Creatidy/foundry
5
0
Fork 0
Code Issues 2 Pull requests 1 Projects Releases Packages Wiki Activity Actions

WIP: Add experimental Windows leaf trust import #14

Draft
kilo wants to merge 2 commits from issue/5-windows-browser-trust into develop
pull from: issue/5-windows-browser-trust
merge into: Creatidy:develop
Conversation 0 Commits 2 Files changed 3 +121 -1
kilo commented 2026-11-03 20:54:39 +00:00
Member
Copy link

Related to #5; do not close the issue. Draft only, not ready to merge.

Adds an explicitly consented CurrentUser Root import of a public certificate manually copied with its SHA-256 from the existing verified managed first-run output. Exact DER is checked; existing entries are left unchanged and reported as present, not necessarily trusted. Trust is not restricted to localhost or browsers.

Incomplete: no reliable Foundry-owned removal or ownership evidence; manually copying PEM/fingerprint is not an integrated retrieval UX. Import/recheck is not atomic. The committed reconstructed/encoded PowerShell test harness was removed at f2b856a0dd; remaining checks are static and do not prove native behavior. The separate uncommitted candidate remains untouched and still contains marker-based removal that cannot establish ownership or exclusive use, native interop, and an unsafe test harness; it must not be executed or incorporated unchanged. Prefer supported .NET store APIs and an explicitly operator-controlled removal lifecycle rather than assuming a marker proves ownership. Do not automatically change trust during normal startup.

Windows Root behavior, ordinary -File invocation, Edge/Chrome positive and negative cases, and cleanup remain unverified. Native acceptance requires separate explicit authorization and an isolated Windows environment. Do not merge without a reviewed lifecycle, native acceptance and required authority. Bitdefender detection cause is unverified.

Current head: f2b856a0dd. Original candidate head: f97f519ac5. Static assessment on 2026-11-04; no tests, PowerShell, Windows interop, Docker mutations, or trust-store operations performed.

Related to #5; do not close the issue. **Draft only, not ready to merge.** Adds an explicitly consented CurrentUser Root import of a public certificate manually copied with its SHA-256 from the existing verified managed first-run output. Exact DER is checked; existing entries are left unchanged and reported as present, not necessarily trusted. Trust is not restricted to localhost or browsers. **Incomplete:** no reliable Foundry-owned removal or ownership evidence; manually copying PEM/fingerprint is not an integrated retrieval UX. Import/recheck is not atomic. The committed reconstructed/encoded PowerShell test harness was removed at f2b856a0dd3aa7f8528c9a8f5eb542b4f1a897b1; remaining checks are static and do not prove native behavior. The separate uncommitted candidate remains untouched and still contains marker-based removal that cannot establish ownership or exclusive use, native interop, and an unsafe test harness; it must not be executed or incorporated unchanged. Prefer supported .NET store APIs and an explicitly operator-controlled removal lifecycle rather than assuming a marker proves ownership. Do not automatically change trust during normal startup. Windows Root behavior, ordinary -File invocation, Edge/Chrome positive and negative cases, and cleanup remain unverified. Native acceptance requires separate explicit authorization and an isolated Windows environment. Do not merge without a reviewed lifecycle, native acceptance and required authority. Bitdefender detection cause is unverified. Current head: f2b856a0dd3aa7f8528c9a8f5eb542b4f1a897b1. Original candidate head: f97f519ac5e3f0a2f7b07ff85a79ef5c327fdb68. Static assessment on 2026-11-04; no tests, PowerShell, Windows interop, Docker mutations, or trust-store operations performed.
kilo changed target branch from main to develop 2026-11-04 17:54:00 +00:00
This pull request is marked as a work in progress.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin issue/5-windows-browser-trust:issue/5-windows-browser-trust
git switch issue/5-windows-browser-trust

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch develop
git merge --no-ff issue/5-windows-browser-trust
git switch issue/5-windows-browser-trust
git rebase develop
git switch develop
git merge --ff-only issue/5-windows-browser-trust
git switch issue/5-windows-browser-trust
git rebase develop
git switch develop
git merge --no-ff issue/5-windows-browser-trust
git switch develop
git merge --squash issue/5-windows-browser-trust
git switch develop
git merge --ff-only issue/5-windows-browser-trust
git switch develop
git merge issue/5-windows-browser-trust
git push origin develop
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Creatidy/foundry!14
No description provided.