Skip to content

v15.2.1 - DryRun completeness fix (safe install preview)

Choose a tag to compare

View all tags
@ryderlacin-pixel ryderlacin-pixel released this 08 Jun 17:32
· 13 commits to main since this release
v15.2.1
99314a6

v15.2.1 — DryRun completeness fix

Status: Production patch on top of v15.2.

Problem

-DryRun was documented as “no firewall/NIC changes,” but several install steps still executed real netsh and registry writes:

  • STEP 3: bulk KS-* rule deletion and firewall policy reset
  • STEP 4: IPv6 firewall rules + global DisabledComponents registry lock
  • STEP 6: firewall policy blockinbound,allowoutbound
  • Remove-InstallBlocks: catch-all rule deletion

Users running .\install.ps1 -DryRun on a VM or physical PC could still get network side effects.

Fix

  • New Invoke-SafeRegistrySet in lib/Install-SafeNetwork.ps1 — DryRun guard for registry writes.
  • lib/Install-MainSteps-0-6.ps1 — all firewall/registry hardening routes through Invoke-SafeNetsh or Invoke-SafeRegistrySet; no bare netsh calls remain.
  • lib/Install-Helpers.ps1 — Remove-InstallBlocks uses Invoke-SafeNetsh.
  • Docs updated: README, CODE_REVIEW, install banner.

What -DryRun still does

Downloads (WireGuard/wgcf), writes generated scripts to C:\WireGuard\, scheduled tasks, GPO, and registry outside network hardening may still run. Only network hardening is fully simulated.

Install

Set-ExecutionPolicy Bypass -Scope Process -Force
.\install.ps1 -DryRun   # safe network-hardening preview
.\install.ps1           # real install (VM first)

Network stuck? emergency-reset.bat as Administrator.

Tests

  • scripts/test-suite.ps1: 189/189 PASS (includes DryRun-safe MainSteps assertions)
Assets 2
Loading