Back out WSL CA sync setup step

Remove the broken Windows CA certificate sync setup step after validation showed it was dead on arrival.

Author: shanselman

src/OpenClaw.SetupEngine/SetupPipeline.cs

@@ -56,7 +56,6 @@ public static List<SetupStep> BuildDefaultSteps()
             new CreateWslInstanceStep(),
             new ConfigureWslInstanceStep(),
             new ValidateWslLockdownStep(),
-            new SyncWindowsCaCertsStep(),
             new InstallCliStep(),
             new ConfigureGatewayStep(),
             new InstallGatewayServiceStep(),

src/OpenClaw.SetupEngine/SetupSteps.cs

@@ -3,9 +3,6 @@
 using System.Net.Http;
 using System.Net.Sockets;
 using System.Runtime.InteropServices;
-using System.Security.Cryptography;
-using System.Security.Cryptography.X509Certificates;
-using System.Text;
 using System.Text.Json;
 using OpenClaw.Connection;
 using OpenClaw.Shared;
@@ -1179,239 +1176,6 @@ private static void ValidateConfValue(Dictionary<string, Dictionary<string, stri
 // GATEWAY INSTALL STEPS
 // ═══════════════════════════════════════════════════════════════════
 
-/// <summary>
-/// Exports Windows trusted root CA certificates into the WSL
-/// distro's system trust store.  This resolves curl exit-60 failures that
-/// occur on corporate networks where a TLS-intercepting proxy injects a
-/// self-signed certificate that the WSL Ubuntu instance does not trust.
-/// The step is non-fatal: if the Windows store cannot be read or the WSL
-/// trust store cannot be updated, it logs a warning and continues so that
-/// setups on non-proxied networks are not blocked.
-/// </summary>
-public sealed class SyncWindowsCaCertsStep : SetupStep
-{
-    private const string ManagedCertDirectory = "/usr/local/share/ca-certificates/openclaw-windows";
-    private const string InstallScript = """
-        set -euo pipefail
-
-        target=/usr/local/share/ca-certificates/openclaw-windows
-        parent=/usr/local/share/ca-certificates
-        backup_parent=/var/lib/openclaw-setup
-        backup="$backup_parent/windows-ca-certificates.backup"
-        install -d -m 0700 -o root -g root "$backup_parent"
-        staging="$(mktemp -d "$parent/.openclaw-windows.XXXXXX")"
-        chmod 0755 "$staging"
-        old_moved=0
-        new_installed=0
-
-        cleanup() {
-          rm -rf -- "$staging"
-          if [ "$new_installed" -eq 1 ]; then
-            rm -rf -- "$target"
-          fi
-          if [ "$old_moved" -eq 1 ] && [ -d "$backup" ]; then
-            mv -- "$backup" "$target"
-          fi
-          rm -rf -- "$backup"
-          if [ "$old_moved" -eq 1 ] || [ "$new_installed" -eq 1 ]; then
-            update-ca-certificates --fresh >/dev/null 2>&1 || true
-          fi
-        }
-        trap cleanup EXIT
-
-        if [ -d "$backup" ]; then
-          rm -rf -- "$target"
-          mv -- "$backup" "$target"
-          update-ca-certificates --fresh
-        fi
-
-        count=0
-        while IFS=$'\t' read -r fingerprint payload; do
-          if [ -z "$fingerprint" ] && [ -z "$payload" ]; then
-            continue
-          fi
-          case "$fingerprint" in
-            ''|*[!0-9A-Fa-f]*) echo "Invalid certificate fingerprint" >&2; exit 64 ;;
-          esac
-          if [ "${#fingerprint}" -ne 64 ]; then
-            echo "Invalid certificate fingerprint length" >&2
-            exit 64
-          fi
-          case "$payload" in
-            ''|*[!A-Za-z0-9+/=]*) echo "Invalid certificate payload" >&2; exit 64 ;;
-          esac
-
-          fingerprint="${fingerprint,,}"
-          cert_path="$staging/$fingerprint.crt"
-          {
-            printf '%s\n' '-----BEGIN CERTIFICATE-----'
-            printf '%s\n' "$payload" | fold -w 64
-            printf '%s\n' '-----END CERTIFICATE-----'
-          } > "$cert_path"
-          chmod 0644 "$cert_path"
-
-          if ! openssl x509 -in "$cert_path" -noout >/dev/null 2>&1; then
-            echo "Invalid X.509 certificate for $fingerprint" >&2
-            exit 65
-          fi
-          actual="$(openssl x509 -in "$cert_path" -outform DER | sha256sum | cut -d ' ' -f1)"
-          if [ "$actual" != "$fingerprint" ]; then
-            echo "Certificate fingerprint mismatch for $fingerprint" >&2
-            exit 65
-          fi
-          count=$((count + 1))
-        done
-
-        if [ "$count" -eq 0 ]; then
-          echo "No certificates received" >&2
-          exit 64
-        fi
-
-        if [ -d "$target" ]; then
-          mv -- "$target" "$backup"
-          old_moved=1
-        fi
-        mv -- "$staging" "$target"
-        new_installed=1
-        update-ca-certificates --fresh
-
-        rm -rf -- "$backup"
-        old_moved=0
-        new_installed=0
-        trap - EXIT
-        """;
-    private const string RollbackScript = """
-        set -e
-        target=/usr/local/share/ca-certificates/openclaw-windows
-        backup=/var/lib/openclaw-setup/windows-ca-certificates.backup
-        if [ -d "$target" ]; then
-          rm -rf -- "$target"
-          update-ca-certificates --fresh
-        fi
-        rm -rf -- "$backup"
-        """;
-
-    private readonly Func<WindowsCaCertificateExport> _exportCertificates;
-
-    public SyncWindowsCaCertsStep() : this(ExportWindowsTrustedRoots) { }
-
-    internal SyncWindowsCaCertsStep(Func<WindowsCaCertificateExport> exportCertificates)
-        => _exportCertificates = exportCertificates;
-
-    public override string Id => "sync-ca-certs";
-    public override string DisplayName => "Sync Windows CA certificates to WSL";
-    public override bool CanRetry => false;
-
-    public override async Task<StepResult> ExecuteAsync(SetupContext ctx, CancellationToken ct)
-    {
-        var distro = ctx.DistroName!;
-
-        WindowsCaCertificateExport export;
-        try
-        {
-            export = _exportCertificates();
-        }
-        catch (Exception ex)
-        {
-            ctx.Logger.Warn($"Could not read Windows CA store: {ex.Message} — skipping CA sync");
-            return StepResult.Ok("Skipped: could not read Windows CA store");
-        }
-
-        foreach (var warning in export.Warnings)
-            ctx.Logger.Warn(warning);
-
-        if (export.CertificateCount == 0)
-        {
-            ctx.Logger.Warn("Windows CA store returned no certificates — skipping CA sync");
-            return StepResult.Ok("Skipped: Windows CA store is empty");
-        }
-
-        var result = await ctx.Commands.RunAsync(
-            WslConstants.WslExePath,
-            ["-d", distro, "-u", "root", "--", "bash", "-c", NormalizeShellScript(InstallScript)],
-            TimeSpan.FromSeconds(60),
-            workingDirectory: WslConstants.SafeWindowsWorkingDirectory,
-            stdinInput: export.Manifest,
-            ct: ct);
-
-        if (result.ExitCode != 0)
-        {
-            ctx.Logger.Warn($"update-ca-certificates exited {result.ExitCode}: {result.Stderr.Trim()}");
-            return StepResult.Ok($"Skipped: could not update WSL CA certificates (exit {result.ExitCode})");
-        }
-
-        ctx.Logger.Info($"Synced {export.CertificateCount} Windows CA certificates to WSL trust store");
-        return StepResult.Ok($"Synced {export.CertificateCount} Windows CA certificates to WSL");
-    }
-
-    public override async Task RollbackAsync(SetupContext ctx, CancellationToken ct)
-    {
-        var distro = ctx.DistroName!;
-        var result = await ctx.Commands.RunAsync(
-            WslConstants.WslExePath,
-            ["-d", distro, "-u", "root", "--", "bash", "-c", NormalizeShellScript(RollbackScript)],
-            TimeSpan.FromSeconds(30),
-            workingDirectory: WslConstants.SafeWindowsWorkingDirectory,
-            ct: ct);
-        if (result.ExitCode == 0)
-        {
-            ctx.Logger.Info($"[Rollback] Removed {ManagedCertDirectory} from WSL trust store");
-            return;
-        }
-
-        throw new InvalidOperationException(
-            $"Could not remove synced CA certificates (exit {result.ExitCode}): {result.Stderr.Trim()}");
-    }
-
-    internal static WindowsCaCertificateExport BuildCertificateManifest(
-        IEnumerable<byte[]> rawCertificates,
-        IReadOnlyList<string>? warnings = null)
-    {
-        var certificates = new SortedDictionary<string, string>(StringComparer.Ordinal);
-        foreach (var rawCertificate in rawCertificates)
-        {
-            var fingerprint = Convert.ToHexString(SHA256.HashData(rawCertificate)).ToLowerInvariant();
-            certificates.TryAdd(fingerprint, Convert.ToBase64String(rawCertificate));
-        }
-
-        var manifest = new StringBuilder();
-        foreach (var (fingerprint, payload) in certificates)
-            manifest.Append(fingerprint).Append('\t').Append(payload).Append('\n');
-
-        return new WindowsCaCertificateExport(manifest.ToString(), certificates.Count, warnings ?? []);
-    }
-
-    private static string NormalizeShellScript(string script)
-        => script.Replace("\r", "", StringComparison.Ordinal);
-
-    private static WindowsCaCertificateExport ExportWindowsTrustedRoots()
-    {
-        var rawCertificates = new List<byte[]>();
-        var warnings = new List<string>();
-        foreach (var location in new[] { StoreLocation.LocalMachine, StoreLocation.CurrentUser })
-        {
-            try
-            {
-                using var store = new X509Store(StoreName.Root, location);
-                store.Open(OpenFlags.ReadOnly);
-                foreach (var certificate in store.Certificates)
-                    rawCertificates.Add(certificate.RawData);
-            }
-            catch (Exception ex) when (ex is CryptographicException or UnauthorizedAccessException)
-            {
-                warnings.Add($"Could not read Windows {location} Root store: {ex.Message}");
-            }
-        }
-
-        return BuildCertificateManifest(rawCertificates, warnings);
-    }
-}
-
-internal sealed record WindowsCaCertificateExport(
-    string Manifest,
-    int CertificateCount,
-    IReadOnlyList<string> Warnings);
-
 public sealed class InstallCliStep : SetupStep
 {
     public override string Id => "install-cli";

tests/OpenClaw.SetupEngine.Tests/SetupPipelineTests.cs

@@ -60,15 +60,15 @@ public void BuildDefaultSteps_IncludesCurrentSetupFlow()
     {
         var steps = SetupStepFactory.BuildDefaultSteps();
 
-        Assert.Equal(20, steps.Count);
+        Assert.Equal(19, steps.Count);
         Assert.IsType<PreflightOsStep>(steps[0]);
         Assert.IsType<PreflightWslStep>(steps[1]);
         Assert.IsType<CleanupStaleDistroStep>(steps[2]);
         Assert.IsType<CleanupStaleGatewayStep>(steps[3]);
         Assert.Contains(steps, s => s is ValidateWslLockdownStep);
-        var caSyncIndex = steps.FindIndex(s => s is SyncWindowsCaCertsStep);
+        var lockdownIndex = steps.FindIndex(s => s is ValidateWslLockdownStep);
         var cliInstallIndex = steps.FindIndex(s => s is InstallCliStep);
-        Assert.Equal(cliInstallIndex - 1, caSyncIndex);
+        Assert.Equal(lockdownIndex + 1, cliInstallIndex);
         Assert.Contains(steps, s => s is RunGatewayWizardStep);
         var pairNodeIndex = steps.FindIndex(s => s is PairNodeStep);
         Assert.IsType<VerifyEndToEndStep>(steps[pairNodeIndex + 1]);

tests/OpenClaw.SetupEngine.Tests/SetupStepsTests.cs

@@ -1521,109 +1521,6 @@ public async Task PairOperatorStep_FailsWhenGatewayNotReachableFromWindows()
         Assert.Contains("not reachable", result.Message, StringComparison.OrdinalIgnoreCase);
     }
 
-    // ─── SyncWindowsCaCertsStep ───
-
-    [Fact]
-    public void SyncWindowsCaCerts_BuildCertificateManifest_DeduplicatesAndSortsCertificates()
-    {
-        byte[] first = [1, 2, 3];
-        byte[] second = [4, 5, 6];
-
-        var export = SyncWindowsCaCertsStep.BuildCertificateManifest([second, first, second]);
-        var lines = export.Manifest.Split('\n', StringSplitOptions.RemoveEmptyEntries);
-
-        Assert.Equal(2, export.CertificateCount);
-        Assert.Equal(2, lines.Length);
-        Assert.Equal(lines.Order(StringComparer.Ordinal), lines);
-        Assert.All(lines, line => Assert.Equal(2, line.Split('\t').Length));
-    }
-
-    [Fact]
-    public async Task SyncWindowsCaCerts_InstallsIndividualCertificatesAsWslRoot()
-    {
-        var export = SyncWindowsCaCertsStep.BuildCertificateManifest([[1, 2, 3]]);
-        var commands = new FakeCommandRunner(_ => Ok());
-        var ctx = CreateContext(commands: commands);
-        ctx.DistroName = "test-distro";
-
-        var result = await new SyncWindowsCaCertsStep(() => export)
-            .ExecuteAsync(ctx, CancellationToken.None);
-
-        Assert.True(result.IsSuccess);
-        var call = Assert.Single(commands.DetailedCalls);
-        Assert.Equal(WslConstants.WslExePath, call.Executable);
-        Assert.Equal(["-d", "test-distro", "-u", "root", "--", "bash", "-c"], call.Arguments[..7]);
-        Assert.Contains("openssl x509", call.Arguments[7], StringComparison.Ordinal);
-        Assert.Contains("backup_parent=/var/lib/openclaw-setup", call.Arguments[7], StringComparison.Ordinal);
-        Assert.Contains("chmod 0755 \"$staging\"", call.Arguments[7], StringComparison.Ordinal);
-        Assert.Contains("chmod 0644 \"$cert_path\"", call.Arguments[7], StringComparison.Ordinal);
-        Assert.Contains("update-ca-certificates --fresh", call.Arguments[7], StringComparison.Ordinal);
-        Assert.Contains("$fingerprint.crt", call.Arguments[7], StringComparison.Ordinal);
-        Assert.DoesNotContain('\r', call.Arguments[7]);
-        Assert.Equal(export.Manifest, call.StdinInput);
-    }
-
-    [Fact]
-    public async Task SyncWindowsCaCerts_FailureIsNonFatal()
-    {
-        var export = SyncWindowsCaCertsStep.BuildCertificateManifest([[1, 2, 3]]);
-        var commands = new FakeCommandRunner(_ => Fail("update failed"));
-        var ctx = CreateContext(commands: commands);
-        ctx.DistroName = "test-distro";
-
-        var result = await new SyncWindowsCaCertsStep(() => export)
-            .ExecuteAsync(ctx, CancellationToken.None);
-
-        Assert.True(result.IsSuccess);
-        Assert.Contains("Skipped", result.Message, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public async Task SyncWindowsCaCerts_EmptyStoreSkipsWslCall()
-    {
-        var commands = new FakeCommandRunner(_ => Ok());
-        var ctx = CreateContext(commands: commands);
-        ctx.DistroName = "test-distro";
-        var empty = new WindowsCaCertificateExport("", 0, []);
-
-        var result = await new SyncWindowsCaCertsStep(() => empty)
-            .ExecuteAsync(ctx, CancellationToken.None);
-
-        Assert.True(result.IsSuccess);
-        Assert.Empty(commands.DetailedCalls);
-    }
-
-    [Fact]
-    public async Task SyncWindowsCaCerts_RollbackRemovesManagedDirectoryAndRebuildsTrust()
-    {
-        var commands = new FakeCommandRunner(_ => Ok());
-        var ctx = CreateContext(commands: commands);
-        ctx.DistroName = "test-distro";
-
-        await new SyncWindowsCaCertsStep(() => new WindowsCaCertificateExport("", 0, []))
-            .RollbackAsync(ctx, CancellationToken.None);
-
-        var call = Assert.Single(commands.DetailedCalls);
-        Assert.Equal(["-d", "test-distro", "-u", "root", "--", "bash", "-c"], call.Arguments[..7]);
-        Assert.Contains("rm -rf -- \"$target\"", call.Arguments[7], StringComparison.Ordinal);
-        Assert.Contains("update-ca-certificates --fresh", call.Arguments[7], StringComparison.Ordinal);
-        Assert.DoesNotContain('\r', call.Arguments[7]);
-    }
-
-    [Fact]
-    public async Task SyncWindowsCaCerts_RollbackFailureIsPropagated()
-    {
-        var commands = new FakeCommandRunner(_ => Fail("remove failed"));
-        var ctx = CreateContext(commands: commands);
-        ctx.DistroName = "test-distro";
-
-        var error = await Assert.ThrowsAsync<InvalidOperationException>(() =>
-            new SyncWindowsCaCertsStep(() => new WindowsCaCertificateExport("", 0, []))
-                .RollbackAsync(ctx, CancellationToken.None));
-
-        Assert.Contains("remove failed", error.Message, StringComparison.Ordinal);
-    }
-
     [Fact]
     public void WindowsNodeContext_CanSkipWhenDisabled()
     {