# asheroto/updaterootcertificates architecture

> Architecture diagram of the GitHub repository asheroto/updaterootcertificates, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/asheroto/updaterootcertificates
- Repository: https://github.com/asheroto/updaterootcertificates
- Video tour (about a minute): https://gitdiagram.com/asheroto/updaterootcertificates/video

## Overview

UpdateRootCertificates is a Windows root-certificate trust-store updater. Its main workflow obtains Microsoft's trusted-root list, extracts and parses it, retrieves the listed certificates, and writes them to the Windows registry; an offline mode separates downloading from applying certificates. The graph follows the documented capabilities and sampled entry-point and processing code; unsampled CLI dispatch details are not expanded.

Main entry points: [`UpdateRootCertificates.py`](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py) (Trusted-root processing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_orchestration["Application flow"]
  node_cli["CLI and modes"]
  node_main["Online entry point"]
  node_offline["Offline apply"]
end

subgraph group_processing["Trust-list processing"]
  node_authroot["Trusted-root processing"]
  node_cab["CAB extraction"]
  node_ctl["CTL parsing"]
  node_certfetch["Certificate retrieval"]
  node_certsave["Offline certificate saving"]
end

subgraph group_integrations["System integrations"]
  node_localfiles["Local certificate files"]
  node_registry[("Windows root store")]
  node_log["Update log"]
end

node_operator(("Operator"))
node_microsoft["Microsoft certificate CDN"]
node_expand["Windows expand.exe"]

node_operator -->|"selects mode"| node_cli
node_cli -->|"starts online run"| node_main
node_cli -->|"selects source"| node_offline
node_main -->|"calls"| node_authroot
node_authroot -->|"downloads trust list"| node_microsoft
node_authroot -->|"extracts CAB"| node_cab
node_cab -->|"invokes"| node_expand
node_authroot -->|"parses CTL"| node_ctl
node_ctl -->|"returns thumbprints"| node_authroot
node_authroot -->|"fetches certificates"| node_microsoft
node_authroot -->|"writes certificates"| node_registry
node_authroot -->|"saves downloaded files"| node_certsave
node_certsave -->|"writes files"| node_localfiles
node_offline -->|"reads source files"| node_localfiles
node_offline -->|"extracts local CAB"| node_cab
node_offline -->|"parses trust list"| node_ctl
node_offline -->|"writes certificates"| node_registry
node_main -->|"writes log"| node_log

click node_cli "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_main "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_offline "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_authroot "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_cab "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_ctl "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_certfetch "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_certsave "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"
click node_log "https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_main,node_offline toneBlue
class node_authroot,node_cab,node_ctl,node_certfetch,node_certsave toneAmber
class node_localfiles,node_registry,node_log toneMint
class node_operator,node_microsoft,node_expand toneIndigo
```

## Components

### Application flow

- [CLI and modes](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`
- [Online entry point](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`
- [Offline apply](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`

### Trust-list processing

- [Trusted-root processing](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`
- [CAB extraction](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`
- [CTL parsing](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`
- [Certificate retrieval](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`
- [Offline certificate saving](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`

### System integrations

- **Local certificate files**
- **Windows root store**
- [Update log](https://github.com/asheroto/updaterootcertificates/blob/master/UpdateRootCertificates.py): `UpdateRootCertificates.py`

### Other components

- **Operator**
- **Microsoft certificate CDN**
- **Windows expand.exe**

## Connections

- Operator → CLI and modes: selects mode
- CLI and modes → Online entry point: starts online run
- CLI and modes → Offline apply: selects source
- Online entry point → Trusted-root processing: calls
- Trusted-root processing → Microsoft certificate CDN: downloads trust list
- Trusted-root processing → CAB extraction: extracts CAB
- CAB extraction → Windows expand.exe: invokes
- Trusted-root processing → CTL parsing: parses CTL
- CTL parsing → Trusted-root processing: returns thumbprints
- Trusted-root processing → Microsoft certificate CDN: fetches certificates
- Trusted-root processing → Windows root store: writes certificates
- Trusted-root processing → Offline certificate saving: saves downloaded files
- Offline certificate saving → Local certificate files: writes files
- Offline apply → Local certificate files: reads source files
- Offline apply → CAB extraction: extracts local CAB
- Offline apply → CTL parsing: parses trust list
- Offline apply → Windows root store: writes certificates
- Online entry point → Update log: writes log