windows: a Microsoft Store package — the unsigned msix the Store re-signs (GDK-1380) - #90
Merged
Conversation
…igns (GDK-1380) Registration is free now and the Store re-signs every MSIX it certifies with a Microsoft certificate, which is the one route past Smart App Control that costs nothing (GDK-211 closed on "no free certificate we qualify for"; this is that certificate, from a direction the page did not list). So `desktop/build-windows.ps1 --msix` stages the same portable directory with desktop/msix/AppxManifest.xml and the committed logo set, and runs makeappx — one compile, a second output, no second build on CI's critical path. The manifest carries the identity Partner Center issued (midagedev.Gadak, the CN publisher, DisplayName Gadak), a full-trust entry point, and the gadak:// protocol. Its version is (major+1).minor.patch.0 because the Store refuses a 0.x major; that mapping is a one-way door once a package is accepted, and the script says so. ~/.gadak is under %USERPROFILE%, which MSIX does not virtualize, so the Store app and the CLI zip share a mirror; WebView2's data path is %APPDATA%, not exe-relative. CI signs the x64 msix with a throwaway self-signed certificate under the same CN, installs it, checks the identity, and removes it — the only check that proves more than schema. It runs last in the job so the HKCU assertion keeps measuring the pack script alone. The release workflow uploads the msix as an artifact only: unsigned, it is not installable, and it is for Partner Center, not for a Release. Logos come from docs/media/logo.png via tools/brand/msix-assets.sh, are committed like the phone set, and tools/check-brand-icons.sh now checks their stamp. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…s a copy The Store submission needs the file, and the tag-only release job is the wrong place to wait for it on a first upload. The install check now signs a RUNNER_TEMP copy so what the artifact carries is the untouched package. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The PR checkout is shallow and tagless, so git describe yields a bare hash and the Store-version mapping had nothing to parse. The install check still needs a package; the release job checks out with tags. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…es it The runner signs and trusts the certificate fine; the speculative AllowAllTrustedApps write is what failed (unauthorized on the Policies key). If Add-AppxPackage itself reports 0x80073CFF that is the moment to find the right switch, not before. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Microsoft Store developer registration is free now and the Store re-signs every MSIX it certifies with a Microsoft certificate. That is the free signing route GDK-211 closed for lack of; this PR packs the Windows app for it.
What changes
desktop/build-windows.ps1 --msixstages the same portable directory withdesktop/msix/AppxManifest.xmland the committeddesktop/msix/Assets/logos and runsmakeappx pack. One compile, a second output — the Windows job is CI's critical path (GDK-1036) and does not get a second build.midagedev.Gadak,CN=975F7A25-…,PublisherDisplayName midagedev,DisplayName Gadak),Windows.FullTrustApplication+runFullTrust, thegadak://protocol,Windows.Desktop ≥ 10.0.17763.0, en-US and ko-KR.Desktop Windows build) signs the x64 msix with a throwaway self-signed certificate under the same CN, installs it, checksGet-AppxPackageidentity and the exe path, and removes it. It runs last so the existing HKCUClasses\gadakassertion keeps measuring the pack script alone.desktop-release.ymlpacks--msixfor x64 and arm64 and uploads them as thegadak-desktop-msixartifact. Never a Release asset: unsigned, the file is not installable (-AllowUnsignedneeds the OID publisher form this manifest deliberately lacks); it exists for Partner Center.tools/brand/msix-assets.sh(hooked intomake brand), stamped and checked bytools/check-brand-icons.sh.desktop/README.md,docs/WINDOWS-SIGNING.mdstatus paragraph, CHANGELOG Unreleased (en + ko).Decisions worth reading
(major+1).minor.patch.0: 0.20.0 → 1.20.0.0, a future 1.0.0 → 2.0.0.0. Once Partner Center accepts a package, no later upload may carry a lower version, so this cannot be "fixed" back to the semver major.main.appVersionstays the semver.~/.gadakis under%USERPROFILE%, which MSIX does not virtualize, so the Store app and the CLI zip share one mirror. WebView2's user data path is wails' default%APPDATA%\gadak-desktop.exe(not exe-relative, which would break under read-onlyWindowsApps). The first-launch HKCU protocol write lands in the package's private hive; the manifest declaration is what Windows reads.AppExecutionAlias(CLI on PATH via the Store) is deliberately left for a follow-up after a first package passes.What CI proves and what it does not
CI proves the package installs under its declared identity with a self-signed stand-in. It does not prove Smart App Control passage — only a Store-signed package installed on an SAC-enforcing machine can show that. This PR is a PR because
desktop/and.github/workflows/are the jobs local gates cannot run; the msix step in particular has never executed outside CI.If
Add-AppxPackagefails on the runner, read the HRESULT first:0x80073CFFis sideloading policy (the step pre-setsAllowAllTrustedApps), a trust error means the TrustedPeople import did not take. Neither is a manifest problem.Local gates:
tools/doc-checks.sh,scripts/scan-internal.sh,tools/check-brand-icons.shall green. No Go code changed.🤖 Generated with Claude Code