Asami Windows enroller

Standalone Windows pre-enrollment utility used to converge a Windows host into the SSH state required for Asami remote administration.

The current recovered line is the historical Asami Windows PreEnroll v6. It is a one-shot bootstrap utility, not the final REM1 implementation: it creates/converges the legacy local Asami maintenance account, installs the dedicated maintenance public key, converges OpenSSH Server and restricts the inbound SSH firewall rule to Terry.

Source provenance

The original temporary build tree was lost with the unavailable Atelier-A2. The repository was reconstructed from the shipped binaries on 2026-09-25.

What is exact:

• the embedded PowerShell workers for v3, v4, v5 and v6;
• the embedded OpenSSH MSI used by those versions;
• artifact sizes and SHA-256 values recorded in HISTORY.md.

What is reconstructed:

• the Go GUI/orchestration source (main.go);
• the Git commit history representing the v3 -> v6 evolution.

The reconstructed Go source follows the observed application behavior, retained Go symbols/module metadata, embedded UI strings and the known build procedure. It is maintainable source, but it is not claimed to reproduce the historical EXE byte-for-byte. See RECOVERY.md.

Build

Requirements:

• Go 1.25.1;
• network access on the first build to obtain the pinned Go modules and github.com/akavel/rsrc@v0.10.2.

Build the Windows x64 executable:

scripts/build.sh

The result is written to:

dist/Asami-Windows-PreEnroll.exe

The build uses the same relevant target settings recovered from the shipped binary metadata:

GOOS=windows
GOARCH=amd64
CGO_ENABLED=0
-trimpath
-ldflags="-s -w -H windowsgui"

Runtime flow

The executable:

1. requests/ensures administrative elevation;
2. extracts its embedded worker.ps1 and openssh.msi to a temporary directory;
3. runs the PowerShell worker non-interactively;
4. projects @@PROGRESS, @@LOG, @@DONE and @@ERROR events into the GUI;
5. removes the temporary extraction directory when the worker finishes.

The v6 worker is the exact payload recovered from the shipped v6 executable.

Repository history

The source history starts at reconstructed v3 because the v1/v2 source payloads could not be recovered with sufficient confidence. v1 and v2 are still documented as shipped artifacts in HISTORY.md.

All reconstruction commits are explicitly named "Reconstruct ..."; their Git timestamps are the reconstruction timestamps rather than invented historical commit dates.