Editing Openai/69420ff4-d7c4-8000-a448-17006bf16a9e (section)

==== Why it fails (even with perfect metadata) ====

===== 1. CBS does not trust CAB files =====

DISM does not trust the CAB itself.

CBS verifies against:
* Catalog (.cat) files
* Component identity
* Servicing stack policy
* OS applicability rules

Even if:
* You change the CAB version
* You change the manifest
* You re-sign the CAB

CBS never installs directly from the CAB.

It installs only from trusted catalog entries that already exist in the OS trust graph.

===== 2. You cannot generate a valid Microsoft catalog =====

To install, the package must be backed by:
* A Microsoft-signed catalog
* A certificate chained to Microsoft Windows Production PCA
* A catalog hash that matches every file byte-for-byte

You cannot recreate this, because:
* Microsoft’s private keys are not available
* Test-signing is not allowed for CBS packages
* Self-signed catalogs are explicitly rejected

Even kernel drivers allow test-signing — CBS does not.

===== 3. Applicability rules are hard-coded =====

IE packages contain applicability rules like:
* Minimum OS version
* Allowed SKUs
* Feature allowlist
* Feature blocklist

Windows 11 has a hard block for:

<syntaxhighlight>Browser.InternetExplorer

</syntaxhighlight>

This block lives in:
* Servicing Stack policy
* Feature manifest logic
* Internal disallowed-capability lists

Even a valid Microsoft-signed IE package would still be rejected on Windows 11.

===== 4. WinSxS hash chain will break =====

Windows component servicing is hash-addressed.

If you modify:
* Any file
* Any manifest
* Any metadata

Then:
* The WinSxS hash no longer matches
* The catalog hash no longer matches
* CBS aborts the transaction

This is why your log shows:

<syntaxhighlight>(null)
CBS HRESULT=0x8000ffff

</syntaxhighlight>

CBS never even gets to file staging — it aborts earlier.

===== 5. Secure Boot & Code Integrity stop you before reboot =====

Even if you somehow:
* Forced files into WinSxS
* Bypassed DISM
* Bypassed CBS

Windows would:
* Fail Code Integrity checks
* Fail Secure Boot verification
* Refuse to load IE binaries

At best: IE won’t start
At worst: Windows won’t boot