Preserve credential provider logo transparency

scripts/Install-CredentialProvider.ps1

@@ -123,7 +123,18 @@ finally {
 $versionId = $packageHash.Substring(0, 16)
 $installPath = Join-Path $installRoot "versions\$versionId"
 $completeMarker = Join-Path $installPath '.complete'
-if ((Test-Path -LiteralPath $installPath) -and -not (Test-Path -LiteralPath $completeMarker)) {
+$completeMarkerValid = $false
+if (Test-Path -LiteralPath $completeMarker -PathType Leaf) {
+    try {
+        $completeMarkerValid = [IO.File]::ReadAllText($completeMarker).Trim() -eq $packageHash
+    }
+    catch {
+        # Treat an unreadable marker as an incomplete installation. Never reuse
+        # a version directory unless its marker proves that every package byte
+        # represented by packageHash finished installing.
+    }
+}
+if ((Test-Path -LiteralPath $installPath) -and -not $completeMarkerValid) {
     $installPath = '{0}-{1}' -f $installPath, ([Guid]::NewGuid().ToString('N').Substring(0, 8))
     $completeMarker = Join-Path $installPath '.complete'
 }

src/SGU.CredentialProvider/SguCredentialTile.cs

@@ -5,7 +5,11 @@ using SGU.AuthBroker.Core.Identity;
 
 namespace SGU.CredentialProvider;
 
-internal sealed class SguCredentialTile : CredentialTile2
+// LogonUI can only preserve the alpha channel of the provider logo when the
+// credential exposes ICredentialProviderCredential3. CredentialTile2 returns
+// an HBITMAP, which composites transparent pixels against #464646 and produces
+// a visible grey square around the circular SGU mark.
+internal sealed class SguCredentialTile : CredentialTile3
 {
     private TextboxControl userNameControl = null!;
     private SecurePasswordTextboxControl passwordControl = null!;

tests/SGU.CredentialProvider.Tests/ProviderTileIconTests.cs

@@ -52,5 +52,6 @@ public sealed class ProviderTileIconTests
         Assert.Equal("Acceso institucional SGU", heading.Label);
         Assert.Equal(FieldState.DisplayInSelectedTile, heading.State);
         Assert.Equal(GenericTileDisplayMode.DisplayAsDedicatedTile, tile.GenericTileDisplayMode);
+        Assert.IsAssignableFrom<CredentialTile3>(tile);
     }
 }