Support MSIX/AppX bundles and upload extensions equally across code paths - #32
Merged
Marc-André Moreau (mamoreau-devolutions) merged 2 commits intoSep 5, 2026
Conversation
…aths - psign-portable-core: portable final signing for .msixbundle/.appxbundle with native AppxBundleSip semantics (manifest-only bundle block map with backslash names and per-block Size, byte-identical child packages, PKCX AppxSignature embedding); skip-signed preflight via AppxSignature.p7x presence; explicit MsixUpload/MsixEncrypted formats with family-specific diagnostics - psign-sip-digest: fix ZIP64 classic-EOCD 0xFFFF disk-field sentinels being misread as multi-disk; expose msix_signature_part_present - portable sign: route bundles through native-shaped local/KV/Artifact Signing paths; extend --skip-signed and target validation to the full MSIX family - psign-tool code: bundle layouts regenerate manifest-only block maps and propagate --publisher-name into AppxBundleManifest.xml Identity@Publisher and child Package@Publisher - digest CLI: msix-manifest-info / msix-set-publisher read and update bundle manifests (AppxMetadata/AppxBundleManifest.xml), reporting package_publisher - win detect/sealing: classify .appxupload/.msixupload as MSIX family for uniform SIP diagnostics and sealing constraints - docs: close the portable-msix-bundle-upload-final-signing gap; upload containers and encrypted packages remain explicit rejections
New clippy lint fires on all chunks_exact(2) call sites under -D warnings; replace with as_chunks::<2>() across portable and Windows-only crates so the floating-stable CI clippy gates pass.
Marc-André Moreau (mamoreau-devolutions)
merged commit Sep 5, 2026
a50e39c
into
master
36 checks passed
Marc-André Moreau (mamoreau-devolutions)
deleted the
copilot/msix-format-parity
branch
September 5, 2026 23:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The MSIX-family audit found
.msixbundle/.appxbundlewere not treated equally: portable bundle final signing was explicitly rejected as "flat-only",--skip-signedignored bundles,psign-tool coderegenerated wrong (flat-style) block maps for bundles and silently ignored--publisher-nameon them, andmsix-manifest-info/msix-set-publisherfailed on bundle manifests. This PR closes those gaps so all MSIX-family formats are handled uniformly.psign-portable-core):.msixbundle/.appxbundlesign through native-shaped portable local PFX/cert-store, Azure Key Vault, and Artifact Signing REST routes with nativeAppxBundleSipsemantics — manifest-only bundle block map (backslash names, per-blockSize,LfhSize=65, byte-verified against MakeAppx fixtures), byte-identical child packages, andPKCX-wrappedAppxSignature.p7xembedding. Children must be signed before the bundle, matching native.psign-sip-digest): MakeAppx writes0xFFFFsentinels in the classic EOCD disk fields;parse_zip_tailmisread them as multi-disk and rejected valid MakeAppx output. Real disk fields are validated in the ZIP64 EOCD path.--skip-signednow covers bundles (bothtarget_should_skip_signedand the staging preflight via newmsix_signature_part_present).psign-tool code: bundle layouts regenerate manifest-only block maps and propagate--publisher-nameintoAppxBundleManifest.xmlIdentity@Publisherplus childPackage@Publishermirrors.msix-manifest-info/msix-set-publisher: read/updateAppxMetadata/AppxBundleManifest.xmlfor bundles, reportingpackage_publisher; flat path unchanged..appxupload/.msixupload→MsixFamily(Win32detect()) and newPortableFileFormat::MsixUpload/MsixEncryptedvariants with family-specific explicit errors everywhere (portable sign/inspect/trust,--mode portable verifyrouting, sealing constraints). Upload containers and encrypted packages remain deliberate, documented rejections (not cleartext SIP subjects).Testing
cargo fmt --all --checkclean;cargo clippy --workspace --all-targets --lockedclean (incl. feature combosartifact-signing-rest,azure-kv-sign-portable,timestamp-http)cargo test --workspace --lockedgreen: 182 sip-digest unit tests, 224 cli_pe_digest tests with KV/Artifact-Signing/timestamp test servers, all code_command tests, CLI-matrix doc testverify-msixpasses with recursive child validation;--skip-signedbundle detection; bundle-manifest publisher propagationDocs
Updated
rust-sip-gaps.md,gap-analysis-signing-platforms.md,linux-signing-pipelines.md,migration-artifact-signing.md,migration-azuresigntool.md, andpsign-cli-matrix.json/.md(top gap renamed toportable-msix-upload-final-signing; bundle gap closed).