Module windows 

Windows toolchain provisioning — “our apt” for the HCS sandbox.

The Windows analogue of the macOS crate::source_build / crate::prebuilt paths. The HCS sandbox has no package manager, so this provisions a named tool into a self-contained, relocatable toolchain with the same ToolchainManifest layout the macOS toolchains use, and the same on-disk cache key (<cache>/<tool>-<version>-<arch>/ + a .ready marker).

Strategy

1. git → MinGit (ensure_mingit). Git for Windows publishes MinGit, a fully self-contained, relocatable portable zip (no installer, no registry writes, no absolute-path baking) — exactly the Windows equivalent of a relocation-free toolchain. We resolve the latest release from the git-for-windows/git GitHub releases, fetch the right architecture’s MinGit-<ver>-{64-bit,arm64}.zip, and extract it into the toolchain.
2. Everything else → Chocolatey. The package is resolved through the ZLayer package index (/choco/:name → .nupkg URL + version), the .nupkg is downloaded (digest-verified when the index/lockfile carries one) and its tools/chocolateyInstall.ps1 is parsed into an InstallPlan by crate::recipe_choco:
   • Portable zip / web-file packages — plans made only of InstallStep::StageResource / InstallStep::PrefixInstall / InstallStep::BinInstall — execute leaf-side: each resource is fetched (sha256-verified from the ps1’s embedded checksums; an empty checksum — the weak-checksum case crate::recipe_choco documents — downloads unverified with a loud warning) and extracted/staged into the toolchain prefix. This is fetch + unzip, no arbitrary code — the same trust class as MinGit.
   • exe/msi installer packages (any other plan shape) run choco install inside a Windows container through the registered crate::executor::ContainerBuildExecutor with the network allowed loudly (grep NET-FALLBACK). When no executor is registered this fails with ToolchainError::ExecutorUnavailable — never a host subprocess, and never a wrong binary.

This module is compiled on all hosts (it is pure HTTP + zip extraction + manifest I/O; the executor call is platform-tagged data, not cfg’d code), so the toolchain format, the MinGit resolver, and the choco chain are unit-testable on a macOS build host even though the toolchains are only provisioned for Windows containers.

Functions

ensure_mingit

Provision the git toolchain from MinGit (a relocatable portable zip).

ensure_windows_toolchain

Provision (or reuse) a Windows toolchain for pkg, returning the toolchain directory.

windows_arch_token

Architecture token used in toolchain cache keys + MinGit asset names (x86_64/arm64).