Reference

Safety model and limits

SpoolSmith runs elevated and changes the Windows print system, so it's deliberately conservative. This page covers the rules it follows, what it supports, and what has actually been proven on real hardware.

The rules SpoolSmith follows#

• Detection is automatic. Changes are not. Nothing is written to the driver store, the print spooler or the trusted-publisher store without showing the exact steps first and getting an explicit yes. On the CLI, the only ways around the prompt are --yes, which you type yourself, and --plan-hash, which accepts only a plan someone has already reviewed. The desktop always asks.
• No guessing. If the printer reports a different identity from the one saved, setup stops. If it just doesn't answer, setup falls back to the saved settings and says so before you confirm.
• Re-running is safe. Matching queues and ports are reused rather than duplicated, conflicts stop the operation, and shared ports and drivers are kept on removal.
• SpoolSmith downloads nothing itself. Drivers come from a printer file, from what's already registered, from a vendor archive you staged yourself, or from Windows' own driver search during IPP setup. Windows does that search, not SpoolSmith.
• No credentials, no remote control. It reads what a printer reports over SNMP, HTTP, PJL and IPP. It never asks for passwords, runs arbitrary commands, or does anything on a schedule.
• Its own binaries are signed. Releases are Authenticode-signed, and the release pipeline refuses to publish anything it couldn't sign. SpoolSmith holds itself to the same standard it holds driver payloads to.

How drivers are trusted#

Hashes detect corruption and casual edits; they aren't a signature. Trust a printer file as much as the PC it came from.

What's supported#

• Windows x64 only, for detection and changes. The core is OS-independent, but macOS and Linux aren't built.
• RAW TCP 9100 by IP, or by hostname (saved as its current IP).
• WSD queues SpoolSmith can verify, converted to RAW TCP/IP or a verified IPP endpoint.
• IPP through Windows automatic setup, on TCP 631. IPPS-only printers aren't supported.
• USB printers, copied to .usb.ssb and mapped once Windows creates the USB queue.
• Not supported: LPR, non-9100 RAW ports, and virtual printers.
• Discovery needs an IPv4 CIDR from /24 to /32. It doesn't cross VLANs or use multicast.
• Intune packaging is local only. Tenant sign-in, upload and assignment aren't planned.

Verified on real hardware#

Most of this was recorded with a Brother HL-L2315D on Windows 11 (build 26200). Separately, multiple HP and Sharp network printers were tested with the v1.1 copy-and-apply workflow (operator report, 2026-09-23).

• Discovery, adding from a saved setup, and a repeated add that changes nothing, with a physical test print.
• Offline add and configure, removal, and protection of shared ports and drivers.
• Copying with the driver (a 115-file, 25.9 MB package), with the file written, re-read and hash-verified.
• Identity matching against the live printer, repeated applies that change nothing, and a reviewed plan fingerprint accepted while a wrong one is refused.
• Driver staging from a printer file, with the driver deregistered and its driver-store package deleted first.
• WSD identity and IPP endpoint verification, plus elevated IPP queue creation, re-apply, status and cleanup.
• The v1.5 native-driver step switching an IPP queue from the class driver to the printer's own (already installed) driver, and a re-apply recognizing it.
• The Intune endpoint lifecycle as SYSTEM: install, detection, protected state, standard-user denials, revision updates and removal.
• The full desktop suite (40 of 40 at 125% scaling), including an accessibility audit of every page.

The dated validation records hold the evidence for each.

Not verified yet#

• Copying between two separate PCs. The "missing driver" destination was simulated on one PC.
• Physical printing through a driver staged from a printer file.
• A live repoint. Only its preview has run against hardware.
• An actual Windows Update driver download during IPP setup. The verified switch used a driver that was already installed.
• Printer sets and default driver export on real printers. These are covered by automated tests only.
• Automatic offline fallback with a real printer powered off mid-copy or mid-apply.
• USB driver staging on a clean PC.
• Other brands, Canon included. They're expected to work through their standard Windows driver, but haven't been tested.
• Delivery through a real Intune tenant and Company Portal.
• Display scales other than 125%, Windows high contrast, and a screen reader.

These are the next validation priorities in the roadmap.

Known issues#

• uninstall --purge-driver can keep a driver that's actually unused. Windows removes queues asynchronously, so the in-use check can still see the queue that was just deleted. Removing the driver afterwards can need a spooler restart. SpoolSmith never restarts the spooler itself, because that would interrupt other printing.
• Operations aren't transactions. If a step fails, earlier steps may already be applied; for example, an unused port can be left behind. Adding the same printer again reuses what exists.
• A broken Windows print provider blocks changes. Inventory errors stop the operation instead of being read as "no printer present".
• Desktop accessible names are internal IDs, not readable labels. Every control is reachable by keyboard, but a screen reader will announce IDs.

Under the hood#

SpoolSmith is written in Go with a pure, OS-independent core:

• internal/probe: live SNMP, HTTP, PJL, port, OUI and hostname fingerprinting, with no third-party dependencies.
• internal/bundle: the .ssb and printer-set formats, and their verification.
• internal/inspect: assembles the reviewable result, with the source of every piece of evidence.
• internal/install: Windows-only driver, port and queue changes behind a narrow interface, so everything else is tested without Windows.

Every change gets an independent adversarial review before it ships. The development log records the defects found and fixed.

Something wrong or unclear? Open an issue or edit this page.