v2.13.1 Release

[jworkmanjc]

• patch for system context

• changelog patch update

• restore progressForm

• remove extra write-hosts

• regenerate from build

Issues

• CUT-5176 - System Context API Changes for padding

What does this solve?

CUT-5176
Overview
Patch 2.13.1 fixes system context API signing when the JumpCloud agent client.key uses PKCS#1 RSA integers with a leading 0x00 that the PEM/ASN.1 parser was dropping, so D (and related CRT fields) were shorter than the modulus and RSACryptoServiceProvider.ImportParameters failed—leaving a null RSA object and errors on SignHash.

The fix adds PadLeading and normalizes D, P, Q, DP, DQ, and IQ to the expected byte lengths before import in the embedded PowerShell 5 RSA helper in 3_ADMU_Invoke.ps1 and DeviceQuery.ps1, and in Invoke-SystemContextAPI.ps1. Module/UI strings bump to 2.13.1 (JumpCloud.ADMU.psd1, GUI titles, Start-Migration). ModuleChangelog.md documents the issue; minor style-only edits appear in Form.ps1 and ProgressForm.ps1.

Is there anything particularly tricky?

How should this be tested?

See Jira Card

Screenshots

---

Note

Medium Risk
Changes affect JumpCloud system-context request signing and migration-time ACL repair on user registry hives; incorrect behavior could break remote API auth or first-login profiles, but the edits are narrow bugfixes with new acceptance coverage.

Overview
2.13.1 is a patch release that fixes system context API signing and bumps module/GUI version strings to 2.13.1.

System context authentication: The embedded PowerShell 5 RSA PEM decoder now left-pads PKCS#1 private key integers (D, P, Q, CRT fields) via PadLeading before ImportParameters, so client.key files with a leading 0x00 on D no longer import as $null and break SignHash. The same helper is updated in Invoke-SystemContextAPI.ps1, DeviceQuery.ps1, and 3_ADMU_Invoke.ps1. Request signing now builds the HTTP Date header with culture-invariant [DateTime]::UtcNow.ToString('r') instead of re-parsing a -UFormat string (fixes non-English Windows locales).

Migration / profile hives: New Set-DATFilePermission repairs NTFS/registry ACLs on NTUSER.DAT, UsrClass.dat, and loaded hive keys when validation fails—replacing warn-only checks in Start-Migration. $datPath is assigned once from $newUserProfileImagePath after home-path handling so hive checks target the correct profile. Acceptance tests cover permission repair and post-migration DAT ACLs.

Device init: DeviceQuery.ps1 skips description updates when no ADMU users are found; Set-SystemDesc accepts an empty user collection.

Minor GUI/style tweaks in Form.ps1 and ProgressForm.ps1; ModuleChangelog.md documents the release.

^{Reviewed by Cursor Bugbot for commit c3ac213. Bugbot is set up for automated code reviews on this repo. Configure here.}