[WIP] feat(windows): MSI bootstrap + self-update packaging

.github/workflows/fuzz.yml

@@ -35,6 +35,7 @@ jobs:
           - ./internal/detector/configaudit
           - ./internal/state
           - ./internal/detector/credentials
+          - ./internal/updatestate
     env:
       CGO_ENABLED: '0'
       # Short campaigns on the PR and merge-queue paths so they don't hold up a

.github/workflows/tests.yml

@@ -112,6 +112,28 @@ jobs:
         with:
           go-version-file: go.mod
       - run: make test
+      - name: Test self-update fault injection (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys ./internal/faultinject/ ./internal/updatestate/ ./internal/selfupdate/ ./internal/authenticode/
+      - name: Test bootstrap fault checkpoints (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults ./internal/launcher/
+
+  # Self-update U0 harness on Linux: the trace-driven kill matrix and the
+  # state corruption matrix (portable parts; Windows runs them natively in
+  # test-windows-native).
+  test-selfupdate-linux:
+    name: Test (self-update kill matrix, linux)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+      - run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys ./internal/faultinject/ ./internal/updatestate/ ./internal/selfupdate/
 
   # These packages have Windows-only code and Windows-specific behavior whose
   # tests the macOS test job can only cross-compile, not run:
@@ -126,6 +148,9 @@ jobs:
   #   - executor: Readlink on a real directory junction (ModeIrregular entry,
   #     NT-namespace target), which the skills detector's junction folding
   #     depends on
+  #   - updatestate: MoveFileEx state replace, LockFileEx, protected DACLs
+  #   - selfupdate: native arch (IsWow64Process2), WinHTTP machine proxy
+  #   - authenticode: WinVerifyTrust against a test-signed copy (elevated runner)
   #   - detector TestReal_*: the Kiro CLI registry reader against a scratch
   #     HKCU key, and skills junction folding over real junctions (the rest of
   #     the detector suite assumes a POSIX host, hence the -run filter)
@@ -144,10 +169,19 @@ jobs:
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
-      - run: go test -race -count=1 ./internal/devicepolicy/ ./internal/secureuserfile/ ./internal/detector/credentials/ ./internal/safepath/ ./internal/executor/
+      - run: go test -race -count=1 ./internal/devicepolicy/ ./internal/secureuserfile/ ./internal/detector/credentials/ ./internal/safepath/ ./internal/executor/ ./internal/updatestate/ ./internal/selfupdate/ ./internal/authenticode/
       - run: go test -race -count=1 -run '^TestReal_' ./internal/detector/
       - name: Test scheduled scan console suppression
         run: go test -race -count=1 -run 'Test(IsTaskRegistered|DetectInvocationMethod_Windows|HideWindow)' ./internal/schtasks/ ./internal/telemetry/ ./internal/winproc/
+      - name: Test self-update fault injection + U0 kill matrix (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys ./internal/faultinject/ ./internal/updatestate/ ./internal/selfupdate/ ./internal/authenticode/
+      - name: Authenticode against test-signed binaries (verbose, shows skips)
+        run: go test -count=1 -v -run 'TestVerify' ./internal/authenticode/
+      - name: Test launcher bootstrap mode and self-update tasks
+        run: |
+          go test -race -count=1 ./internal/launcher/
+          go test -race -count=1 -tags selfupdate_faults ./internal/launcher/
+          go test -race -count=1 -run 'Test(UpdateTask|ResolveBootstrapRoot|BuildCreateArgs_Bootstrap|InstallUpdateTask|Uninstall_|TerminateUnder|WaitForInstanceMutex|StopProcess)' ./internal/schtasks/
 
   smoke:
     name: Smoke Tests

cmd/stepsecurity-dev-machine-guard-task/main.go

@@ -25,6 +25,16 @@
 //     `powershell.exe -File loader.ps1 send-telemetry` in the same
 //     no-console envelope the MSI flow uses for the agent.
 //
+//   - Bootstrap mode. Invoked under the file name
+//     stepsecurity-dev-machine-guard-bootstrap.exe (the MSI installs a
+//     second copy of this launcher under that name), the verbs run /
+//     update / adopt-seed resolve the self-update state.json pointer and
+//     launch the versioned binaries. See internal/launcher/bootstrap.go.
+//
+// When launched by the bootstrap (STEPSEC_BOOTSTRAP_VERSION set), failing to
+// resolve or start the agent exits 70 so the run counts as bad (D5); other
+// invocations keep their legacy exit codes.
+//
 // The agent (and any --exec target) stays console-subsystem so
 // interactive CLI use continues to work normally.
 //
@@ -40,14 +50,13 @@ import (
 	"os"
 	"os/exec"
 	"syscall"
-	"unsafe"
 
+	"github.com/step-security/dev-machine-guard/internal/faultinject"
 	"github.com/step-security/dev-machine-guard/internal/launcher"
+	"github.com/step-security/dev-machine-guard/internal/winproc"
 	"golang.org/x/sys/windows"
 )
 
-const createNoWindow uint32 = 0x08000000
-
 func main() {
 	os.Exit(run(os.Args[1:]))
 }
@@ -56,6 +65,11 @@ func main() {
 // after the program name (os.Args[1:] in main); accepting it explicitly
 // keeps the windows-only test path open if we add one later.
 func run(argv []string) int {
+	if me, err := os.Executable(); err == nil && launcher.IsBootstrapBinary(me) {
+		return launcher.NewBootstrap(me, winproc.IsLocalSystem).Main(argv)
+	}
+	underBootstrap := os.Getenv(launcher.EnvBootstrapVersion) != ""
+
 	target, childArgs, err := launcher.ResolveTarget(argv)
 	if err != nil {
 		// Two distinct failure shapes, matched to the legacy contract:
@@ -76,16 +90,22 @@ func run(argv []string) int {
 			fmt.Fprintln(os.Stderr, err)
 			return 2
 		}
+		if underBootstrap {
+			return launcher.ExitCannotStart
+		}
 		return 1
 	}
 
 	cmd := exec.Command(target, childArgs...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		HideWindow:    true,
-		CreationFlags: createNoWindow,
+		CreationFlags: launcher.CreateNoWindow,
 	}
 
 	if err := cmd.Start(); err != nil {
+		if underBootstrap {
+			return launcher.ExitCannotStart
+		}
 		return 1
 	}
 
@@ -94,17 +114,18 @@ func run(argv []string) int {
 	// exit, which fires the kill. Failure here only weakens lifecycle
 	// (orphan possible on forced termination), not the work the child
 	// was started to do.
-	if job, jerr := newKillOnCloseJob(); jerr == nil {
-		if h, oerr := windows.OpenProcess(
-			windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE,
-			false,
-			uint32(cmd.Process.Pid),
-		); oerr == nil {
-			_ = windows.AssignProcessToJobObject(job, h)
-			_ = windows.CloseHandle(h)
+	if job, jerr := launcher.NewKillOnCloseJob(); jerr == nil {
+		if aerr := launcher.AssignToJob(job, cmd.Process.Pid); aerr != nil {
+			_ = windows.CloseHandle(job)
 		}
 	}
 
+	// Lets a test build crash a version's scans after launch (harness
+	// baked fault boot.launched@user:exit2); a no-op in release builds.
+	if underBootstrap {
+		_ = faultinject.Point("boot.launched")
+	}
+
 	if err := cmd.Wait(); err != nil {
 		var ee *exec.ExitError
 		if errors.As(err, &ee) {
@@ -114,27 +135,3 @@ func run(argv []string) int {
 	}
 	return 0
 }
-
-func newKillOnCloseJob() (windows.Handle, error) {
-	job, err := windows.CreateJobObject(nil, nil)
-	if err != nil {
-		return 0, err
-	}
-	info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
-		BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
-			// BREAKAWAY_OK lets the agent's CREATE_BREAKAWAY_FROM_JOB spawns
-			// (WSL guest scans) outlive this run instead of being killed.
-			LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | windows.JOB_OBJECT_LIMIT_BREAKAWAY_OK,
-		},
-	}
-	if _, err := windows.SetInformationJobObject(
-		job,
-		windows.JobObjectExtendedLimitInformation,
-		uintptr(unsafe.Pointer(&info)),
-		uint32(unsafe.Sizeof(info)),
-	); err != nil {
-		_ = windows.CloseHandle(job)
-		return 0, err
-	}
-	return job, nil
-}

cmd/stepsecurity-dev-machine-guard/main.go

@@ -74,6 +74,10 @@ func main() {
 		os.Exit(aiagentscli.RunHook(os.Stdin, os.Stdout, os.Stderr, os.Args[2:]))
 	}
 
+	// agent.prestart fault checkpoint and the Windows self-update verbs
+	// (self-update --system, self-check); they exit here.
+	runEarlyVerbs(os.Args[1:])
+
 	// Load persisted config (~/.stepsecurity/config.json) before parsing CLI
 	// --config must be honoured before Load(), which runs ahead of flag
 	// parsing and keeps the first values it reads.
@@ -238,6 +242,7 @@ func main() {
 			APIEndpoint:   cfg.ConfigAPIEndpoint,
 			APIKey:        cfg.ConfigAPIKey,
 			ScanFrequency: cfg.ConfigScanFrequency,
+			AutoUpdate:    cfg.ConfigAutoUpdate,
 		}
 		if opts.APIKey == "" {
 			// Env-var fallback keeps the secret off the msiexec command
@@ -274,6 +279,7 @@ func main() {
 			log.Error("Enterprise configuration not found. Run '%s configure' or download the script from your StepSecurity dashboard.", os.Args[0])
 			os.Exit(1)
 		}
+		reportBootstrapFallback()
 		// Server-driven run gate: exit 0 quietly when the backend says this
 		// invocation isn't due (or another instance is mid-scan). Sits before
 		// the watchdog and telemetry.Run so a skipped wakeup posts no beacon,