Remove old ADCSTemplate.zip references and add new templates - #340

Hey @Ne0nd0g — thanks for catching this. The fix works, but wanted to suggest an alternative that avoids committing binary zips.

The unzipped ADCSTemplate/ directory is already tracked in git (both roles have it at files/ADCSTemplate/). Instead of committing the zip, we could replace the 3-task zip workflow (copy → extract → cleanup) with a single win_copy directory copy:

- name: Copy ADCSTemplate module to remote
  ansible.windows.win_copy:
    src: files/ADCSTemplate/
    dest: "C:\\Program Files\\WindowsPowerShell\\Modules\\ADCSTemplate\\"

I compared the zip contents against the tracked directory — they're identical (same 10 files). PowerShell modules are just directories of .psm1/.psd1 files with no special packaging, so win_copy of the directory works the same as extract-from-zip.

Benefits:

• No binary blobs in git (zips don't diff, bloat the repo permanently)
• No stale zip risk if someone updates a .psm1 in the directory but forgets to re-zip
• Fewer Ansible tasks (3 → 1)

Do you see any issues with that approach? If not, happy to update the PR branch — or feel free to adjust it yourself.

Yeah, I agree with your approach, I'll try to get an update to my PR pushed soon

@Ne0nd0g — I went ahead and pushed the change we discussed to this branch (6812177) so it's not sitting on you. Entirely up to you to review and approve; happy to revert or rework any of it.

The agreed change

Both roles (adcs_templates, vulns_adcs_templates) now do a single directory copy instead of copy-zip → Expand-Archive → cleanup:

- name: Copy ADCSTemplate module to remote
  ansible.windows.win_copy:
    src: files/ADCSTemplate/
    dest: "C:\\Program Files\\WindowsPowerShell\\Modules\\ADCSTemplate\\"

Both ADCSTemplate.zip blobs are removed. Before deleting them I extracted each and diffed against the tracked files/ADCSTemplate/ directory — byte-identical in both roles, so nothing is lost. Your .gitignore removal stays correct: nothing generates those zips anymore.

A little more than we agreed on — flagging explicitly since it's your PR

Dropping the zips made some existing plumbing dead, so I removed it in the same commit:

• PrepareADCSZips() in cli/internal/ansible/prepare.go — provision preflight was its only caller
• the zip doctor check (cli/internal/doctor/checks.go) and its mention in doctor --help — PrepareADCSZips was the only thing that shelled out to zip
• the Ludus docs zip prerequisite, plus an "ADCS template zip missing" troubleshooting section that referenced a cert_templates.zip path no longer present in the repo

Say the word if you'd rather keep this PR to just the role change and split the cleanup out.

Verification

• Built the collection (ansible-galaxy collection build) and confirmed all 15 ADCSTemplate/ entries ship in the tarball for both roles — worth noting since preflight built the collection before PrepareADCSZips ran, so on a fresh clone the first-run collection never actually contained the zip. The tracked directory removes that ordering trap.
• Exercised the same _find_needle('files', src) + trailing-slash walk that win_copy uses against a mirrored role layout: resolves role-relative, lands ADCSTemplate/ADCSTemplate.psd1 at the module root (so Import-Module ADCSTemplate in vulns_adcs_esc15 still resolves), output identical to the source tree, idempotent on re-run.
• go build / go vet / gofmt / full go test ./... clean; docsible regenerated both role READMEs.