fixes using a svc_user on windows

.buildkite/release_pipeline.yaml

@@ -271,6 +271,7 @@ steps:
           environment:
             - HAB_BLDR_CHANNEL
             - HAB_AUTH_TOKEN
+            - HAB_CRYPTO_KEY
             - HAB_LICENSE
             - BUILDKITE_JOB_ID
             - BUILDKITE_AGENT_ACCESS_TOKEN

components/common/src/command/package/install.rs

@@ -45,6 +45,7 @@ use crate::{api_client::{self,
                          pkg_install_path,
                          svc_hooks_path,
                          AtomicWriter},
+                    os::users,
                     package::{list::temp_package_directory,
                               Identifiable,
                               PackageArchive,
@@ -405,9 +406,16 @@ fn run_install_hook<T>(ui: &mut T, package: &PackageInstall) -> Result<()>
         ui.status(Status::Executing,
                   format!("install hook for '{}'", &package.ident(),))?;
         templating::compile_for_package_install(package)?;
-        if !hook.run(&package.ident().name,
-                     &Pkg::from_install(package)?,
-                     None::<&str>)
+        let mut pkg = Pkg::from_install(package)?;
+        // Only windows uses svc_password
+        if cfg!(target_os = "windows") {
+            // Install hooks do not have access to svc_passwords so
+            // we execute them under the current user account.
+            if let Some(user) = users::get_current_username() {
+                pkg.svc_user = user;
+            }
+        }
+        if !hook.run(&package.ident().name, &pkg, None::<&str>)
                 .unwrap_or(false)
         {
             return Err(Error::InstallHookFailed(package.ident().clone()));

components/sup/src/manager/service/spec.rs

@@ -107,8 +107,16 @@ pub struct ServiceSpec {
     #[serde(with = "serde_string")]
     pub desired_state: DesiredState,
     pub shutdown_timeout: Option<ShutdownTimeout>,
-    pub health_check_interval: HealthCheckInterval,
     pub svc_encrypted_password: Option<String>,
+    // it is important that the health check interval
+    // is the last field to be serialized because it
+    // is serialized as a table. Individual values
+    // serialized after the health check interval will
+    // break the parser.
+    // Note that there is an issue to ultimately fix this:
+    // https://github.com/habitat-sh/habitat/issues/6469
+    // and eliminate the need to keep this field last.
+    pub health_check_interval: HealthCheckInterval,
 }
 
 impl ServiceSpec {