about function loadSystemRoots

[lysShub]

1. if !strings.Contains(string(out), "command completed successfully") { not work on other language system；maybe if cmd.ProcessState.ExitCode() != 0 {

[lysShub]

2. certutil -syncWithWU cost too many time, recommend use certutil -verify directly

[ayoubfaouzi]

@lysShub thanks for your feedback.

I agree we should check exit code regarding point number 1.
For point 2: do you know if verify does grab the lastest certs ?

[lysShub]

@lysShub thanks for your feedback.

I agree we should check exit code regarding point number 1. For point 2: do you know if verify does grab the lastest certs ?

my test result is, when a required cert missing：
    if exec 'certutil verify xxx.crt' with administrator access, the system will automatically download the missing cert
    otherwise, will verify fail

[lysShub]

not need to manually create CertPool, if VerifyOptions.Roots is nil and golang will call system API to verify: https://github.com/golang/go/blob/go1.22.0/src/crypto/x509/verify.go#L770

@LordNoteworthy

[ayoubfaouzi]

Thanks a lot @lysShub, I should be able to fix this by the end of the week

[ayoubfaouzi]

Hey @lysShub

-verify requires us to first download the certs, so do we have to first run the sync then in subsequent commands do the verification ?

Can you post a quick benchmark how this is faster ?

My tests shows that when sync runs the first time, its slow, then subsequent executions are fast.

[lysShub]

@LordNoteworthy I mean is that no need the certPool, but directly：

	// Let's load the system root certs.
	if !pe.opts.DisableCertValidation {
		certValid = pkcs.Verify() == nil
	}

[ayoubfaouzi]

I see, does this work prior to go v1.22 ?

[lysShub]

yes, it depend on Verify，not need to distinguish Windows or Linux

[ayoubfaouzi]

Verify is just a wrapper over VerityWithChain. It does not seem to do that?

[ayoubfaouzi]

ah here: https://github.com/golang/go/blob/go1.22.0/src/crypto/x509/verify.go#L770, let me check that

[lysShub]

to be continue, finally call windows system function, such as syscall.CertGetCertificateChain

[ayoubfaouzi]

	// Let's load the system root certs.
	if !pe.opts.DisableCertValidation {
		certValid = pkcs.Verify() == nil
	}

The unit tests fails when I changed it as above. Can you please submit a PR ?