Skip to content

fix: verify Windows installer Authenticode publisher - #32

Merged
yujiezhang-ops merged 1 commit into
mainfrom
codex/issue-27-windows-authenticode
Aug 5, 2026
Merged

fix: verify Windows installer Authenticode publisher#32
yujiezhang-ops merged 1 commit into
mainfrom
codex/issue-27-windows-authenticode

Conversation

@yujiezhang-ops

Copy link
Copy Markdown
Collaborator

Closes #27

Summary

  • Restrict the Windows installer URL to HTTPS on get.microsoft.com.
  • Verify the downloaded EXE with Windows PowerShell Get-AuthenticodeSignature before launch.
  • Require Status == Valid, a signer certificate, and the approved Microsoft Corporation publisher/organization.
  • Fail closed for unsigned, hash-mismatched, untrusted, malformed, or unexpected-publisher downloads.
  • Keep the downloaded file private and remove it when verification or launch fails.

Tests

  • python3 -m unittest scripts/test_generate_third_party_licenses.py
  • python3 scripts/generate_third_party_licenses.py --check
  • python3 scripts/check-docs.py
  • go vet ./...
  • go test ./...
  • GOOS=windows GOARCH=amd64 go test -c ./internal/desktopapp -o /tmp/oneagent-desktopapp-windows.test.exe
  • cd frontend && pnpm run test
  • cd frontend && pnpm run build

This PR is intentionally stacked on PR #31 and should be merged after PRs #28, #30, and #31.

@yujiezhang-ops
yujiezhang-ops force-pushed the codex/issue-26-macos-install-verification branch from 7656371 to ca5af2d Compare August 5, 2026 04:36
@yujiezhang-ops
yujiezhang-ops force-pushed the codex/issue-27-windows-authenticode branch from a3097d2 to 0d423f2 Compare August 5, 2026 04:36
@yujiezhang-ops
yujiezhang-ops changed the base branch from codex/issue-26-macos-install-verification to main August 5, 2026 04:42
@yujiezhang-ops
yujiezhang-ops merged commit 845a288 into main Aug 5, 2026
4 checks passed
@yujiezhang-ops
yujiezhang-ops deleted the codex/issue-27-windows-authenticode branch August 5, 2026 04:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[P1] Verify Windows installer Authenticode publisher before execution

1 participant