Windows Secure WSL Setup

powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "\\wsl.localhost\<Ubuntu-distro>\home\<linux-user>\code\teamwork\ops\hacp-control\onboard-wsl-hacp.ps1"

$ExpectedSignerSha256 = (Read-Host 'Paste the independently reviewed installer signer-certificate SHA-256').Trim().ToLowerInvariant()
$ExpectedDescriptorSha256 = (Read-Host 'Paste the independently reviewed verification-descriptor file SHA-256').Trim().ToLowerInvariant()
if ($ExpectedSignerSha256 -notmatch '^sha256:[0-9a-f]{64}$' -or $ExpectedDescriptorSha256 -notmatch '^sha256:[0-9a-f]{64}$') { throw 'Invalid independent release pin' }
$DescriptorPath = Resolve-Path '.\sigroom-appliance-release-verification-key.json'
$ActualDescriptorSha256 = 'sha256:' + (Get-FileHash -Algorithm SHA256 -LiteralPath $DescriptorPath).Hash.ToLowerInvariant()
if ($ActualDescriptorSha256 -cne $ExpectedDescriptorSha256) { throw 'Unexpected release-verification descriptor' }
$Descriptor = Get-Content -Raw -LiteralPath $DescriptorPath | ConvertFrom-Json
if ($Descriptor.schema_version -ne 'HACP_WINDOWS_RELEASE_VERIFICATION_KEY/1' -or $Descriptor.signature_algorithm -ne 'RSA-PSS-SHA256' -or $Descriptor.public_key_pem_filename -ne 'sigroom-appliance-release-public.pem' -or $Descriptor.jwk.kty -ne 'RSA') { throw 'Invalid release-verification descriptor' }
$ActualPemSha256 = 'sha256:' + (Get-FileHash -Algorithm SHA256 -LiteralPath '.\sigroom-appliance-release-public.pem').Hash.ToLowerInvariant()
if ($ActualPemSha256 -cne $Descriptor.public_key_pem_sha256) { throw 'Release PEM does not match the pinned descriptor' }
function ConvertFrom-Base64Url([string]$Value) { $Value = $Value.Replace('-', '+').Replace('_', '/'); switch ($Value.Length % 4) { 0 {} 2 {$Value += '=='} 3 {$Value += '='} default {throw 'Invalid base64url'} }; [Convert]::FromBase64String($Value) }
$Parameters = New-Object Security.Cryptography.RSAParameters
$Parameters.Modulus = ConvertFrom-Base64Url ([string]$Descriptor.jwk.n)
$Parameters.Exponent = ConvertFrom-Base64Url ([string]$Descriptor.jwk.e)
if ($Parameters.Modulus.Length -lt 256 -or $Parameters.Modulus.Length -gt 1024 -or $Parameters.Exponent.Length -lt 1 -or $Parameters.Exponent.Length -gt 8) { throw 'RSA key is outside supported bounds' }
$EvidenceBytes = [IO.File]::ReadAllBytes((Resolve-Path '.\setup-l4-windows.ps1.authenticode.json').Path)
$EvidenceSignatureBytes = [IO.File]::ReadAllBytes((Resolve-Path '.\setup-l4-windows.ps1.authenticode.json.sig').Path)
$Verifier = New-Object Security.Cryptography.RSACng
try { $Verifier.ImportParameters($Parameters); $EvidenceSignatureValid = $Verifier.VerifyData($EvidenceBytes, $EvidenceSignatureBytes, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pss) } finally { $Verifier.Dispose() }
if (-not $EvidenceSignatureValid) { throw 'Invalid detached Authenticode evidence signature' }
$Evidence = [Text.Encoding]::UTF8.GetString($EvidenceBytes) | ConvertFrom-Json
$Installer = Resolve-Path '.\setup-l4-windows.ps1'
$InstallerSha256 = 'sha256:' + (Get-FileHash -Algorithm SHA256 -LiteralPath $Installer).Hash.ToLowerInvariant()
if ($Evidence.schema_version -ne 'HACP_WINDOWS_BOOTSTRAP_AUTHENTICODE/1' -or $Evidence.signer_certificate_sha256 -cne $ExpectedSignerSha256 -or $Evidence.signed_file_sha256 -cne $InstallerSha256) { throw 'Installer does not match signed evidence' }
$Signature = Get-AuthenticodeSignature -LiteralPath $Installer
if ([string]$Signature.Status -ne 'Valid' -or -not $Signature.SignerCertificate) { throw 'Invalid Sigroom Authenticode signature' }
$Sha256 = [Security.Cryptography.SHA256]::Create()
try { $ActualSignerSha256 = 'sha256:' + (($Sha256.ComputeHash($Signature.SignerCertificate.RawData) | ForEach-Object { $_.ToString('x2') }) -join '') } finally { $Sha256.Dispose() }
if ($ActualSignerSha256 -cne $ExpectedSignerSha256) { throw 'Unexpected Authenticode signer' }
& $Installer -ManifestUrl 'https://api.example.com/downloads/runtime-appliance.json' -PublicKey '.\sigroom-appliance-release-public.pem' -ApiUrl 'https://api.example.com' -GatewayUrl 'wss://gateway.example.com/hacp/v1' -ArtifactUrl 'https://api.example.com' -Json

.\scripts\release\export-windows-bootstrap-authenticode-evidence.ps1 `
  -SignedInstaller '.\release\setup-l4-windows.ps1' `
  -UnsignedSource '.\ops\hacp-control\setup-l4-windows.ps1' `
  -ExpectedSignerSha256 'sha256:<reviewed signer certificate SHA-256>' `
  -ReleaseSigningKeyId 'appliance-release-primary' `
  -OutputPath '.\release\setup-l4-windows.ps1.authenticode.json'

scripts/ops/bootstrap-railway-release.sh --apply \
  --windows-bootstrap-release-mode production \
  --appliance-release-dir /reviewed/runtime-appliance-release \
  --appliance-public-key /reviewed/sigroom-appliance-release-public.pem \
  --windows-bootstrap-signed-installer /reviewed/setup-l4-windows.ps1 \
  --windows-bootstrap-authenticode-evidence /reviewed/setup-l4-windows.ps1.authenticode.json \
  --windows-bootstrap-authenticode-evidence-signature /reviewed/setup-l4-windows.ps1.authenticode.json.sig \
  --windows-bootstrap-signer-sha256 'sha256:<reviewed signer certificate SHA-256>'