fix(build): reg.exe-only offline-hive access fixes Dismount-WindowsImage -Save lock (v1.0.30)#21
Merged
Conversation
…age -Save lock (v1.0.30) v1.0.29 broke Standard ISO creation: Dismount-WindowsImage -Save failed with "The process cannot access the file because it is being used by another process." Root cause: Invoke-RegistryPatternZeroAction read the loaded offline NTUSER hive via the .NET PowerShell registry provider (Test-Path/Get-Item HKLM:\z*), which caches an in-process RegistryKey handle that survives `reg unload` and locks the mount at dismount-save. Latent since v1.0.3; intermittent via GC non-determinism. v1.0.29's -Save retry cannot clear a same-process handle. Fix: offline-hive access is reg.exe-only (Get-Tiny11RegValueNames / Test-Tiny11HiveLoaded / Invoke-Tiny11RegExe); Invoke-RegistryPatternZeroAction rewritten; Clear-Tiny11StaleHives no longer probes via Test-Path. Matches upstream tiny11builder + Microsoft offline-servicing docs. v1.0.29 integrity gate + retry kept as defense-in-depth. local-deps: reg.exe/dism.exe/robocopy.exe in the build process now resolve from %SystemRoot%\System32 by absolute path, not %PATH%. Adds a static drift guard that fails if HK*:\z provider access reappears in src. Validated end-to-end: clean ISO built + Windows 11 installed + post-boot task working. Pester 521/0 (non-elevated; +2 admin-gated Synthetic run in CI).
…e-only offline-hive convention
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the
Dismount-WindowsImage -Savelock that broke Standard ISO creation in v1.0.29 (now retracted), at its real root cause. Validated end-to-end: clean ISO built -> Windows 11 installed -> post-boot cleanup task in place and working.Root cause
Invoke-RegistryPatternZeroActionread the loaded offline NTUSER hive through the .NET PowerShell registry provider (Test-Path/Get-Item HKLM:\z*). The provider caches an in-processRegistryKeyhandle that survivesreg unloadand keeps the hive file (inside the mount) open, soDismount-WindowsImage -Savefails with "The process cannot access the file because it is being used by another process." Latent since v1.0.3; surfaced intermittently via GC non-determinism. v1.0.29's-Saveretry could never clear a handle held by the same long-lived process -- this corrects the prior "transient file-lock" hypothesis.Fix
reg.exe-only -- newTiny11.HiveshelpersGet-Tiny11RegValueNames/Test-Tiny11HiveLoaded/Invoke-Tiny11RegExe;Invoke-RegistryPatternZeroActionrewritten ontoreg query;Clear-Tiny11StaleHivesno longer probes viaTest-Path. Matches upstreamtiny11builder+ Microsoft's offline-servicing docs. No change to a successful build's output image.-Saveretry kept as defense-in-depth.reg.exe/dism.exe/robocopy.exein the build process now resolve from%SystemRoot%\System32by absolute path, not%PATH%(supersedes the 2026-05-30 bare-PATH waiver). DISM*-WindowsImagecmdlets unchanged.Tests
tests/Tiny11.OfflineHive.NoProvider.Drift.Tests.ps1fails if anyHK*:\zprovider access reappears insrc.Context
v1.0.29's GitHub release + Velopack feed assets + signed tag were retracted. v1.0.30 ships the validated fix.