MSIX storage validation leaves the sideload certificate in TrustedPeople

Open Beginner friendly
  • Is something wrong?
#2,009 2 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
77/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
powershell
Domain
devops

Research direction

Read scripts/validate-msix-storage-paths.ps1 around the certificate import at line 591 and Invoke-Teardown around line 1041. Track whether this run added the certificate, then remove that thumbprint during teardown only when it was newly imported. Add a regression or script assertion showing a certificate already in TrustedPeople remains there.

Written by the indexing model from the issue text.

Description

clawsweeper:bulk-filed clawsweeper:needs-security-review clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:security issue-rating: 🦞 diamond lobster P2

What happens

scripts/validate-msix-storage-paths.ps1 -CertPath imports that certificate into Cert:\LocalMachine\TrustedPeople so the sideload package can install. Teardown removes the AppX package with Remove-AppxPackage and does not remove the certificate. The publisher stays trusted on the machine after the validation run exits.

Import requires an elevated store write. The leftover is the trust entry the script added and then did not undo.

Where

Checked on 7967d509 by reading the script. The script was not run.

Suggested fix

Record the imported thumbprint and remove that certificate from TrustedPeople during teardown. Do not remove a different certificate that was already in the store.

Environment

Windows 11. OpenClaw Companion source on main at commit 7967d509886fc9efecbb19c8236350a82867f69c (2026-11-04). No packaged installer build was used.

Steps

  1. On Windows, as an administrator, run scripts/validate-msix-storage-paths.ps1 -CertPath with a test .cer.
  2. Let the script import the certificate and finish teardown.
  3. Open Cert:\LocalMachine\TrustedPeople and find that thumbprint.

Line 591 calls Import-Certificate into Cert:\LocalMachine\TrustedPeople. Invoke-Teardown removes the AppX package and does not remove the certificate.

Repair

Remember the thumbprint this run imported and remove only that certificate during teardown. Add a regression, or a script assertion, that a thumbprint which was already in the store is left in place. Stop there.

Dominant language
C#
Stars
2.2k
Forks
340
Avg merge
3d 11h
Merged PRs (30d)
173

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openclaw/openclaw-windows-node

All issues in openclaw/openclaw-windows-node

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.