0.74.0 - hardening: data loss, signing security, PS 5.1, CI honesty

[sanderdewit]

Hardening release from a full-codebase audit (security, enterprise stability, PS 5.1 compatibility, test/CI quality). Closes #145, #146, #147, #148, #150, #151, #152, #153.

Everything below shipped in 0.73.x. Several items could destroy or corrupt an operator's package, or hand a local attacker control of what the organisation signs.

Data loss (#145)

• Remove-MsixPsf destroyed payload in PSF-free packages. The delete loop ran unconditionally with patterns as generic as config.json and *Fixup*.dll, recursed over the whole package, and because deletions alone counted as "changed" the result was repacked, signed and moved over the operator's original — exit code 0. An Electron/.NET app shipping its own resources\app\config.json simply lost it. Now gated on real PSF presence, with precise patterns.
• Add-MsixVcRuntimeBundle packed and signed over the input file with no -UnsignedOutputPath, so a signing failure left an unsigned repack where a signed package had been. Now scratch → sign → atomic move.
• -WhatIf was broken for all ~46 mutators: New-MsixWorkspace honoured the inherited $WhatIfPreference and returned an empty path.
• -UnsignedOutputPath could destroy the artifact it promised to preserve — copy with -ErrorAction SilentlyContinue, unconditional "preserved" log, then the scratch deleted in finally.

Security (#147, #148)

• Signing-toolchain hijack. Only three .exe files were verified, but SDK signtool.exe loads wintrust.dll / mssign32.dll / AppxSip.dll from its own directory — so genuine signed executables plus one planted DLL passed the check and ran attacker code inside signing. Every .exe/.dll in the root is now verified.
• Discovery reached a user-writable directory (4-level parent walk, lexically highest wins → ~\Documents for a CurrentUser install). Now one level.
• Fail-open branch when the verifier wasn't loaded → now throws.
• PFX password written to the log file via the Exec: line, collected by CI artifact upload and support bundles → secret-bearing switches redacted.
• SignerSignEx left the PFX private key in the user's key store on every run → container now deleted explicitly (verified key-file count returns to baseline).

Windows PowerShell 5.1 (#146)

• Join-String (PS6+) silently replaced the real ComServer finding with a scanner error on 5.1.
• Get-PfxCertificate -Password (PS6+) made Set-MsixScriptSignature / Add-MsixStandardScript -Pfx unusable on 5.1.
• -Encoding utf8 = BOM on 5.1, no BOM on 7 → a BOM in the Trusted Signing metadata JSON (rejected by System.Text.Json, on the default signing backend) and in PSF config.json. New _MsixWriteUtf8 makes it explicit and identical on both.
• The 5.1 CI lane now resolves every command and parameter against real 5.1 metadata; PSSA's compatibility rules do not flag this class.

Manifest correctness (#153)

Found by writing the first behavioural tests for functions the ratchet had falsely certified. All three emitted manifests MakeAppx refuses to pack:

• Add-MsixLoaderSearchPathOverride wrote attribute LoaderSearchPath; UapManifestSchema_v6.xsd requires FolderPath.
• Add-MsixLoaderSearchPathOverride declared the extension under Application; it must be under <Package>.
• Add-MsixFirewallRule passed the caller's casing to a schema requiring lowercase, so -Direction In failed to parse.

Reliability + CI (#150, #151, #152)

• Workspace leak behind ~46 mutators — 1,077 stale msix-* directories on one ordinary dev machine, oldest ~3 months. Also two helpers that leaked permanently because the path was never returned.
• CI never provisioned PSF, so the PSF regression guards — including the OrderedDictionary.ContainsKey guard from Fix PSF config merge crash on re-injection (OrderedDictionary.ContainsKey) #138 — had never once run on a runner. Provisioning failure is now fatal (was a ::warning:: that produced a green build with ~96 tests skipped), and a passed-count floor makes an all-skip run red.
• The coverage ratchet counted Get-Command calls and It titles as coverage, so the debt list read EMPTY while 12 mutators were never invoked. Replaced with AST CommandAst detection; six mutators gained real tests.
• Test-MsixFixtureToolingAvailable returned $false on system-SDK hosts, silently disabling integration coverage.

New

• PSGallery update notification on import. Silent in CI and non-interactive hosts, cached 24h, hard network timeout, every failure swallowed — an update notice must never slow or break Import-Module. Opt out with $env:MSIX_NO_UPDATE_CHECK = '1'. Measured: 273 ms live lookup, 60 ms fail on an unreachable endpoint.
• Missing/mistyped package paths now fail loudly instead of returning an empty finding set that reads as "clean".

Validation

• Full suite 745 passed / 0 failed / 1 skipped; local Integration lane 100/0/0.
• PSSA clean across the repo at ParseError/Error/Warning.
• 5.1 command/parameter scan clean under real Windows PowerShell 5.1.
• The six data-loss guards were verified to fail against the pre-fix code (stash, run, restore) — they are genuine regression tests, not tautologies.
• Private-key deletion and password redaction verified empirically.

🤖 Generated with Claude Code