Repository navigation
Conversation
On WSL2 with interop, keys registered as windows_hello_keys let the agent approve a request by a signature from a Windows Hello key credential. The client has mairu-windows-hello.exe sign the agent's challenge through interop, and the agent verifies the RSA PKCS #1 v1.5 SHA-256 signature against the registered keys, so nothing the helper says counts on its own. The challenge flow is the ssh-agent one, now per method: a signature answers only a challenge of its method, and a decline covers its method and those before it. A cancelled dialog is answered with a "cancelled" decline, which the agent turns into a denial instead of asking another method. A hardened client runs the helper only while its SHA-256 matches the pin recorded by a release build, or the approved windows_hello_helper_sha256, which the approval anchor also records so that changes can be approved while the files are unapproved. The helper is a feature-gated Windows bin of this package; release archives and debs ship it for the matching Windows architecture. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dg17LE9aWqsb1VBUCVcKLM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dg17LE9aWqsb1VBUCVcKLM
sorah
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements docs/specs/016-windows-hello.md.
mairu-windows-hello.exe([[bin]]behindwindows-hello-helper,windows0.62):public-key,createandsignagainst theco.0w0.mairuKeyCredential, bringing the Windows Hello dialog to the frontwindows-hellopresence method on WSL2 with interop: the agent issues the same single-use challenges as ssh-agent and verifies RSA-2048 PKCS#1 v1.5 SHA-256 signatures againstwindows_hello_keys; default orderssh-agent,windows-hello,platform/usr/lib/mairu/, or viaconfig.json, and runs it only if its SHA-256 matches the pin (MAIRU_WINDOWS_HELLO_HELPER_SHA256at build time, or approvedwindows_hello_helper_sha256, also recorded in the approval anchor). It re-hashes the file right before each runmairu policy enroll-windows-hello;doctorandpolicy checkreport keys and the helperwindows-latestjob builds and attests x86_64/aarch64 helpers; Linux tarballs and debs ship the matching exe with the pin set at build time. CI builds and lints the helper#![cfg(unix)]and protos are skipped on non-Unix targets, so Windows runners need no protocNot verified on real Windows: the KeyCredential calls, dialog focus, running the exe from the Linux filesystem (Q-W6), and the MSVC builds on Actions. The helper type-checks and lints for both MSVC targets and links under mingw. Verified in Docker (71 checks) with a fake helper speaking the protocol with OpenSSL RSA keys: pinning, enrolment, approval through polkit then Windows Hello, cancel, wrong-key and replayed signatures, tampered helpers, and the release deb.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Dg17LE9aWqsb1VBUCVcKLM