From edbff1768054afa80efda721cd1011b29c7fe355 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 11 Sep 2026 17:47:42 +0200 Subject: feat(packaging): an MSIX target for Microsoft Store submission Store certification of the NSIS "MSI/EXE" submission failed on three checks (silent-install verification, Add/Remove Programs entry, bundleware check) -- traced and reproduced live to one cause: SmartScreen blocks an unsigned, internet-downloaded installer at the shell layer before Microsoft's own unattended validation bot ever gets to run it. MSIX sidesteps this class of failure entirely: submitted through the Store's native pipeline, there is no browser-download-then-launch step for SmartScreen to intercept, and Microsoft signs the package itself at publish time -- free, and specific to this submission type (Trusted Signing remains a paid service for the MSI/EXE path). Full plan and findings: C:\Users\admin\devel\msix-installer.md (out of repo). electron-builder.msix.yml carries the same bundle as Full (node runtime, ffmpeg, both service scripts) -- an AppX/MSIX install never elevates, by design, but that changes only *when* the two elevated operations can run, not whether the daemon ships. No main.js changes were needed: the on-demand elevation path for service-mode (winElevateServiceMode(), driven from the Node page) already existed for a different reason and depends only on service-mode.ps1 being present as an extraResource, true for any packaged Windows target. identityName/publisher/publisherDisplayName are the real values from Partner Center's app-identity reservation, not placeholders. build-win-msix.ps1 points electron-builder at the system Windows 10 SDK (auto-detected) instead of letting it download its own bundled copy -- that download's 7z extraction creates symlinks this target never uses and fails without SeCreateSymbolicLinkPrivilege, reproduced on this machine. build/appx/ carries the four tile images the AppX target requires regardless of showNameOnTiles, generated once from the existing app icon (see that directory's README) since the system-SDK redirect has no vendor samples to fall back to. build/appx-extensions.xml declares windows.startupTask by hand rather than via electron-builder's addAutoLaunchExtension, which always targets the Electron shell -- this points at the bundled node binary instead, matching what "starts at sign in" already means for Full. Verified live via a signed sideload install (self-signed test cert, cleaned up after): the package installs and the app runs correctly. One finding worth carrying forward -- the declared network capabilities (internetClientServer, privateNetworkClientServer) do not create any firewall exemption for this app, most likely because automatic capability-based exemption is an AppContainer-sandbox property and this app deliberately runs full-trust, outside any sandbox. Not a regression: no install-time elevation was possible either way, so the cost is the same one-time OS firewall prompt firewall.ps1's own header already documents as its fallback today. Co-Authored-By: Claude Sonnet 5 --- packaging/win/build-win-msix.ps1 | 134 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 packaging/win/build-win-msix.ps1 (limited to 'packaging/win/build-win-msix.ps1') diff --git a/packaging/win/build-win-msix.ps1 b/packaging/win/build-win-msix.ps1 new file mode 100644 index 0000000..9f7f667 --- /dev/null +++ b/packaging/win/build-win-msix.ps1 @@ -0,0 +1,134 @@ +<# +.SYNOPSIS + Build the Windows "MSIX" package: same feature set as Full (bundled node + + ffmpeg), packaged for Microsoft Store submission instead of NSIS. + +.DESCRIPTION + See C:\Users\admin\devel\msix-installer.md for the plan this implements. + Unlike Light, this target does NOT drop anything from Full's feature + set -- it exists because Store certification of the NSIS "MSI/EXE" + submission failed for a reason MSIX sidesteps entirely (an unsigned, + internet-downloaded installer never gets a chance to run under + Microsoft's own unattended validation bot; see msix-installer.md ยง2), + not because the bundled node/service-mode/autostart machinery needed + removing. The one real change is *when* the two elevated operations + (firewall rule, service-mode install) can happen: an AppX/MSIX install + never elevates, so neither can run at install time the way + build/installer.nsh's customInstall macro does. Both already have an + elevation path that does not depend on the installer at all -- + firewall.ps1's own per-first-use Windows prompt, and main.js's + winElevateServiceMode() ("the other door", already used by the Node + page today) -- so nothing in src/main.js needed to change for this + target to work. + + Steps 1-5 are identical to build-win.ps1 (build-win-common.ps1 for 1-4, + build-node-runtime.ps1 for 5 -- this target ships the same frozen daemon + Full does). Step 6 hands electron-builder a standalone config + (electron-builder.msix.yml) via --config, same reasoning as Light: the + two targets' extraResources and signing configuration must never merge. + + Output: packages/meshbay-client/dist-msix/MeshBay-.appx + +.PARAMETER SkipFfmpeg + Passed through to build-node-runtime.ps1 -- skip bundling ffmpeg. Smaller, + streaming-less build for local iteration only. + +.PARAMETER NoElectronBump + Keep the pinned Electron instead of upgrading to the latest release. + +.PARAMETER SkipNodeRuntime + Reuse an existing packages/meshbay-client/node-runtime/ (faster iteration + on the electron-builder side). +#> +[CmdletBinding()] +param( + [switch]$SkipFfmpeg, + [switch]$NoElectronBump, + [switch]$SkipNodeRuntime +) + +$ErrorActionPreference = "Stop" +Set-StrictMode -Version Latest + +$WinDir = $PSScriptRoot +$Repo = (Resolve-Path (Join-Path $WinDir "..\..")).Path +$Client = Join-Path $Repo "packages\meshbay-client" +$Config = Join-Path $WinDir "electron-builder.msix.yml" + +. (Join-Path $WinDir "build-win-common.ps1") + +if (-not (Test-Path $Config)) { throw "missing $Config" } + +# electron-builder's AppX target downloads its own bundled Windows Kits tools +# (winCodeSign-*.7z) unless ELECTRON_BUILDER_WINDOWS_KITS_PATH already points +# at a real one. That archive's 7z extraction creates symlinks for binaries +# this target never uses (its macOS/Linux signing tools), and fails outright +# without SeCreateSymbolicLinkPrivilege -- which this machine's build shell +# does not hold. The Windows 10 SDK already installed here has everything +# actually needed (makeappx.exe, signtool.exe); point electron-builder at +# it instead of fighting that extraction. Only set if the caller hasn't +# already pointed it somewhere themselves. +if (-not $env:ELECTRON_BUILDER_WINDOWS_KITS_PATH) { + $kitsRoot = "C:\Program Files (x86)\Windows Kits\10\bin" + $kit = Get-ChildItem $kitsRoot -ErrorAction SilentlyContinue | + Where-Object { $_.PSIsContainer -and $_.Name -match '^\d+\.\d+\.\d+\.\d+$' ` + -and (Test-Path (Join-Path $_.FullName "x64\makeappx.exe")) } | + Sort-Object Name -Descending | Select-Object -First 1 + if (-not $kit) { + throw ("No Windows 10 SDK with makeappx.exe found under $kitsRoot -- " + + "install the Windows 10 SDK (the App Certification Kit / MSIX " + + "Packaging Tools component covers it), or set " + + "ELECTRON_BUILDER_WINDOWS_KITS_PATH yourself.") + } + $env:ELECTRON_BUILDER_WINDOWS_KITS_PATH = Join-Path $kit.FullName "x64" +} +Step "Windows Kits: $env:ELECTRON_BUILDER_WINDOWS_KITS_PATH" + +# --- 1. Node ------------------------------------------------------------- +Assert-NodeVersion + +Push-Location $Client +try { + # --- 2. deps ------------------------------------------------------ + Invoke-NpmCi + + # --- 3. Electron: build against the latest release -------------- + Invoke-ElectronBump -NoElectronBump:$NoElectronBump -WinDir $WinDir + + # --- 4. UI ----------------------------------------------------- + Invoke-SyncUi + + # --- 5. node runtime --------------------------------------- + $rtExe = Join-Path $Client "node-runtime\meshbay-node.exe" + if ($SkipNodeRuntime -and (Test-Path $rtExe)) { + Step "reusing existing node-runtime/" + } else { + Step "building the bundled node (PyInstaller)" + $rtArgs = @{} + if ($SkipFfmpeg) { $rtArgs["SkipFfmpeg"] = $true } + & (Join-Path $WinDir "build-node-runtime.ps1") @rtArgs + if ($LASTEXITCODE -ne 0) { throw "build-node-runtime.ps1 failed" } + } + + # --- 6. package --------------------------------------- + Step "electron-builder --win appx --config electron-builder.msix.yml" + & npx electron-builder --win appx --config $Config + if ($LASTEXITCODE -ne 0) { throw "electron-builder failed" } +} +finally { + Pop-Location +} + +$pkg = Get-ChildItem (Join-Path $Client "dist-msix") -Filter "*.appx" -ErrorAction SilentlyContinue | + Sort-Object LastWriteTime | Select-Object -Last 1 +Write-Host "" +if ($pkg) { + Write-Host "OK package: $($pkg.FullName)" -ForegroundColor Green + Write-Host (" ({0:N0} MB)" -f ($pkg.Length / 1MB)) + Write-Host " unsigned by design -- Microsoft signs it at publish time" -ForegroundColor DarkGray + Write-Host " (msix-installer.md 3)." -ForegroundColor DarkGray +} +else { + Write-Host "!! no *.appx found in $Client\dist-msix" -ForegroundColor Red + exit 1 +} -- cgit v1.2.3