[Marc-André Moreau (mamoreau-devolutions)]

Summary

Follow-up to #59. The WinGet source publishers no longer need the Windows SDK (makeappx.exe, signtool.exe) or, in Rust, PowerShell.

• Packaging: both publishers write source2.msix in-process, in the exact AppxPackaging (makeappx) ZIP layout:

  • stored entries;
  • central directory entries with version-made-by 45 and zero external attributes;
  • ZIP64 end records;
  • an SHA-256 block map with a hash per 64 KiB block;
  • content types.

  Windows AppxSip rejects signatures over any other layout with TRUST_E_BAD_DIGEST. The Rust (msix.rs) and .NET (MsixPackageWriter.cs) writers are byte-identical for the same payload, and a .NET test pins hashes produced by the Rust writer.

• Signing: done with the cross-platform psign-tool (Devolutions.Psign.Tool, 0.8.2 or later; 0.8.1's portable MSIX signatures fail Windows verification, fixed in Fix Windows TRUST_E_BAD_DIGEST on portable-signed MSIX/AppX; sign plain-ZIP packages psign#46).

  • All arguments, including the PFX password, go through a private, short-lived response file, so the password never appears on a command line. That matters on Linux, where /proc/*/cmdline is readable by other users, and for the .cmd launcher dotnet tool install creates on Windows.

• Verification, after signing and in verify --destination:

  • the package digests;
  • the signer subject matches --publisher, formatted the way Windows formats certificate subjects;
  • the signer has the Code Signing EKU and is currently valid;
  • chain trust: the Windows store on Windows (as signtool verify /pa did), or new repeatable --trusted-ca anchors.

• CLI: --makeappx/--signtool become --psign-tool; doctor JSON reports psignToolPath.

• Portability: publish and verify now run off Windows, using the existing portable MSZIP decoders. build still compresses with the Windows Compression API.

• CI, scripts and docs:

  • CI installs psign-tool 0.8.2.
  • The gate scripts take -PsignToolPath.
  • The interoperability check no longer needs makeappx.
  • Docs are updated.

Validation (local, Windows 11, SDK 10.0.26100)

• Rust: publisher tests pass (19 unit + 26 conformance), as do the CLI tests; clippy and fmt are clean.
• .NET: the solution builds; 80/80 publisher tests pass.
• Interop: tests/publisher/run-production-conformance.ps1 passes: Rust and .NET reopen each other's state and verify each other's unsigned feeds.
• Signed end to end with released psign-tool 0.8.2, both CLIs, via the plain exe and the dotnet-tool .cmd launcher, with a password containing quotes, @ and %PATH%:
  • signtool verify /pa and Get-AuthenticodeSignature report only the untrusted throwaway root, never a bad digest;
  • --trusted-ca publish and verify succeed;
  • a mismatched --publisher is rejected;
  • makeappx unpack accepts both signed and unsigned output.
• Not yet run: the signed stock-WinGet acceptance job, which runs in CI on this PR. Note that NuGet had not yet listed the 0.8.2 platform packages (Devolutions.Psign.Tool.win-x64, …) shortly after the release. If they're still missing, the job's install step will fail until NuGet finishes indexing.

Notes

• The full Rust and .NET source2.msix still differ, because their manifest text and generated logos differ (unchanged from before). Only the container layout is identical.
• tests/publisher/build_v2_fixture.ps1 still uses makeappx on purpose. It's a manual, independent reference-fixture builder, and nothing calls it.

🤖 Generated with Claude Code