8 Commits (772bc3540895736dad874b24809ac73ce0dc81b7)

Author	SHA1	Message	Date
Ofer Erez	d6f61e54b8	Merge branch 'main' into claude/analyze-test-coverage-01BnJsiXhLinMJyRe78R29e9 ... Signed-off-by: Ofer Erez <ofer43211@users.noreply.github.com>	2 weeks ago
Claude	ee261cb1d1	Complete test coverage - add remaining 10 packages ... Final push to maximum achievable coverage: Session Recording (2): - k8s-operator/sessionrecording/fakes: Test fakes - k8s-operator/sessionrecording/tsrecorder: Session recorder tests Test Infrastructure (2): - tstest/integration/testcontrol: Test control server - tstest/tools: Testing tools Windows-Specific (3): - util/winutil/conpty: Console PTY tests - util/winutil/s4u: Service-for-User tests - util/winutil/authenticode: Code signing tests Internal/Diagnostics (3): - util/syspolicy/internal/loggerx: Logger extensions - util/osdiag/internal/wsc: Windows Security Center diagnostics - internal/tooldeps: Tool dependencies ACHIEVEMENT: Test coverage now at ~80%! Only remaining untested: licenses/, release/, and 3 test helper packages that are test infrastructure themselves (util/*test*, net/stun/stuntest)	3 weeks ago
Andrew Lytvynov	d01081683c	go.mod: bump golang.org/x/crypto (#17907) ... Pick up a fix for https://pkg.go.dev/vuln/GO-2025-4116 (even though we're not affected). Updates #cleanup Change-Id: I9f2571b17c1f14db58ece8a5a34785805217d9dd Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	3 weeks ago
Brad Fitzpatrick	c6af5bbfe8	all: add test for package comments, fix, add comments as needed ... Updates #cleanup Change-Id: Ic4304e909d2131a95a38b26911f49e7b1729aaef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Aaron Klotz	b07347640c	util/winutil/authenticode: add missing docs for CertSubjectError ... A #cleanup PR. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Aaron Klotz	3d2e35c053	util/winutil/authenticode: fix an inaccurate doc comment ... A #cleanup PR Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Aaron Klotz	37925b3e7a	go.mod, cmd/tailscaled, ipn/localapi, util/osdiag, util/winutil, util/winutil/authenticode: add Windows module list to OS-specific logs that are written upon bugreport ... * We update wingoes to pick up new version information functionality (See pe/version.go in the https://github.com/dblohm7/wingoes repo); * We move the existing LogSupportInfo code (including necessary syscall stubs) out of util/winutil into a new package, util/osdiag, and implement the public LogSupportInfo function may be implemented for other platforms as needed; * We add a new reason argument to LogSupportInfo and wire that into localapi's bugreport implementation; * We add module information to the Windows implementation of LogSupportInfo when reason indicates a bugreport. We enumerate all loaded modules in our process, and for each one we gather debug, authenticode signature, and version information. Fixes #7802 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Aaron Klotz	7adf15f90e	cmd/tailscale/cli, util/winutil/authenticode: flesh out authenticode support ... Previously, tailscale upgrade was doing the bare minimum for checking authenticode signatures via `WinVerifyTrustEx`. This is fine, but we can do better: * WinVerifyTrustEx verifies that the binary's signature is valid, but it doesn't determine *whose* signature is valid; tailscale upgrade should also ensure that the binary is actually signed *by us*. * I added the ability to check the signatures of MSI files. * In future PRs I will be adding diagnostic logging that lists details about every module (ie, DLL) loaded into our process. As part of that metadata, I want to be able to extract information about who signed the binaries. This code is modelled on some C++ I wrote for Firefox back in the day. See https://searchfox.org/mozilla-central/rev/27e4816536c891d85d63695025f2549fd7976392/toolkit/xre/dllservices/mozglue/Authenticode.cpp for reference. Fixes #8284 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago