Add automatic AuthRoot cache for portable trust (#24)

## Summary
- Add automatic Microsoft AuthRoot CAB caching for portable trust
verification when no explicit anchors are supplied, with a 7-day stale
refresh window and environment overrides.
- Route supported `--mode portable verify` calls through portable trust
verification by default when auto trust is enabled, and align the
PowerShell module cache behavior.
- Normalize exact duplicate certificates in Authenticode
`SignedData.certificates` bags so Windows-valid Azure Artifact Signing
signatures parse in the strict Rust CMS stack.

## Validation
- `cargo build --locked`
- `cargo clippy --workspace --all-targets --locked`
- `cargo test -p psign-sip-digest pkcs7_wire --locked`
- `cargo test -p psign-authenticode-trust --lib --locked`
- `cargo test -p psign-authenticode-trust authroot_cache --locked`
- `dotnet build
dotnet/Devolutions.Psign.PowerShell/Devolutions.Psign.PowerShell.csproj`
- `bash scripts/linux-portable-validation.sh`
- `psign-tool --mode portable verify tursodb.exe` with a fresh AuthRoot
cache

Known baseline: full `cargo test --workspace --locked` still fails on
the existing `tests/fixtures/msix-minimal/AppxManifest.xml` fixture
manifest-size mismatch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mamoreau-devolutions

Cargo.lock

@@ -95,7 +95,7 @@ New-PSDrive -Name certs -PSProvider PortableCertStore -Root ./project-certs
 
 ## Trust Model
 
-By default, `Get-PsignSignature` automatically downloads and caches the Microsoft AuthRoot CAB (~350KB) for trust evaluation. The cache lives at `~/.psign/authroot/`.
+By default, `Get-PsignSignature`, `Test-PsignFileCatalog`, and `Test-PsignModule` automatically download and cache the Microsoft AuthRoot CAB for trust evaluation when no explicit trust anchors are supplied. The cache lives at `~/.psign/authroot/` and is refreshed when it is older than 7 days. Set `PSIGN_AUTHROOT_MAX_AGE_DAYS`, `PSIGN_AUTHROOT_CACHE_DIR`, or `PSIGN_AUTHROOT_URL` to override the stale window, cache directory, or source URL.
 
 ```powershell
 # Disable auto-trust

PowerShell/README.md

@@ -86,7 +86,9 @@ cargo build -p psign --bin psign-tool --locked
 # Portable PE signing with a local RSA key:
 # psign-tool portable sign-pe --cert cert.der --key key.pk8 --output signed.exe unsigned.exe
 # Existing PE signatures are replaced by default; add --append-signature to match signtool /as.
-# Portable trust verification with explicit anchors:
+# Portable trust verification downloads/caches Microsoft AuthRoot automatically when no anchors are supplied:
+# psign-tool portable trust-verify-pe signed.exe
+# Explicit anchors still override auto trust:
 # psign-tool portable trust-verify-pe signed.exe --anchor-dir anchors
 # Portable custom ZIP Authenticode verification:
 # psign-tool portable trust-verify-zip archive.zip --anchor-dir anchors

README.md

@@ -10,6 +10,7 @@ repository.workspace = true
 anyhow = "1"
 base64 = "0.22"
 serde = { version = "1", features = ["derive"] }
+serde_json = "1"
 cms = "0.2.3"
 der = { version = "0.7", features = ["derive"] }
 digest = "0.10"
@@ -20,7 +21,7 @@ authenticode = { version = "0.5.0", features = ["std", "object"] }
 psign-sip-digest = { path = "../psign-sip-digest" }
 picky = { version = "7.0.0-rc.23", features = ["pkcs7", "time_conversion"] }
 picky-asn1-x509 = "0.15.4"
-time = "0.3"
+time = { version = "0.3", features = ["formatting", "parsing"] }
 x509-cert = "0.2.5"
 cab = "0.6"