Fossroot

Open-source, single-binary manager for DoD PKI CA certificate trust stores. A modern, cross-platform, auditable replacement for DISA's InstallRoot utility.

⚠️ Unofficial community tool. Fossroot is not affiliated with, endorsed by, or supported by the U.S. Department of War, DISA, or any government agency. "InstallRoot" is DISA's product; Fossroot is an independent open-source reimplementation of the same end-user need.

What it does

Accessing DoW websites (OWA, myPay, MilConnect, …) from a personal computer requires the DoD PKI root and intermediate CA certificates in your machine's trust store. DISA's InstallRoot tool does this, but it is Windows-only, closed source, and frozen at v5.6 (2024). Fossroot runs on Windows, macOS, and Linux, handles the DoD, ECA, JITC, and WCF bundle groups, and:

• Fetches the latest official bundle live from DISA's distribution point (dl.dod.cyber.mil) — Fossroot never ships certificates of its own.
• Cryptographically verifies everything before touching your machine:
  • the bundle's DISA-signed CMS checksum manifest is verified back to DoD root CAs whose SHA-256 fingerprints are pinned in the source code;
  • every certificate in the bundle must chain — with real signature verification (RSA & ECDSA) — to a pinned DoD root, or the bundle is rejected outright.
• Shows you a full diff before any change: what's installed, what's missing, what's expired, and which stale DoD CAs should be pruned.
• Installs without admin by default on Windows and macOS (per-user trust store), or machine-wide with a native administrator prompt.
• Uninstalls completely — it removes exactly the certificates in the DISA bundle, nothing else, and leaves no other trace on your system.

Install

Every download is a single self-contained program: no installer, no service, no telemetry, no config files. Delete it and it's gone.

Platform	Get it
Windows (x86_64, arm64)	fossroot-<version>-windows-<arch>.exe from Releases — double-click for the GUI, or run from a terminal
macOS (Apple Silicon + Intel)	Fossroot-<version>-macos-universal.dmg from Releases — drag to Applications (first-launch note)
Linux — any distro (x86_64, aarch64)	Fossroot-<version>-<arch>.AppImage from Releases, chmod +x, run
Debian / Ubuntu	sudo apt install ./fossroot_<version>_<arch>.deb
Fedora / RHEL	sudo dnf install ./fossroot-<version>-1.<arch>.rpm
Arch	fossroot-git PKGBUILD in packaging/aur/ (makepkg -si)
Nix	nix run github:danielneustadter/fossroot
From source (any)	cargo build --release with stable Rust

Verify downloads against the .sha256 / SHA256SUMS.* files attached to each release. Details and caveats per format: docs/packaging.md.

macOS first launch

The macOS build is signed but not yet notarized with Apple, so Gatekeeper shows an "unidentified developer" warning the first time. Right-click (Control-click) Fossroot.app → Open → Open, once. Or, from a terminal:

xattr -dr com.apple.quarantine /Applications/Fossroot.app

The binary inside the bundle is also the CLI: /Applications/Fossroot.app/Contents/MacOS/fossroot status.

Usage

fossroot                 # GUI
fossroot status          # read-only: verification + coverage report
fossroot status --json   # machine-readable (includes platform store layout)
fossroot install         # install missing certs (per-user on Windows/macOS: no admin)
fossroot install --machine --prune   # machine-wide + remove stale DoD CAs (admin/sudo)
fossroot remove          # uninstall everything the bundle manages
fossroot export --out d: # dump .cer files + PEM chain (for Firefox on Linux, Java, WSL, …)
fossroot ... --offline bundle.zip    # air-gapped: use a hand-carried bundle
fossroot --group eca status          # ECA / JITC / WCF bundle groups
fossroot completions zsh             # shell completions (bash, zsh, fish, powershell, elvish)

The same verification runs whether you use the GUI or the CLI — the diff you see is exactly what will change, and nothing is written until you confirm.

Machine-wide installs

Platform	Per-user store	Machine-wide store
Windows	Current User CryptoAPI — no admin; Windows confirms each new root	Local Machine — GUI: Relaunch as admin (UAC); CLI: elevated shell
macOS	Login keychain — no admin	System keychain — GUI: native password prompt; CLI: sudo fossroot install --machine
Linux	none — Linux has one system-wide store	GUI: polkit password prompt; CLI: sudo fossroot install (--machine implied)

On macOS and Linux the GUI never runs as root: it runs the exact fossroot install --machine command through the OS's own authorization dialog (osascript / pkexec) and refreshes when it finishes.

Browsers and other trust stores

• Chrome, Edge, Safari, and everything that uses the OS store pick up Fossroot's changes immediately.
• Firefox on Windows and macOS reads OS-installed roots by default (security.enterprise_roots.enabled); on Linux, use fossroot export and import dod_ca_chain.pem under Settings → Certificates → Authorities, or point Firefox at the system store via p11-kit.
• Java and other private keystores: fossroot export writes one .cer per CA plus a PEM chain for keytool -importcert.

Why trust it?

You shouldn't trust any third-party root-CA installer blindly — including this one. Fossroot's answer:

1. 100% open source — every line that touches your trust store is in this repo, in memory-safe Rust.
2. Never bundles the certificates it installs — those always come live from DISA. The only certificate material Fossroot ships is the four DoD root CAs, embedded purely as verification anchors and pinned by fingerprint in verify.rs (each checked against its pin at load). DISA signs every group's manifest with a DoD PKE credential, so those four anchors transitively verify the DoD, ECA, JITC, and WCF bundles.
3. Fail-closed verification — if the manifest signature, a checksum, or a single chain fails to verify, nothing is installed.
4. Single portable binary — no installer, no services, no telemetry, no config files. Delete it and it's gone.
5. Every release is built in public CI from a tagged commit, on GitHub's own runners, with checksums attached. Reproduce it yourself with cargo build --release.

Platforms

Platform	Trust store	Verified
Windows 10/11 (x86_64, arm64)	CryptoAPI ROOT/CA, Current User & Local Machine	Real hardware
macOS 11+ (Apple Silicon, Intel)	Security.framework login & System keychains + trust settings	Real hardware (macOS 26, Apple Silicon); login-keychain roundtrip in CI
Linux (x86_64, aarch64)	update-ca-certificates (Debian/Ubuntu) / update-ca-trust (RHEL/Fedora/SUSE)	Full root install/remove against the live DISA bundle in CI (Ubuntu)

All three build, test, clippy, and fmt on every push; the Package workflow builds every artifact and exercises the trust stores on every push too.

Building

cargo build --release          # → target/release/fossroot
cargo test --workspace         # unit + black-box CLI tests, no network

Optional, with a downloaded DISA zip: FOSSROOT_TEST_BUNDLE=path/to/unclass-certificates_pkcs7_DoD.zip cargo test runs the real-bundle verification and tamper-rejection tests. Packaging scripts for each platform live under packaging/.

Roadmap

• Code signing: Windows Authenticode and macOS notarization (removes the first-launch prompts), then winget and a Homebrew cask
• Firefox/Thunderbird NSS profile support on Linux
• Publish the scaffolded packages: AUR, nixpkgs, Snap (classic review), Gentoo GURU

See CHANGELOG.md for what shipped in each release.

License

Dual-licensed under MIT or Apache-2.0, at your option.