AutopilotMonitor

mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 20:53:06 +00:00

Files

T

Oliver Kieselbach d639d9dda9 Bootstrap MSI 1.4: the action runs only the exact loader the package embeds (SHA-256 baked in at build time)

The automated security review of the previous commit found that a publisher pin alone
would run any validly signed script of ours placed at the copy's path, such as an older
loader without the held handle. The build now bakes the SHA-256 of the signed loader into
the action (wix build -d LoaderSha256=...; the package refuses to build without it), and
the action compares the bytes it read against it before the signature check.

- Package.wxs: hash check, preprocessor guard, comment
- build-msi.yml: the build step hashes the signed loader and passes it to wix
- Bootstrap.Integration.Tests.ps1: the harness substitutes the hash of the loader it serves;
  a copy that is not the embedded loader, however validly signed, runs nothing
- BootstrapContractTests: the hash condition, the guard and the build step are pinned
- internal: D-384, footprint doc and plan updated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-10-23 02:09:56 +02:00

TestData

Bootstrap leaves nothing behind: loader 1.3 and installer 2.7 (D-375)

2026-10-22 13:34:54 +02:00

Bootstrap.Integration.Tests.ps1

Bootstrap MSI 1.4: the action runs only the exact loader the package embeds (SHA-256 baked in at build time)

2026-10-23 02:09:56 +02:00

Install-AutopilotMonitor.ps1

Bootstrap MSI 1.4 keeps its loader copy under ProgramData and runs only what it checked; installer 2.9 removes the copy (D-384)

2026-10-23 02:01:15 +02:00

Install-AutopilotMonitor.Tests.ps1

Bootstrap MSI 1.4 keeps its loader copy under ProgramData and runs only what it checked; installer 2.9 removes the copy (D-384)