Desktop utility for monitoring the integrity and chain of custody of SDK in Windows (check hashes, Authenticode, SBOM)

Initial situation
The Windows development team uses an internal set of SDKs and CLI utilities, which are distributed as ZIP/MSI and are updated frequently. Currently, integrity checks are done manually using Wiki notes, which is why unsigned or modified binaries, as well as “lost” versions without transparent content, periodically end up in the build.

Technical environment and subject area
- Windows 10/11 x64
- .NET 8 Desktop (WPF or WinUI 3) or C++/Qt - to choose from, but the result must be a ready-made desktop program with an installer
- Repositories/artifacts: local folder, network sharing (UNC), as well as downloaded ZIP/MSI
- Validations: SHA-256/SHA-512, Authenticode (WinVerifyTrust), basic certificate chain validation, SBOM collection (CycloneDX or SPDX) based on package contents

What needs to be done (several steps)
1) Analysis of delivery format and rules
- The input includes 10-15 standard packages (ZIP/MSI) and an example of current rules in the form of a table (expected files, masks, versions, signature requirements)
- It is necessary to clarify and fix the rules scheme in the application config: valid names/masks, required files, valid certificate issuers, minimum versions, exceptions

2) Development of a desktop application
- The application selects the source (folder/UNC/ZIP/MSI file), unpacks it into a temporary area, builds a file tree and performs checks
- Generates a report in two types: human-readable (PDF or HTML file) and machine-readable (JSON)
- Supports rule profiles (for example Dev/CI/Release) with switching
- Has a “compare two packages” mode - shows the difference in files, hashes, signatures and versions

3) Implementation of checks
- Hashing of each file and comparison with the standard, if one is specified
- Authenticode check for PE files: signature status, issuer, certificate validity period at the time of signing, timestamp if any
- For unsigned files or with a signature error - a separate list with the reason
- Version checking for EXE/DLL via FileVersionInfo and comparison with rules
- SBOM: generate a list of files with metadata (path, size, hash, version where applicable), pack into CycloneDX/SPDX JSON; a simplified version is allowed without dependency analysis, but with the correct schema and component identifiers at the file/package level

4) Packing and delivery
- Build a ready-made installer (MSIX or MSI/WiX, or Squirrel - your choice) and a portable version
- Diagnostic logs (log file) and clear error messages
- Short instructions (README in Russian) on how to add/change rules and how to run the check

Restrictions
- Everything should work offline, without external cloud services
- You cannot require the user to install heavy dependencies (except for the standard .NET Desktop Runtime, if .NET is selected)
- On a package size of up to 3 GB and 50,000 files, the check should take 7 minutes on an i7/16GB/SSD PC, progress should be displayed
- Temporary files should be cleared automatically even if there are errors

Measurable acceptance criteria
- On the provided test packages, the application produces the same results upon repeated runs, the JSON report is valid and matches the agreed upon schema
- For 5 pre-prepared cases (signed file, unsigned, signature with an expired certificate without a timestamp, signature with a timestamp, file with the wrong version), the application correctly classifies the status and reflects the reason in the report
- The mode for comparing two packages shows the minimum: added/deleted/changed files, hash changes, signature status changes, version changes
- The installer installs and removes the application without garbage, the portable version runs without installation

What will be provided
- A set of test ZIP/MSI (via link/archive), current table of rules, list of trusted publishers, examples of expected reports (in any form)

Expected result
A ready-made desktop program for Windows, source code, rule configs, installer and portable assembly, plus a minimum set of auto-tests for the check logic (at least unit tests for parsing rules and classifying signature statuses).