Add Windows certificate trust management for signed installers#445
Merged
Add Windows certificate trust management for signed installers#445
Conversation
…tall After installation completes on Windows, checks if the installed exe is signed with an untrusted (e.g. self-signed) certificate. If so, shows certificate details and offers to add it to the user's trust store via certutil -user (no admin required). Proceeds to the completion dialog regardless of the user's choice. https://claude.ai/code/session_019uM9CsmXdTMeEtoiNLijWG
…-tests The mock-network-tests workflow built the installer module with `mvn package` which does not install the jar to the local Maven repo. When the CLI module subsequently resolves jdeploy-installer as a dependency, it fails because the artifact is not available. https://claude.ai/code/session_019uM9CsmXdTMeEtoiNLijWG
checkSignature() and exportCertificate() now throw IllegalArgumentException for invalid input (null, missing file, non-exe) and IOException for process failures instead of returning null. Callers guard against obvious invalid input before calling, and the existing catch(Exception) block handles any runtime failures. https://claude.ai/code/session_019uM9CsmXdTMeEtoiNLijWG
The signtool verify error 0x80096019 ("basic constraint extension has
not been observed") occurs because generated certificates lack proper
X.509v3 extensions. Add basicConstraints=CA:FALSE, keyUsage=
digitalSignature, and extendedKeyUsage=codeSigning to all certificate
generation paths: OpenSSL commands in the test skill and keytool
commands in integration tests.
Also includes the earlier refactor making AuthenticodeSignatureChecker
never return null (throws exceptions instead).
https://claude.ai/code/session_019uM9CsmXdTMeEtoiNLijWG
Replace the verbose certificate details dump with a friendly message showing just the signer name and organization extracted from the subject DN. Full certificate details (subject, issuer, thumbprint, validity) are available via an info icon button. Button labels simplified to "Trust" / "Skip". https://claude.ai/code/session_019uM9CsmXdTMeEtoiNLijWG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds functionality to detect when a Windows executable is signed with an untrusted certificate and prompts the user to add it to their trust store, improving the installation experience for self-signed or internally-signed applications.
Key Changes
certutil.exewithout requiring admin elevationshowCertificateTrustPrompt()method toInstallationForminterface with implementation inDefaultInstallationFormthat displays certificate details and asks users if they want to trust the certificateMain.javato check for untrusted certificates after Windows installation completes and prompt the user accordingly before showing the completion dialogImplementation Details
-userflag withcertutil.exeto avoid requiring administrator privilegeshttps://claude.ai/code/session_019uM9CsmXdTMeEtoiNLijWG