[4.0.0-beta desktop] Sign, DMG, and MSI scripts are unused or invalid #255

PROBLEM

BUILD_INFRASTRUCTURE.md documents a full pipeline:

1. sign_and_notarize_macos.sh
2. build_dmg.sh (Applications symlink, layout)
3. sign_windows.ps1
4. build_msi.ps1 (WiX)

CI calls none of them. The Mac job uses a bare hdiutil create of a folder that only contains the .app (no Applications shortcut). Windows zips the exe.

When someone does run the scripts locally:

• sign_and_notarize_macos.sh looks for Contents/MacOS/libcblite.3.dylib. PyInstaller puts dylibs under Contents/Frameworks/ or Contents/Resources/. The script warns and skips, then may sign an incomplete bundle.
• build_msi.ps1 emits invalid WiX:
  • Guid="$(var.WixUIWIChangedGuid)" is not a defined preprocessor variable
  • Icon="AppIcon.ico" with no <Icon Id="AppIcon.ico" SourceFile="..."/>
  • Shortcut Icon on a File component is malformed

Suggested RCA

Scripts were sketched from the design docs and never wired into the workflow or smoke-tested. The WiX template mixed copy-pasted $(var.…) placeholders. Sign script assumed a flat MacOS/ layout instead of PyInstaller's BUNDLE layout.

Suggested FIX

DMG (CI, now):

mkdir -p dist/dmg
cp -R dist/QueryAnalyzer.app dist/dmg/
ln -s /Applications dist/dmg/Applications
hdiutil create -volname "QueryAnalyzer-Beta" -srcfolder dist/dmg -ov -format UDZO dist/QueryAnalyzer-4.0.0-beta-macos.dmg

Sign script: search for the dylib instead of hardcoding MacOS/:

DYLIB_PATH="$(find "$APP_BUNDLE/Contents" -name 'libcblite*.dylib' | head -1)"

MSI: replace $(var.WixUIWIChangedGuid) with a real GUID (or Guid="*"), add:

<Icon Id="AppIcon.ico" SourceFile="assets\img\app_icon.ico" />
<Property Id="ARPPRODUCTICON" Value="AppIcon.ico" />

Do not mention Setup.exe in README until build_msi.ps1 is actually invoked.

Unit tests

# tests/python/test_packaging_scripts.py
from pathlib import Path
import re

def test_sign_script_finds_dylib_anywhere_in_bundle():
    src = Path("app/scripts/sign_and_notarize_macos.sh").read_text()
    assert "find " in src and "libcblite" in src
    assert 'Contents/MacOS/libcblite.3.dylib' not in src  # the broken hardcode

def test_msi_script_has_no_placeholder_guid():
    src = Path("app/scripts/build_msi.ps1").read_text()
    assert "WixUIWIChangedGuid" not in src
    assert "AppIcon.ico" in src
    assert "Icon Id=" in src or "<Icon" in src

def test_beta_workflow_creates_applications_symlink_in_dmg():
    wf = Path(".github/workflows/release-4.0.0-beta.yml").read_text()
    assert "ln -s /Applications" in wf or "build_dmg.sh" in wf

Context: found on branch release-4.0.0-beta while reviewing standalone macOS .app / Windows .exe packaging. Issues in this batch share the title prefix [4.0.0-beta desktop].