Improve SGU logon resilience and client UX

scripts/Install-CredentialProvider.ps1

@@ -17,8 +17,8 @@ param(
 
     [string]$DomainNetbios = 'LCI',
 
-    [ValidateRange(2, 30)]
-    [int]$TimeoutSeconds = 6,
+    [ValidateRange(2, 60)]
+    [int]$TimeoutSeconds = 20,
 
     [switch]$InstallDotNetRuntime,
 
@@ -27,7 +27,7 @@ param(
 
 $ErrorActionPreference = 'Stop'
 $providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
-$installPath = Join-Path $env:ProgramFiles 'SGU\CredentialProvider'
+$installRoot = Join-Path $env:ProgramFiles 'SGU\CredentialProvider'
 $settingsPath = Join-Path $env:ProgramData 'SGU\CredentialProvider\settings.json'
 $providerRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$providerClassId"
 $classRegistryPath = "HKLM:\SOFTWARE\Classes\CLSID\$providerClassId\InprocServer32"
@@ -100,6 +100,30 @@ foreach ($file in $requiredFiles) {
     }
 }
 
+$resolvedPublishPath = (Resolve-Path -LiteralPath $PublishPath).Path.TrimEnd('\')
+$packageManifest = Get-ChildItem -LiteralPath $resolvedPublishPath -Recurse -File |
+    Sort-Object FullName |
+    ForEach-Object {
+        $relativePath = $_.FullName.Substring($resolvedPublishPath.Length).TrimStart('\')
+        '{0}={1}' -f $relativePath, (Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256).Hash
+    }
+$manifestBytes = [Text.Encoding]::UTF8.GetBytes(($packageManifest -join "`n"))
+$sha256 = [Security.Cryptography.SHA256]::Create()
+try {
+    $packageHash = -join ($sha256.ComputeHash($manifestBytes) | ForEach-Object { $_.ToString('x2') })
+}
+finally {
+    $sha256.Dispose()
+}
+
+$versionId = $packageHash.Substring(0, 16)
+$installPath = Join-Path $installRoot "versions\$versionId"
+$completeMarker = Join-Path $installPath '.complete'
+if ((Test-Path -LiteralPath $installPath) -and -not (Test-Path -LiteralPath $completeMarker)) {
+    $installPath = '{0}-{1}' -f $installPath, ([Guid]::NewGuid().ToString('N').Substring(0, 8))
+    $completeMarker = Join-Path $installPath '.complete'
+}
+
 $clientThumbprint = $ClientCertificateThumbprint -replace ' ', ''
 $serverThumbprint = $ServerCertificateThumbprint -replace ' ', ''
 if ($clientThumbprint.Length -ne 40 -or $serverThumbprint.Length -ne 40) {
@@ -121,8 +145,11 @@ if (-not $serverCertificate) {
 }
 
 if ($PSCmdlet.ShouldProcess($installPath, 'Install and register the SGU Credential Provider')) {
-    New-Item -ItemType Directory -Path $installPath -Force | Out-Null
-    Copy-Item -Path (Join-Path $PublishPath '*') -Destination $installPath -Recurse -Force
+    if (-not (Test-Path -LiteralPath $completeMarker)) {
+        New-Item -ItemType Directory -Path $installPath -Force | Out-Null
+        Copy-Item -Path (Join-Path $resolvedPublishPath '*') -Destination $installPath -Recurse -Force
+        [IO.File]::WriteAllText($completeMarker, $packageHash, [Text.UTF8Encoding]::new($false))
+    }
 
     New-Item -ItemType Directory -Path (Split-Path $settingsPath -Parent) -Force | Out-Null
     $settingsJson = @{