RackStack v1.117.0

RackStack v1.117.0

Auto-released by CI on version bump in Header.ps1.

SHA256 verification

69f3ab3ff2baddda2676df6b92db7799f891f24cc9a5bf04b69f801e06906149  RackStack.exe
226ebea98a4eb1b127fa88e207869583399bfb905708a1c3f2fe05257e74f05b  RackStack v1.117.0.ps1
df45124ba2f3f4374068e38cc6e685ea0d58db190aeb9e66e5b5752974db0555  defaults.example.json

Verify with (Get-FileHash RackStack.exe -Algorithm SHA256).Hash.ToLower().

Supply-chain attestations

• Build provenance (SLSA Level 3): verify the EXE came from this exact workflow run on this commit:

  gh attestation verify RackStack.exe --owner TheAbider
  

• Cosign keyless signatures: each artifact is signed via Sigstore Fulcio + GitHub OIDC. Verify with:

  cosign verify-blob \`
    --certificate RackStack.exe.pem \`
    --signature RackStack.exe.sig \`
    --certificate-identity-regexp "^https://github.com/TheAbider/RackStack/.github/workflows/ci.yml@refs/heads/master$" \`
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \`
    RackStack.exe
  

• SBOM (CycloneDX): see RackStack-1.117.0-sbom.cyclonedx.json attached below.

Changes

Service certificate binding audit — a new module (78-CertificateAudit) surfaced under Security & Access → [12] Certificate Binding Audit, plus a read-only CLI action.

• CertBindingAudit (read-only) — reports which certificate is actually bound to the RDP-Tcp listener and the WinRM HTTPS listener, with subject, days-to-expiry, and whether the certificate has a usable private key. JSON-aware; makes no changes. This is binding-aware — unlike the generic certificate-expiry check, it tells you which cert each service is presenting, so you can catch an expiring RDP/WinRM binding before clients see TLS failures.

A note on scope: automated rotation of the RDP listener was prototyped for this release but deferred after an adversarial security review. Re-binding RDP safely requires the target certificate's private key to be readable by the RDP service account (NETWORK SERVICE) — a freshly generated self-signed cert is not, by default — and getting that wrong can break RDP TLS and lock an administrator out of the only remote-access path. Combined with inconsistent CIM writability of SSLCertificateSHA1Hash across Windows builds, that mutation needs validation on a live, elevated, RDP-enabled server before it ships. The audit surfaces exactly what to rotate manually and when, and the rotation will follow once it can be verified safely.

New module 78-CertificateAudit. Modules: 78 → 79. CLI actions: 198 → 199.