fix(components): verify CBS package integrity by content hash before install

Assert-AtlasCbsCertificate only checked for an EKU, so a tampered or attacker
re-signed CAB could pass. Thumbprint-pinning (the obvious fix) is unworkable:
the sxsc builder regenerates the signing cert on every build (make-cert.ps1 ->
New-SelfSignedCertificate), so no thumbprint is stable — which is also why the
8A334AA8 value in the ROOT-store key no longer matches the shipped CABs' signer.

Instead verify each CAB's SHA256 against a committed Atlas-CbsHashes.psd1 before
Add-WindowsPackage (loaded via the AST so it doesn't depend on PSModulePath under
TrustedInstaller). A PayloadLayout test fails CI if the manifest drifts from the
shipped CABs. The existing EKU check and ROOT-store key are left untouched.

Author: jacksyrm

playbook/Executables/AtlasModules/Packages/Atlas-CbsHashes.psd1

@@ -0,0 +1,13 @@
+# SHA256 of every CBS package shipped in this folder, verified before install by
+# Atlas.Software\Domain\CbsPackages.ps1 (Assert-AtlasCbsHash). The signing cert is
+# regenerated on every CAB rebuild, so its thumbprint is not stable and cannot be
+# pinned; the content hash is. REGENERATE THIS FILE WHENEVER THE CABS ARE REBUILT:
+#   Get-ChildItem *.cab | Sort-Object Name | ForEach-Object {
+#     "    '$($_.Name)' = '$((Get-FileHash $_ -Algorithm SHA256).Hash)'" }
+# A PayloadLayout test fails CI if this drifts from the shipped CABs.
+@{
+    'Z-Atlas-NoDefender-Package31bf3856ad364e35amd645.0.0.0.cab' = '6A8D1F8788277B425766FAD069A8192EDC33EEA2D6F7F9B061A42C941A21D2EC'
+    'Z-Atlas-NoDefender-Package31bf3856ad364e35arm645.0.0.0.cab' = '39500FA6DF403F162C02A9C36D37D2C787BF459C05376872B9962FA649F4E081'
+    'Z-Atlas-NoTelemetry-Package31bf3856ad364e35amd645.0.0.0.cab' = '11C5E3502DCB962F2FAE456712C7982DC1864D686B76194628CBFF8D1CD77ECA'
+    'Z-Atlas-NoTelemetry-Package31bf3856ad364e35arm645.0.0.0.cab' = 'C6526330F660E654B249B63A974793BAE0E39F6714A0B79E03942145195E29A3'
+}

playbook/Executables/AtlasModules/Scripts/Modules/Atlas.Software/Domain/CbsPackages.ps1

@@ -98,6 +98,59 @@ function Assert-AtlasCbsCertificate {
     }
 }
 
+function Get-AtlasCbsExpectedHashes {
+    <#
+    .SYNOPSIS
+        Loads Atlas-CbsHashes.psd1 (the SHA256 of every shipped CAB) from the packages
+        folder. The CAB signing cert is regenerated on every build, so its thumbprint is
+        not stable and cannot be pinned - the content hash is what we verify against.
+    #>
+    param(
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$PackagesPath
+    )
+
+    if ($null -ne $script:AtlasCbsExpectedHashes) {
+        return $script:AtlasCbsExpectedHashes
+    }
+
+    $hashFile = Join-Path -Path $PackagesPath -ChildPath 'Atlas-CbsHashes.psd1'
+    if (-not (Test-Path -LiteralPath $hashFile -PathType Leaf)) {
+        throw "The CBS package hash manifest '$hashFile' is missing; refusing to install unverified packages."
+    }
+
+    # Parse via the AST (SafeGetValue) so loading never depends on a possibly-polluted
+    # PSModulePath under TrustedInstaller (see docs/testing.md).
+    $tableAst = [System.Management.Automation.Language.Parser]::ParseFile($hashFile, [ref]$null, [ref]$null).Find(
+        { param($node) $node -is [System.Management.Automation.Language.HashtableAst] }, $false)
+    if ($null -eq $tableAst) {
+        throw "The CBS package hash manifest '$hashFile' is not a valid data file."
+    }
+
+    $script:AtlasCbsExpectedHashes = $tableAst.SafeGetValue()
+    return $script:AtlasCbsExpectedHashes
+}
+
+function Assert-AtlasCbsHash {
+    param(
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$CabPath
+    )
+
+    $fileName = Split-Path -Path $CabPath -Leaf
+    $expected = Get-AtlasCbsExpectedHashes -PackagesPath (Split-Path -Path $CabPath -Parent)
+    if (-not $expected.ContainsKey($fileName)) {
+        throw "No expected SHA256 is recorded for '$fileName' in the CBS hash manifest; refusing to install an unlisted package."
+    }
+
+    $actual = (Get-FileHash -LiteralPath $CabPath -Algorithm SHA256).Hash
+    if ($actual -ne $expected[$fileName]) {
+        throw "SHA256 mismatch for '$fileName' (got '$actual'); the package may have been modified. Refusing to install it."
+    }
+}
+
 function Install-AtlasCbsCab {
     param(
         [Parameter(Mandatory = $true)]
@@ -109,6 +162,15 @@ function Install-AtlasCbsCab {
     Write-Host "`nInstalling $fileName..." -ForegroundColor Cyan
     Write-Host ('-' * 84) -ForegroundColor Magenta
 
+    Write-Host '[INFO] Verifying package hash...'
+    try {
+        Assert-AtlasCbsHash -CabPath $CabPath
+    }
+    catch {
+        Write-Host "[ERROR] Hash verification failed for '$CabPath': $($_.Exception.Message)" -ForegroundColor Red
+        return $false
+    }
+
     Write-Host '[INFO] Checking certificate...'
     try {
         Assert-AtlasCbsCertificate -CabPath $CabPath

tests/Atlas.PayloadLayout.Tests.ps1

@@ -40,3 +40,26 @@ Describe 'Paired registry assets stay in lockstep' {
         $hashB | Should -Be $hashA -Because 'the Toolbox copy must match its Scripts/Registry source; edit both together'
     }
 }
+
+Describe 'CBS package hash manifest stays in lockstep with the shipped CABs' {
+    # Atlas-CbsHashes.psd1 is verified before install by Assert-AtlasCbsHash. If a CAB is
+    # rebuilt without regenerating the manifest, this fails CI instead of shipping a gate
+    # that would reject every real package at install time.
+    It 'records the correct SHA256 for every shipped .cab and lists no stale entries' {
+        $pkgDir = Join-Path -Path $script:executablesRoot -ChildPath 'AtlasModules\Packages'
+        $manifestPath = Join-Path -Path $pkgDir -ChildPath 'Atlas-CbsHashes.psd1'
+        Test-Path -LiteralPath $manifestPath -PathType Leaf | Should -BeTrue
+        $manifest = Import-PowerShellDataFile -LiteralPath $manifestPath
+
+        $cabs = @(Get-ChildItem -LiteralPath $pkgDir -Filter '*.cab' -File)
+        $cabs.Count | Should -BeGreaterThan 0
+
+        foreach ($cab in $cabs) {
+            $manifest.Keys | Should -Contain $cab.Name
+            (Get-FileHash -LiteralPath $cab.FullName -Algorithm SHA256).Hash | Should -Be $manifest[$cab.Name]
+        }
+        foreach ($listed in $manifest.Keys) {
+            $cabs.Name | Should -Contain $listed
+        }
+    }
+}