Security hardening: trust management, signatures, onboarding

[Hefaistos68]

• Add key management mode selection (DPAPI vs. certificates) with onboarding dialog
• Enforce asymmetric signatures for trust/policy files; require .signature sidecar
• Implement repository pinning for signature enforcement
• Add trust purging on settings downgrade and UI commands for trust removal
• Support root CA pinning via environment variable
• Refactor signature storage for cross-platform compatibility
• Update settings, menus, and documentation for new workflows
• Add/expand tests for trust management and onboarding
• Bump extension/package versions

[Copilot]

⚠️ Not ready to approve

Several critical issues (VS command binding, VS CoreSettings propagation, VS Code trust deletion targeting, and trust pinning scope) can break the intended security and purge workflows.

Pull request overview

This PR strengthens MSBuild Guard’s trust/policy integrity model by introducing key-management mode onboarding, asymmetric signature enforcement with sidecar .signature files, and “trust purge” workflows in both the Visual Studio and VS Code extensions.

Changes:

• Added settings + onboarding for key management mode (DPAPI vs certificates) and new enforcement toggles.
• Switched signature storage to cross-platform sidecar files and added repository “pinning” behavior to keep asymmetric enforcement sticky.
• Added UI/commands to remove/purge trust stores and expanded tests around trust/signature behavior.

File summaries

File	Description
README.md	Links to advanced trust management documentation.
MSBuildGuard.Worker/Program.cs	Reads env vars to set core enforcement/sharing flags for the worker process.
MSBuildGuard.VSCode/src/views/securityReviewView.ts	Adds “Remove All Project Trusts” UI + message wiring in the webview.
MSBuildGuard.VSCode/src/views/onboardingView.ts	Minor layout CSS update for onboarding content container.
MSBuildGuard.VSCode/src/services/workerClient.ts	Passes enforcement/sharing settings to worker via env vars.
MSBuildGuard.VSCode/src/extension.ts	Adds trust removal/purge commands and first-run key mode picker + downgrade purge logic.
MSBuildGuard.VSCode/package.json	Bumps version; adds commands and settings for new workflows.
MSBuildGuard.VSCode/package-lock.json	Lockfile version bump to match package.json version.
MSBuildGuard.VisualStudio/UnifiedSettings/msbuildguard.registration.json	Registers new unified settings entries for onboarding/key mode/enforcement.
MSBuildGuard.VisualStudio/ToolWindows/SolutionSecurityReviewViewModel.cs	Adds “remove project trusts” capability and enablement state.
MSBuildGuard.VisualStudio/ToolWindows/SolutionSecurityReviewControl.xaml.cs	Adds click handler for project trust removal confirmation + execution.
MSBuildGuard.VisualStudio/ToolWindows/SolutionSecurityReviewControl.xaml	Adds “Remove All Project Trusts” button and UI layout change.
MSBuildGuard.VisualStudio/ToolWindows/KeyManagementOnboardingViewModel.cs	New view model for key management onboarding dialog.
MSBuildGuard.VisualStudio/ToolWindows/KeyManagementOnboardingDialog.xaml.cs	New onboarding dialog behavior (mode selection buttons).
MSBuildGuard.VisualStudio/ToolWindows/KeyManagementOnboardingDialog.xaml	New onboarding dialog UI.
MSBuildGuard.VisualStudio/source.extension.vsixmanifest	Bumps VSIX version.
MSBuildGuard.VisualStudio/PackageIds.cs	Adds command IDs for new “remove trusts” menu items.
MSBuildGuard.VisualStudio/Options/UnifiedSettingsOptionsProvider.cs	Reads/enumerates new settings in the options snapshot.
MSBuildGuard.VisualStudio/Options/SettingsNames.cs	Adds unified settings keys for key mode and asymmetric enforcement.
MSBuildGuard.VisualStudio/Options/MSBuildGuardOptionsSnapshot.cs	Extends options snapshot with key mode + enforcement flags.
MSBuildGuard.VisualStudio/Options/MSBuildGuardOptionsPage.cs	Adds key mode/enforcement options and guards repository sharing in DPAPI mode.
MSBuildGuard.VisualStudio/MSBuildGuardPackage.cs	Adds downgrade purge workflow and registers remove-trusts commands + onboarding checks.
MSBuildGuard.VisualStudio/MSBuildGuard.VisualStudio.csproj	Bumps extension assembly version.
MSBuildGuard.VisualStudio/Menus.vsct	Adds menu groups and new “Remove All … Trusts” commands.
MSBuildGuard.VisualStudio.Tests/ToolWindows/ManageSignerTrustsHelperTests.cs	Updates tests to write trust stores using TrustStoreService.Save().
MSBuildGuard.VisualStudio.Tests/ToolWindows/ManagePackageTrustsHelperTests.cs	Updates tests to write trust stores using TrustStoreService.Save().
MSBuildGuard.VisualStudio.Tests/ToolWindows/ManageAssemblyTrustsHelperTests.cs	Updates tests to write trust stores using TrustStoreService.Save().
MSBuildGuard.VisualStudio.Tests/ToolWindows/KeyManagementOnboardingViewModelTests.cs	Adds tests for new onboarding view model defaults/setters.
MSBuildGuard.Core/Trust/TrustStoreService.cs	Enforces signed trust format; adds asymmetric signing/verification + pinning and DPAPI/local key logic.
MSBuildGuard.Core/Policy/PolicyService.cs	Enforces missing signature behavior under strict mode; uses .signature sidecar; adds root CA pinning logic.
MSBuildGuard.Core/CoreSettings.cs	Introduces global core settings for asymmetric enforcement and repo trust sharing.
MSBuildGuard.Core.Tests/Trust/TrustStoreServiceTests.cs	Adds/updates tests for unsigned trust rejection, asymmetric enforcement, pinning, and audit tamper detection.
MSBuildGuard.Core.Tests/Policy/PolicyServiceTests.cs	Updates for sidecar signature storage and adds CA pinning tests.
MSBuildGuard.Core.Tests/CoreSettingsTests.cs	Adds basic test coverage for new CoreSettings properties.
documentation/ADVANCED-TRUST-MANAGEMENT.md	Adds detailed guide for key modes, signatures, pinning, purging, and enterprise CA setup.

Copilot's findings

Files not reviewed (1)

• MSBuildGuard.VSCode/package-lock.json: Generated file

• Files reviewed: 34/35 changed files
• Comments generated: 11

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

[Copilot]

⚠️ Not ready to approve

Core trust-store persistence currently breaks asymmetric signature validity (and has an insecure DPAPI fallback), and the VS package init may resume off the UI thread due to ConfigureAwait(false).

Copilot's findings

Files not reviewed (1)

• MSBuildGuard.VSCode/package-lock.json: Generated file

• Files reviewed: 36/37 changed files
• Comments generated: 5

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.