Skip to content

Releases: danielneustadter/fossroot

Release list

v0.2.0

v0.2.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Aug 02:53
v0.2.0
dc129f0

What's Changed

  • macOS: fix trust-store enumeration and removal (first real-hardware validation) by @8tp in #1

New Contributors

  • @8tp made their first contribution in #1

Full Changelog: v0.1.0...v0.2.0

What's Changed

  • macOS: fix trust-store enumeration and removal (first real-hardware validation) by @8tp in #1

New Contributors

  • @8tp made their first contribution in #1

Full Changelog: v0.1.0...v0.2.0

Contributors

8tp
Assets 8
Loading

Fossroot v0.1.0

Fossroot v0.1.0

Choose a tag to compare

View all tags
@danielneustadter danielneustadter released this 23 Jul 06:32
v0.1.0
07cecfb

Fossroot v0.1.0 — first release. Open-source, single-binary manager for DoD PKI CA certificate trust stores; a modern, auditable alternative to DISA's InstallRoot.

⚠️ Unofficial community tool. Not affiliated with or endorsed by the U.S. Department of War, DISA, or any government agency.

What's in this release

  • fossroot-v0.1.0-x86_64-windows.exe — Windows x64, single self-contained executable. No installer, no runtime dependencies, no config files. Double-click for the GUI; run with arguments for the CLI (status, install, remove, export).

How it works

Fossroot ships zero certificates. It fetches the latest DoD PKCS#7 bundle live from DISA's official distribution point, verifies DISA's CMS-signed checksum manifest back to DoD Root CA 3/4/5/6 fingerprints pinned in the source, and signature-verifies every certificate chain (RSA + ECDSA) to a pinned root before anything is written. It fails closed. Use --offline <bundle.zip> for air-gapped machines.

Verified against DoD PKI bundle v5.14.

⚠️ This binary is not code-signed

Windows SmartScreen will show an "unknown publisher" warning on download/run. Verify the download before trusting it:

Get-FileHash .\fossroot-v0.1.0-x86_64-windows.exe -Algorithm SHA256

Expected SHA-256:

9f0d8b3335d99fbfa0d9316698fbb9cf186c92804fd33453ebcb1733f4c94272

This must match fossroot-v0.1.0-x86_64-windows.exe.sha256. If you'd rather not trust a prebuilt binary, build it yourself with cargo build --release — the full source is in this repo.

Known limitations

  • Windows only in this release. macOS and Linux trust-store backends are on the roadmap (the core is already platform-agnostic).
  • Covers the DoD bundle. ECA / JITC / WCF groups and Firefox NSS support are planned.

License

Dual-licensed MIT OR Apache-2.0.

Full Changelog: https://github.com/danielneustadter/fossroot/commits/v0.1.0

Loading