🤝 Contributing

Adding a vendor or driver series

A step-by-step walkthrough is in docs/adding-a-printer.md. In short:

1. Create vendors/<vendor>/<series>/default.nix that fetches the driver archive with pkgs.fetchzip (real SRI hash, no fakeHash) and calls lib.mkIntunePackage from the repo root.
2. Add vendors/<vendor>/<series>/scripts/Install.ps1 and Uninstall.ps1.
3. Register the package in flake.nix's vendorPackages set.
4. nix build .#<vendor>-<series> and confirm the output .intunewin.

Keep vendor default.nix files minimal — fetch, unpack, call lib/mkIntunePackage.nix. Anything reusable belongs in lib/ or nix/, not duplicated per vendor — PowerShell helpers that every Install.ps1 needs (e.g. Import-DriverPublisherTrust in lib/common-scripts/) go there too; mkIntunePackage.nix merges them into every package's build tree automatically.

Design constraints to preserve

• One package per driver series, not per printer. Printer identity (name, IP, model) is supplied at deploy time via Intune install-command arguments — never bake a specific printer into a package.
• No secrets or driver binaries committed. Drivers are fetched at build time and pinned by hash only.
• Idempotent scripts. Install.ps1 / Uninstall.ps1 must be safe to re-run: create resources only if absent, reconcile if present but different, and never fail because something already exists.
• Reproducible builds. mkintunewin must produce byte-identical output for identical inputs and --seed. If you touch tools/mkintunewin.py, don't introduce non-determinism (wall-clock timestamps, unsorted directory iteration, unseeded randomness).

Style

• Nix: format with nixpkgs-fmt (available in nix develop, wired up as nix fmt).
• PowerShell: short comment-based help header (synopsis, parameters, one example); inline comments only where the why isn't obvious from the code.
• Python: standard library + pycryptodome only, no other runtime dependencies — this keeps nix/intunewin-packer.nix simple to wrap.

Before opening a PR

nix flake check
nix build .#all
nix fmt

If you changed tools/mkintunewin.py, see docs/architecture.md — format changes should be validated against a real Intune upload where possible.