Harden Code Integrity verification and document recovered mincrypt contracts #4

Merged
nefarius merged 3 commits from fix/ci-validation-hardening into master 2026-10-27 00:31:32 +01:00
Owner

Improve PE parsing, digest cleanup, file I/O, and export resolution. Add algorithm-explicit Authenticode hashing, bounded ASN.1 digest discovery, and explicit catalog policy controls with embedded/catalog result reporting.

Document recovered CI parameters, ownership rules, policy bits, and CiValidateFileObject flag 0x20. Add opt-in x64 26100 layouts while preserving existing structure layouts and compatibility entry points.

Validation includes 6,054 passing host checks, Windows SIP and embedded-digest comparisons, and x64/ARM64 builds with warnings treated as errors. Real CI runtime verification, historical ABI checks, and broader PE-layout support remain documented follow-up work.

Improve PE parsing, digest cleanup, file I/O, and export resolution. Add algorithm-explicit Authenticode hashing, bounded ASN.1 digest discovery, and explicit catalog policy controls with embedded/catalog result reporting. Document recovered CI parameters, ownership rules, policy bits, and CiValidateFileObject flag 0x20. Add opt-in x64 26100 layouts while preserving existing structure layouts and compatibility entry points. Validation includes 6,054 passing host checks, Windows SIP and embedded-digest comparisons, and x64/ARM64 builds with warnings treated as errors. Real CI runtime verification, historical ABI checks, and broader PE-layout support remain documented follow-up work.
nefarius added 1 commit 2026-10-27 00:17:36 +01:00
Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

Add CI validation helpers with explicit signature selection and owned results

Document runtime-confirmed CI signer selection and crypto reuse

Expand CI compatibility matrix to twenty verified samples

Extend CI export matrix with Windows 11 x64 and ARM64 samples

Document CI API availability and historical mincrypt layouts

Add explicit Authenticode workflows and correct CI helper contracts

Document CI validation flag 0x20 and add kernel probe

Harden CI digest parsing and failure cleanup
nefarius force-pushed fix/ci-validation-hardening from a491bbd3f8 to 3fbfe31d15 2026-10-27 00:17:36 +01:00 Compare
nefarius added 1 commit 2026-10-27 00:20:22 +01:00
nefarius added 1 commit 2026-10-27 00:29:29 +01:00
nefarius merged commit edf3eeb4ac into master 2026-10-27 00:31:32 +01:00
nefarius deleted branch fix/ci-validation-hardening 2026-10-27 00:31:32 +01:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: nefarius/Domito#4