fix: чтение SSLCertificateSHA1Hash через Registry API + версия 1.0.3

Усилена нормализация byte[]/Object[] из реестра; в логе версия модуля
для проверки git pull; RestoreTls нормализует thumbprint.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/lib/RdpRepair.Common.ps1

@@ -4,6 +4,7 @@ Set-StrictMode -Version Latest
 $script:RdpRepairDataRoot = Join-Path $env:ProgramData 'RdpRepair'
 $script:RdpRepairRdpTcpKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
 $script:RdpRepairTsKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
+$script:RdpRepairModuleVersion = '1.0.3'
 
 function Initialize-RdpRepairDataRoot {
     if (-not (Test-Path -LiteralPath $script:RdpRepairDataRoot)) {
@@ -56,25 +57,26 @@ function Get-RdpRepairComputerDnsNames {
     return $names | Select-Object -Unique
 }
 
+function Convert-RdpRepairBytesToHex {
+    param([byte[]]$Bytes)
+    if ($null -eq $Bytes -or $Bytes.Length -eq 0) { return $null }
+    return -join ($Bytes | ForEach-Object { '{0:X2}' -f $_ })
+}
+
 function ConvertTo-RdpRepairThumbprintHex {
     param([object]$HashValue)
     if ($null -eq $HashValue) { return $null }
 
     if ($HashValue -is [byte[]]) {
-        if ($HashValue.Length -eq 0) { return $null }
-        return -join ($HashValue | ForEach-Object { '{0:X2}' -f $_ })
+        return Convert-RdpRepairBytesToHex -Bytes $HashValue
     }
 
-    if ($HashValue -is [System.Array] -and $HashValue.Count -gt 0) {
-        $allNumeric = $true
-        foreach ($b in $HashValue) {
-            if ($b -isnot [byte] -and $b -isnot [int] -and $b -isnot [short]) {
-                $allNumeric = $false
-                break
-            }
-        }
-        if ($allNumeric -and ($HashValue.Count -eq 20 -or $HashValue.Count -eq 16)) {
-            return -join ($HashValue | ForEach-Object { '{0:X2}' -f [byte]$_ })
+    if ($HashValue -is [System.Array] -and $HashValue.Length -gt 0) {
+        if ($HashValue.Length -ge 16 -and $HashValue.Length -le 32) {
+            try {
+                $bytes = @($HashValue | ForEach-Object { [byte]$_ })
+                return Convert-RdpRepairBytesToHex -Bytes $bytes
+            } catch { }
         }
     }
 
@@ -83,19 +85,34 @@ function ConvertTo-RdpRepairThumbprintHex {
     $text = $text.Trim()
 
     if ($text -match '^\d+( \d+)+$') {
-        $bytes = $text -split '\s+' | ForEach-Object { [byte]$_ }
-        return -join ($bytes | ForEach-Object { '{0:X2}' -f $_ })
+        $bytes = @($text -split '\s+' | ForEach-Object { [byte]$_ })
+        return Convert-RdpRepairBytesToHex -Bytes $bytes
     }
 
     $hex = ($text -replace '\s', '').ToUpper()
-    if ($hex -match '^[0-9A-F]+$') { return $hex }
+    if ($hex -match '^[0-9A-F]{32,40}$') { return $hex }
     return $null
 }
 
-function Get-RdpRepairSslCertificateHash {
-    $p = Get-ItemProperty -Path $script:RdpRepairRdpTcpKey -Name SSLCertificateSHA1Hash -ErrorAction SilentlyContinue
+function Get-RdpRepairSslCertificateHashRaw {
+    $regSubKey = 'SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
+    try {
+        $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($regSubKey, $false)
+        if ($key) {
+            try {
+                return $key.GetValue('SSLCertificateSHA1Hash', $null)
+            } finally {
+                $key.Close()
+            }
+        }
+    } catch { }
+    $p = Get-ItemProperty -LiteralPath $script:RdpRepairRdpTcpKey -Name SSLCertificateSHA1Hash -ErrorAction SilentlyContinue
     if ($null -eq $p -or -not $p.PSObject.Properties['SSLCertificateSHA1Hash']) { return $null }
-    return ConvertTo-RdpRepairThumbprintHex -HashValue $p.SSLCertificateSHA1Hash
+    return $p.SSLCertificateSHA1Hash
+}
+
+function Get-RdpRepairSslCertificateHash {
+    return ConvertTo-RdpRepairThumbprintHex -HashValue (Get-RdpRepairSslCertificateHashRaw)
 }
 
 function Get-RdpRepairSecurityLayer {
@@ -245,7 +262,10 @@ function Test-RdpRepairCertificateBindingPersisted {
     $after = Get-RdpRepairSslCertificateHash
     Write-RdpRepairLog "Hash AFTER TermService start:  $(if ($after) { $after } else { '(empty)' })" 'INFO' $LogPath
     $expected = ConvertTo-RdpRepairThumbprintHex -HashValue $ExpectedThumbprint
-    $ok = ($after -eq $expected)
+    $ok = ($null -ne $after) -and ($null -ne $expected) -and ($after -eq $expected)
+    if (-not $ok) {
+        Write-RdpRepairLog "Hash compare: expected=$expected after=$after before=$before" 'INFO' $LogPath
+    }
     if ($ok) {
         Write-RdpRepairLog 'Привязка cert принята TermService' 'OK' $LogPath
     } else {