generated from MrSphay/codex-agent-repository-kit
113 lines
3.9 KiB
Markdown
113 lines
3.9 KiB
Markdown
# MrTrust
|
|
|
|
MrTrust is a small Windows trust-onboarding kit for MrSphay software.
|
|
|
|
It is designed for this workflow:
|
|
|
|
1. MrSphay creates a private code-signing certificate once.
|
|
2. MrSphay publishes only the public trust certificate with MrTrust.
|
|
3. A user runs MrTrust once and explicitly approves installing that public certificate.
|
|
4. MrSphay projects signed with the matching certificate chain are shown as trusted on that PC.
|
|
|
|
MrTrust does not bypass Microsoft Defender or SmartScreen. Windows can still scan, quarantine, or warn about suspicious files. This project only manages normal Windows certificate trust with visible user consent.
|
|
|
|
## What It Contains
|
|
|
|
- `MrTrust.ps1 gui` opens a simple Windows interface for installing or removing trust.
|
|
- `scripts/New-MrTrustCertificate.ps1` creates a local root certificate and a code-signing certificate for the publisher.
|
|
- `scripts/Install-MrTrust.ps1` installs the public trust certificate for the current user or the local machine.
|
|
- `scripts/Uninstall-MrTrust.ps1` removes the MrTrust certificate again.
|
|
- `scripts/Sign-MrTrustProject.ps1` signs `.exe`, `.msi`, `.ps1`, and other Authenticode-compatible files.
|
|
- `scripts/New-MrTrustRelease.ps1` builds a distributable ZIP package.
|
|
- `docs/integration-prompt.md` is a prompt you can paste into other Windows projects.
|
|
- `MrTrust.exe` is standalone for normal users. It embeds the public certificates and runtime scripts.
|
|
|
|
## Quick Start For MrSphay
|
|
|
|
Create the certificates:
|
|
|
|
```powershell
|
|
.\scripts\New-MrTrustCertificate.ps1
|
|
```
|
|
|
|
This writes:
|
|
|
|
- public certificates to `assets\certificates\`
|
|
- private signing material to `private\`
|
|
|
|
The `private\` directory is ignored by git. Do not publish `.pfx` files or passwords.
|
|
|
|
Install the public trust certificate on your own PC:
|
|
|
|
```powershell
|
|
.\MrTrust.ps1 install
|
|
```
|
|
|
|
Open the GUI:
|
|
|
|
```powershell
|
|
.\MrTrust.ps1 gui
|
|
```
|
|
|
|
Sign another project build:
|
|
|
|
```powershell
|
|
.\MrTrust.ps1 sign `
|
|
-Path "C:\Path\To\App.exe" `
|
|
-PfxPath ".\private\MrSphay-CodeSigning.pfx"
|
|
```
|
|
|
|
Remove the trust certificate:
|
|
|
|
```powershell
|
|
.\MrTrust.ps1 uninstall
|
|
```
|
|
|
|
Build a user-facing ZIP release:
|
|
|
|
```powershell
|
|
.\scripts\New-MrTrustRelease.ps1 -Version 0.1.1
|
|
```
|
|
|
|
The Gitea workflow `.gitea/workflows/build.yml` builds the Windows launcher EXE on an `ubuntu-latest` runner with .NET Windows cross-targeting, then uploads the ZIP as an artifact.
|
|
|
|
## User Installation
|
|
|
|
For normal users, distribute `MrTrust.exe`. The executable embeds the public certificate files and opens the GUI by default.
|
|
|
|
By default, MrTrust installs trust only for the current Windows user:
|
|
|
|
```text
|
|
Root certificate -> Cert:\CurrentUser\Root
|
|
Code-signing certificate -> Cert:\CurrentUser\TrustedPublisher
|
|
```
|
|
|
|
For all users on the machine, run PowerShell as Administrator:
|
|
|
|
```powershell
|
|
.\MrTrust.ps1 install -Scope LocalMachine
|
|
```
|
|
|
|
## Using This Repo With Other Agents
|
|
|
|
Yes. Give another agent this repository URL and the target Windows project, then paste `docs/integration-prompt.md`.
|
|
|
|
Both sides have to be wired:
|
|
|
|
- MrTrust side: users install the public trust certificates once.
|
|
- Target project side: release artifacts are signed with the MrSphay code-signing certificate.
|
|
- Installer side, optional: the target app can offer "Open MrTrust" or bundle the MrTrust ZIP, but it must not silently change trust.
|
|
|
|
If the target project is not signed, MrTrust cannot make it trusted.
|
|
|
|
## Important Limits
|
|
|
|
- This only helps for programs signed with the matching MrSphay certificate chain.
|
|
- It does not make unsigned programs trusted.
|
|
- It does not disable Defender, SmartScreen, UAC, or enterprise policies.
|
|
- Public distribution without warnings is still best handled with a recognized commercial code-signing certificate.
|
|
|
|
## Recommended Project Integration
|
|
|
|
Use `docs/integration-prompt.md` in another Windows project. The prompt tells Codex or another assistant to add a visible trust check, a link or bundled copy of MrTrust, and a signing step without hiding security changes from the user.
|