Modernize WslQuery on .NET 10 and address legacy dependency security

[rkttu]

WslQuery targets .NET 5 and depends on an experimental 2020 AOT compiler. This change moves the CLI to .NET 10 and supported Native AOT tooling, removes the legacy Newtonsoft.Json dependency associated with CVE-2024-21907, and retains the 16-field JSON contract.

• Incorporates the original Korean README contribution from README 한글 #5, including its original commit 6cad4a2 in the merge history. Updates both READMEs, release links, and build instructions.
• Integrates master after Bump Newtonsoft.Json from 12.0.3 to 13.0.2 in /src/WslQuery #7 was merged. The final implementation uses source-generated System.Text.Json and removes Newtonsoft.Json, the obsolete ILCompiler package, and the experimental package feed.
• Replaces the small read-only Wslhub.Sdk query surface with owned code and preserves its MIT notice and the Icons8 attribution in published output. Corrects missing registry handling, default-distribution flags, invalid default IDs, false success for unregistered distributions, and unsigned UID handling. Native bindings restrict DLL lookup to System32 and release WSL environment buffers in finally blocks.
• Handles the Copilot COM review by accepting only RPC_E_TOO_LATE when a process COM security policy already exists. Other initialization failures and subsequent WSL errors remain visible. Both Copilot review threads are resolved.
• Adds regression tests, Windows x64 Native AOT publishing and executable smoke checks, CodeQL, and SHA-pinned Actions with Dependabot updates.

Compatibility: the 16 JSON property names were checked against the Wslhub.Sdk 0.1.2 NuGet assembly. Numeric flags and HRESULTs remain. Corrected default/success values and unsigned UID values are intentional changes. JSON escaping can differ. Unknown arguments return 2; query and partial failures return 1 with diagnostics on stderr.

Validation for final head 0bdc6fd:

• Build and test: Windows 17/17 and Linux 15/15 regressions; warning-free Release builds; Windows x64 Native AOT publish; executable help, invalid-argument, and successful JSON-query smoke checks.
• Windows tests reproduce RPC_E_TOO_LATE by calling native CoInitializeSecurity twice. Portable tests cover success, already-initialized COM security, and unrelated failing HRESULTs.
• CodeQL 2.26.4: 52 rules, zero findings, no analysis error. Analysis commit 3eb38c3 matches the current PR merge ref.
• NuGet auditing completes without warnings during CI restore.
• The final source tree exactly matches the previously validated becce6f tree. Integration preserves the original README 한글 #5 and Bump Newtonsoft.Json from 12.0.3 to 13.0.2 in /src/WslQuery #7 commits without reverting modernized code or documentation. The same tree passed a warning-free macOS Release build and 15/15 regressions. Published notices were inspected in the downloaded CI artifact.

Use a merge commit to preserve the original contributor history. PR #5's original fork is unavailable and its direct merge API returned HTTP 409; retaining its original head commit in this PR enables GitHub's indirect-merge handling. PR #7 is already merged.

Live configuration queries against populated WSL 1 and WSL 2 distributions remain unverified; hosted-runner smoke checks do not establish that coverage. This PR changes source and CI without publishing a release. Secret scanning was disabled when inspected and its repository setting was not changed.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🟡 Changes recommended

There are at least two correctness/completeness issues (COM security init robustness and distributed notice completeness) that should be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR modernizes WslQuery into a .NET 10, Native AOT–friendly CLI that queries WSL distribution configuration via owned native/registry code and emits a stable 16-field JSON contract using source-generated System.Text.Json. It also removes legacy/experimental dependencies and adds CI + regression coverage to keep the CLI behavior (exit codes, stderr diagnostics, JSON shape) stable.

Changes:

• Migrates the CLI to net10.0, removes Newtonsoft.Json/Wslhub.Sdk/experimental ILCompiler feed usage, and switches to source-generated System.Text.Json.
• Implements Windows registry + wslapi.dll querying with constrained DLL search paths and safe native buffer cleanup.
• Adds a dependency-free regression test runner, Windows Native AOT publish + smoke tests, and new CI/CodeQL/Dependabot configuration.

File summaries

File	Description
THIRD-PARTY-NOTICES.txt	Adds MIT notice for adapted Wslhub.Sdk-derived model/bindings.
tests/SmokeTest.ps1	Adds published-exe smoke tests for help/args/query behavior in CI.
src/WslQuery/WslQuery.csproj	Moves project to net10.0, enables AOT-friendly settings, and publishes license/notice files.
src/WslQuery/WindowsDistroQuery.cs	New registry + native WSL query implementation and native env-var buffer management.
src/WslQuery/QueryJson.cs	Adds source-generated System.Text.Json serialization (pretty/compact).
src/WslQuery/Program.cs	Replaces legacy entrypoint with argument parsing, exit codes, stderr diagnostics, and platform gating.
src/WslQuery/nuget.config	Removes the per-project experimental feed configuration.
src/WslQuery/NativeMethods.cs	Introduces LibraryImport bindings with System32-only DLL search paths.
src/WslQuery/DistroInfo.cs	Defines the 16-field JSON contract model (computed flags + HRESULT + success).
src/WslQuery.Tests/WslQuery.Tests.csproj	Adds net10.0 regression runner project referencing the CLI code.
src/WslQuery.Tests/Program.cs	Implements regression coverage for JSON contract, CLI behavior, native buffers, and registry fixtures.
src/WslQuery.sln	Adds test project and switches solution configs to Any CPU.
src/publish.cmd	Updates publish script to Native AOT win-x64 output under artifacts/.
src/.vscode/tasks.json	Updates publish/watch tasks for Native AOT publishing and correct watch syntax.
src/.vscode/launch.json	Updates debug target path to net10.0.
README.md	Updates English README for .NET 10/AOT, exit codes, compatibility notes, and CI/testing guidance.
README.ko-kr.md	Adds/updates Korean README with the modernized behavior, tooling, and validation scope.
nuget.config	Adds a root NuGet config restricted to nuget.org.
global.json	Pins/rolls forward to .NET 10 SDK selection policy.
.github/workflows/codeql.yml	Adds CodeQL analysis workflow for C#.
.github/workflows/ci.yml	Adds cross-OS build/test plus Windows Native AOT publish and executable smoke test.
.github/dependabot.yml	Enables weekly GitHub Actions and NuGet update checks.

Review details

• Files reviewed: 22/22 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.