Add dotnetup <> install under admin mode MVP

.github/memory/FILE_MAP.md

@@ -63,7 +63,7 @@ Important root files:
 | [`src/Common`](../../src/Common), [`src/Microsoft.DotNet.ProjectTools`](../../src/Microsoft.DotNet.ProjectTools), [`src/Microsoft.Extensions.Logging.MSBuild`](../../src/Microsoft.Extensions.Logging.MSBuild) | Cross-area utilities, project tooling, and MSBuild logging support. | Consumed by the owning product areas; verify references before changing shared code. |
 | [`src/Microsoft.Net.Sdk.Compilers.Toolset`](../../src/Microsoft.Net.Sdk.Compilers.Toolset), [`src/Microsoft.Win32.Msi`](../../src/Microsoft.Win32.Msi), [`src/System.CommandLine.StaticCompletions`](../../src/System.CommandLine.StaticCompletions) | Compiler toolset packaging, Windows installer support, and shell completion generation. | Consumed by layout, CLI, or platform-specific builds and tests. |
 | [`src/SourceBuild`](../../src/SourceBuild) | Source-build-specific content and integration. | Consumed by the VMR/source-only build; use source-build guidance for source-only failures. |
-| [`src/Installer`](../../src/Installer) | dotnetup NativeAOT entry point, command library, and installation library. See the [self-update design](../../documentation/general/dotnetup/designs/self-update/self-update-design.md) and [version-query contract](../../documentation/general/dotnetup/designs/self-update/self-update-verification.md). | Self-update uses bounded `--version` children for installed-version queries and startup verification, except that the Windows command gate reads the PE version resource in-process, and Windows self-update links the workload Authenticode checks from `src/Cli/dotnet/Installer/Windows/Security/Signature.cs`; rollback uses transaction state, not an embedded record. Tested by `test/dotnetup.Tests`. |
+| [`src/Installer`](../../src/Installer) | dotnetup NativeAOT entry point, command library, and installation library. See the [self-update design](../../documentation/general/dotnetup/designs/self-update/self-update-design.md) and [version-query contract](../../documentation/general/dotnetup/designs/self-update/self-update-verification.md). | Self-update uses bounded `--version` children for installed-version queries and startup verification, except that the Windows command gate reads the PE version resource in-process, and Windows self-update links the workload Authenticode checks from `src/Cli/dotnet/Installer/Windows/Security/Signature.cs`; rollback uses transaction state, not an embedded record. Windows `admin` mode ([design](../../documentation/general/dotnetup/designs/dotnetup-admin-mode.md)) is selected by the `HKLM\SOFTWARE\Policies\Microsoft\dotnet\Dotnetup!AdminMode` value, gates commands through `CommandBase.GetAdminModeSupport`, and installs `.exe` bundles through `src/Installer/dotnetup.Library/WindowsInstaller`. Tested by `test/dotnetup.Tests`. |
 
 ## Test Structure
 

documentation/general/dotnetup/concepts/environment.md

@@ -26,6 +26,7 @@ or later with the `dotnetup env` command.
 | `none` | Does not modify these environment variables. Run .NET with `dotnetup dotnet`. |
 | `shell` | Modifies the shell profile to set these environment variables. Processes started from that shell use the .NET SDKs and Runtimes installed by dotnetup. |
 | `everywhere` | Modifies the system `PATH` and sets the user-level `DOTNET_ROOT` environment variable. Only available on Windows. |
+| `admin` | Does not modify these environment variables. Installs run the official .NET installers into Program Files, which manage the system `PATH` themselves. Machine-wide; only available on Windows. See [dotnetup admin mode](../designs/dotnetup-admin-mode.md). |
 
 By default, dotnetup also adds itself to the `PATH`, regardless of the access
 mode setting.  This can be controlled with

documentation/general/dotnetup/reference/dotnetup-env-set.md

@@ -28,12 +28,15 @@ The optional .NET access mode:
 | `none` | Does not modify these environment variables. Run .NET with `dotnetup dotnet`. |
 | `shell` | Modifies the shell profile to set these environment variables. Processes started from that shell use the .NET SDKs and Runtimes installed by dotnetup. |
 | `everywhere` | Modifies the system `PATH` and sets the user-level `DOTNET_ROOT` environment variable. Only available on Windows. |
+| `admin` | Switches this machine to `admin` mode, in which installs run the official .NET installers into Program Files. Changes a machine-wide setting for all users and asks for administrator permission. Only available on Windows. See [dotnetup admin mode](../designs/dotnetup-admin-mode.md). |
 
 For details about each mode and considerations for `everywhere`, see
 [dotnetup environment configuration](../concepts/environment.md).
 
 When you omit `MODE`, the command reapplies the stored mode. The command
-fails if no readable configuration exists.
+fails if no readable configuration exists. While `admin` mode is active,
+omitting `MODE` makes no changes, and selecting another mode leaves `admin`
+mode first.
 
 ## Options
 

documentation/general/dotnetup/reference/dotnetup-init.md

@@ -28,10 +28,21 @@ system-managed installations. For descriptions of the access modes, see
 
 Run this command again to reconfigure dotnetup.
 
+### Admin mode
+
+On Windows, `--mode admin` switches the machine to `admin` mode, in which
+`dotnetup sdk install` and `dotnetup runtime install` run the official .NET
+installers into Program Files. Switching into or out of `admin` mode changes a
+machine-wide setting for all users and asks for administrator permission. While
+`admin` mode is active, `dotnetup init` without `--mode` makes no changes; run
+`dotnetup init --mode <none|shell|everywhere>` to leave it. For details, see
+[dotnetup admin mode](../designs/dotnetup-admin-mode.md).
+
 ## Options
 
 | Option | Description |
 | --- | --- |
+| `--mode <none\|shell\|everywhere\|admin>` | Select the access mode. Without this option, non-interactive runs keep their existing defaults. `admin` is only available on Windows; it switches this machine to `admin` mode and does not install .NET. |
 | `--install-path <INSTALL_PATH>` | Select the installation root. |
 | `--manifest-path <MANIFEST_PATH>` | Use a custom manifest file. |
 | `--no-progress [<true\|false>]` | Disable progress display. |
@@ -47,4 +58,5 @@ Run this command again to reconfigure dotnetup.
 dotnetup init
 dotnetup init --shell bash
 dotnetup init --install-path .\.dotnet
+dotnetup init --interactive false --mode admin
 ```

documentation/general/dotnetup/signature-verification.md

@@ -446,6 +446,15 @@ does two things:
    `UnsignedDownloadBlockedByPolicy` error (defense-in-depth check inside
   `DotnetDownloader.ResolveBlobFeedEntry`).
 
+The channel-based predicate only drives the warning. Admin-mode Windows installer
+bundles decide whether a failed Authenticode check is acceptable from the actual
+download source: only a bundle that was downloaded from the blob feed may run
+unsigned, after its SHA-512 hash is verified and only while the IT opt-out is off.
+A bundle resolved from the signed releases manifest must always pass Authenticode,
+whatever the channel. The bundle is re-hashed against the downloader's expected
+hash through a handle that denies write and delete access, and that handle is held
+until the installer exits.
+
 ### Enabling the IT opt-out
 
 Administrators that want to disallow unsigned dnup downloads can set
@@ -463,6 +472,13 @@ the policy with the platform-appropriate switch:
 
   Clear the policy by deleting the value (or setting it to `0`).
 
+  Enabling dotnetup `admin` mode also sets this value to `1`, and leaving
+  `admin` mode leaves it unchanged. In `admin` mode, the value controls
+  whether unsigned daily `.exe` installers may run; see
+  [dotnetup admin mode](designs/dotnetup-admin-mode.md). The `AdminMode`
+  value under the same key selects `admin` mode and uses the same `0`/`1`
+  structure.
+
 - **Linux / macOS** — create the sentinel file
   `/etc/dotnet/dnup-block-unsigned-downloads` (any content; existence is
   what matters). Example:
@@ -478,6 +494,9 @@ When the policy is in effect, attempts to install from the daily channel
 (or any version that is not present in the signed releases manifest)
 fail with a clear `UnsignedDownloadBlockedByPolicy` message directing
 the user to choose a released version or escalate to their administrator.
+`dotnetup self update` is exempt only when the installed `dotnetup` is
+Authenticode-signed (Windows), because the replacement must then carry a
+Microsoft-rooted Authenticode signature before it is installed.
 
 The check is centralized in
 `src/Installer/Microsoft.Dotnet.Installation/Internal/UnsignedSourcePolicy.cs`.

src/Installer/Microsoft.Dotnet.Installation/DotnetInstallException.cs

@@ -166,6 +166,27 @@ public enum DotnetInstallErrorCode
 
     /// <summary>The user declined confirmation of an operation.</summary>
     OperationCancelled,
+
+    /// <summary>The invoked command is not supported while dotnetup is in admin mode.</summary>
+    AdminModeCommandNotSupported,
+
+    /// <summary>An option or argument passed to the command is not supported while dotnetup is in admin mode.</summary>
+    AdminModeSymbolNotSupported,
+
+    /// <summary>The operation requires <c>--untracked</c> while dotnetup is in admin mode.</summary>
+    AdminModeRequiresUntracked,
+
+    /// <summary>Admin mode could not be enabled or disabled because elevation was declined or failed, or the policy could not be written.</summary>
+    AdminModeChangeFailed,
+
+    /// <summary>Another Windows Installer (MSI) installation is in progress (exit code 1618).</summary>
+    InstallerBusy,
+
+    /// <summary>The Windows installer bundle returned a failure exit code.</summary>
+    InstallerFailed,
+
+    /// <summary>The Windows installer bundle reported success, but the expected installation could not be verified afterwards.</summary>
+    InstallerPostInstallVerificationFailed,
 }
 
 /// <summary>

src/Installer/Microsoft.Dotnet.Installation/Internal/DotnetArchiveExtractor.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.Dotnet.Installation.Internal;
 
-internal class DotnetArchiveExtractor : IDisposable
+internal class DotnetArchiveExtractor : IInstallArtifact
 {
     private readonly DotnetInstallRequest _request;
     private readonly ReleaseVersion _resolvedVersion;