
-        # Microsoft privided OpenSSH must be installed on Windows 2019
-        # => https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell&pivots=windows-server-2019
-        $sshPackages = @("OpenSSH.Client", "OpenSSH.Server")
-        foreach ($sshPackage in $sshPackages) {
-            try {
-                $moduleName = (Get-WindowsCapability -Online -Name "$sshPackage*" | ForEach-Object Name)
-                Add-WindowsCapability -Online -Name $moduleName
-            } catch {
-                Write-Output "Error installing $moduleName : $_"
-            }
-        }
-    }
-
     Edit-DefaultOpenSSHConfig
 
     Set-Service -Name sshd -StartupType Disabled
diff --git a/scripts/aws/setup_winrm.txt b/scripts/aws/setup_winrm.txt
@@ -34,5 +34,10 @@ if (-not (Get-Command Enable-WinRM -errorAction SilentlyContinue))
 Write-Log "Invoking WinRM"
 Enable-WinRM
 
+Write-Log "Install OpenSSH.Server"
+Write-Log (Get-WindowsCapability -Online -Name "OpenSSH.Server*" | Format-List | Out-String)
+Add-WindowsCapability -Online -Name (Get-WindowsCapability -Online -Name "OpenSSH.Server*" | ForEach-Object Name)
+Write-Log (Get-WindowsCapability -Online -Name "OpenSSH.Server*" | Format-List | Out-String)
+
 Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope LocalMachine
 </powershell>
diff --git a/scripts/gcp/setup-winrm.ps1 b/scripts/gcp/setup-winrm.ps1
@@ -32,3 +32,8 @@ if (-not (Get-Command Enable-WinRM -errorAction SilentlyContinue))
 
 Write-Log "Invoking WinRM"
 Enable-WinRM
+
+Write-Log "Install OpenSSH.Server"
+Write-Log (Get-WindowsCapability -Online -Name "OpenSSH.Server*" | Format-List | Out-String)
+Add-WindowsCapability -Online -Name (Get-WindowsCapability -Online -Name "OpenSSH.Server*" | ForEach-Object Name)
+Write-Log (Get-WindowsCapability -Online -Name "OpenSSH.Server*" | Format-List | Out-String)
diff --git a/spec/packer/config/aws_spec.rb b/spec/packer/config/aws_spec.rb
@@ -2,11 +2,11 @@
 
 describe Packer::Config::Aws do
   describe 'builders' do
-    before :each do
+    before(:each) do
       Timecop.freeze
     end
 
-    after :each do
+    after(:each) do
       Timecop.return
     end
 
@@ -172,38 +172,37 @@
           vm_prefix: '',
           ).provisioners
         expected_provisioners_base = [
-          {"type" => "file", "source" => "build/bosh-psmodules.zip", "destination" => "C:\\provision\\bosh-psmodules.zip", "pause_before"=>"60s"},
-          {"type"=>"file", "source"=>"scripts/install-bosh-psmodules.ps1", "destination"=>"C:\\provision\\install-bosh-psmodules.ps1", "pause_before"=>"60s"},
-          {"type"=>"powershell", "inline"=>['$ErrorActionPreference = "Stop";', 'C:\\provision\\install-bosh-psmodules.ps1'], "pause_before"=>"60s"},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "New-Provisioner"]},
-          {"type"=>"powershell", "inline"=> ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Remove-DockerPackage"]},
-          {"type" => "windows-restart", "restart_timeout" => "1h", "check_registry" => true},
-          {"type"=>"powershell", "inline"=> ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Install-CFFeatures -IaaS aws"]},
-          {"type" => "windows-restart", "restart_timeout" => "1h", "check_registry" => true},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Add-Account -User Provisioner -Password some-password!"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Register-WindowsUpdatesTask"]},
-          {"type"=>"powershell", "inline"=> ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Wait-WindowsUpdates -Password some-password! -User Provisioner"]},
-          {"type" => "windows-restart", "restart_timeout" => "12h", "check_registry" => true},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Unregister-WindowsUpdatesTask"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Get-HotFix > hotfixes.log"]},
-          {"type" => "file", "source" => "hotfixes.log", "destination" => "hotfixes.log", "direction" => "download"},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Remove-Account -User Provisioner"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Protect-CFCell -IaaS aws"]},
-          {"type" => "file", "source" => "../sshd/OpenSSH-Win64.zip", "destination" => "C:\\provision\\OpenSSH-Win64.zip"},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Install-SSHD"]},
-          {"type"=>"powershell", "inline"=> ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-SSHD"]},
-          {"type" => "file", "source" => "build/agent.zip", "destination" => "C:\\provision\\agent.zip"},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Install-Agent -IaaS aws -agentZipPath 'C:\\provision\\agent.zip'"]},
-          {"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-RC4"]},
-          {"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS1"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS11"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-TLS12"]},
-          {"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-3DES"]},
-          {"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Get-WUCerts"]},
-          {"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Remove-SSHKeys"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Clear-Provisioner"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Set-InternetExplorerRegistries"]},
-          {"type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Invoke-Sysprep -IaaS aws"]}
+          { "type" => "file", "source" => "build/bosh-psmodules.zip", "destination" => "C:\\provision\\bosh-psmodules.zip", "pause_before" => "60s" },
+          { "type" => "file", "source" => "scripts/install-bosh-psmodules.ps1", "destination" => "C:\\provision\\install-bosh-psmodules.ps1", "pause_before" => "60s" },
+          { "type" => "powershell", "inline" => ['$ErrorActionPreference = "Stop";', 'C:\\provision\\install-bosh-psmodules.ps1'], "pause_before" => "60s" },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "New-Provisioner"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Remove-DockerPackage"] },
+          { "type" => "windows-restart", "restart_timeout" => "1h", "check_registry" => true },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Install-CFFeatures -IaaS aws"] },
+          { "type" => "windows-restart", "restart_timeout" => "1h", "check_registry" => true },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Add-Account -User Provisioner -Password some-password!"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Register-WindowsUpdatesTask"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Wait-WindowsUpdates -Password some-password! -User Provisioner"] },
+          { "type" => "windows-restart", "restart_timeout" => "12h", "check_registry" => true },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Unregister-WindowsUpdatesTask"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Get-HotFix > hotfixes.log"] },
+          { "type" => "file", "source" => "hotfixes.log", "destination" => "hotfixes.log", "direction" => "download" },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Remove-Account -User Provisioner"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Protect-CFCell -IaaS aws"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Install-SSHD"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-SSHD"] },
+          { "type" => "file", "source" => "build/agent.zip", "destination" => "C:\\provision\\agent.zip" },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Install-Agent -IaaS aws -agentZipPath 'C:\\provision\\agent.zip'"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-RC4"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS1"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS11"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-TLS12"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-3DES"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Get-WUCerts"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Remove-SSHKeys"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Clear-Provisioner"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Set-InternetExplorerRegistries"] },
+          { "type" => "powershell", "inline" => ["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Invoke-Sysprep -IaaS aws"] }
         ].flatten
         expect(provisioners.detect {|x| x['destination'] == "C:\\windows\\LGPO.exe"}).not_to be_nil
 
@@ -214,14 +213,13 @@
         line_by_line_provisioners = provisioners.delete_if {|x| x['destination'] == "C:\\windows\\LGPO.exe"}
         line_by_line_provisioners = line_by_line_provisioners.delete_if {|p| p.has_key?('inline') && p['inline'].include?("New-VersionFile -Version '#{version}'")}
 
-        expect(line_by_line_provisioners).to eq (expected_provisioners_base)
-
+        expect(line_by_line_provisioners).to eq(expected_provisioners_base)
 
         FileUtils.rm_rf(stemcell_deps_dir)
         ENV.delete('STEMCELL_DEPS_DIR')
       end
 
-      context 'when provisioning with emphemeral disk mounting enabled' do
+      context 'when provisioning with ephemeral disk mounting enabled' do
         it 'calls Install-Agent with -EnableEphemeralDiskMounting' do
           allow(SecureRandom).to receive(:hex).and_return("some-password")
           provisioners = Packer::Config::Aws.new(
diff --git a/spec/packer/config/azure_spec.rb b/spec/packer/config/azure_spec.rb
diff --git a/spec/packer/config/gcp_spec.rb b/spec/packer/config/gcp_spec.rb
diff --git a/spec/s3_spec.rb b/spec/s3_spec.rb
diff --git a/stembuild/stemcell-automation/AutomationHelpers.Tests.ps1 b/stembuild/stemcell-automation/AutomationHelpers.Tests.ps1

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,8 @@ def builders`
`45`	`45`	`'winrm_use_ssl' => 'true',`
`46`	`46`	`'winrm_insecure' => 'true',`
`47`	`47`	`'winrm_timeout' => '1h',`
`48`		`- 'winrm_username' => 'packer'`
	`48`	`+ 'winrm_username' => 'packer',`
	`49`	`+ 'custom_script' => 'powershell -ExecutionPolicy Unrestricted -NoProfile -NonInteractive -Command "Add-WindowsCapability -Online -Name (Get-WindowsCapability -Online -Name OpenSSH.Server* \| ForEach-Object Name)"'`
`49`	`50`	`}`
`50`	`51`	`]`
`51`	`52`	`end`
Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,7 @@ def initialize(`
`39`	`39`	`end`
`40`	`40`
`41`	`41`	`def builders`
	`42`	`+ stemcell_builder_dir = File.expand_path('../../../../', __FILE__)`
`42`	`43`	`[`
`43`	`44`	`{`
`44`	`45`	`'type' => 'googlecompute',`
`@@ -62,7 +63,7 @@ def builders`
`62`	`63`	`'winrm_timeout' => '1h',`
`63`	`64`	`'state_timeout' => '10m',`
`64`	`65`	`'metadata' => {`
`65`		`- 'sysprep-specialize-script-url' => 'https://raw.githubusercontent.com/cloudfoundry/bosh-windows-stemcell-builder/master/scripts/gcp/setup-winrm.ps1',`
	`66`	`+ 'sysprep-specialize-script-ps1' => File.read(File.join(stemcell_builder_dir, 'scripts', 'gcp', 'setup-winrm.ps1')),`
`66`	`67`	`'name' => "#{@vm_prefix}-#{Time.now.to_i}",`
`67`	`68`	`}.compact_blank!`
`68`	`69`	`}`
Original file line number	Diff line number	Diff line change
`@@ -137,11 +137,6 @@`
`137`	`137`	`"Protect-CFCell -IaaS <%= iaas %>"`
`138`	`138`	`]`
`139`	`139`	`},`
`140`		`- {`
`141`		`- "type": "file",`
`142`		`- "source": "../sshd/OpenSSH-Win64.zip",`
`143`		`- "destination": "C:\\provision\\OpenSSH-Win64.zip"`
`144`		`- },`
`145`	`140`	`{`
`146`	`141`	`"type": "powershell",`
`147`	`142`	`"inline": [`