Release v1.2.1 MSI builder recovery #50
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/standards#50
Reference in new issue
Block a user
Release checklist: v1.2.1 MSI builder recovery Preserve the failed signedv1.2.0 tag (missing MINOR checklist annotation; no assets published). This PATCH recovery carries the same optional MSI implementation and links its actual preflight evidence. Owner publication/no-further-human-review authorization remains in effect. ## 1. Conformance - [x] Full Test-RepoConformance -Repository KofTwentyTwo/standards -LocalPath . exits0: no FAIL;33 PASS,5 REVIEW,2 WARN,1 N/A. Retained full output AppKit/artifacts/msi-builder-release-conformance.log. - [x] Applicable EX-0001 single-maintainer and EX-0006 release-proposal credential exceptions are open/unexpired. No signing exception is used for production MSI. Review items concern provider enrollment/current assessment, fuzz scope, CI command parity and release-gate structure; existing documented controls remain. Warnings are allowed-actions breadth and no homepage, not hidden passes. ## 2. Scans/findings - [x] Main has no open HIGH/CRITICAL code-scanning alerts. The only open item is medium Scorecard Fuzzing process metric#2, not an exploitable product vulnerability. - [x] No HIGH/CRITICAL Dependabot alerts are open. - [x] No known non-exploitable product vulnerability requires a new VEX statement; no fake VEX is created for a repository process metric. ## 3. MSI security assessment - [x] Existing Azure OIDC environment/repository trust, profile role, publisher verification and third-party signature preservation are unchanged. Optional MSI uses native Velopack/Windows Installer; per-user scope matches EXE. Administrative extraction checks exact signed payload bytes. Bounded install/window-launch/uninstall and final native signatures run before publication. Temporary cleanup validates its resolved owned root. - [x] Highest impact risk is shipping altered/unsigned payload or installing into an incorrect location: explicit payload hashes, timestamped publisher/trust checks, per-user scope, owned temporary targets and mandatory native lifecycle checks address it. ## 4. Test depth - [x] All40 signing regression tests pass0skip; hosted builder/source checks pass. Real pinnedvpk MSI fixture compiles and actual GitHub-wrapped extraction preserves all6 signed input application binaries byte-for-byte; native ProductCode query passes. - [x] Mutation/fuzz campaigns are not applicable to the new native packaging switch; no parser/core library logic changes. Existing parser/security validation remains. Actual signed production MSI lifecycle proof belongs to each app release; no claim it has already run. ## 5. Ship - [x] Recovery documentation/main and generated1.2.1 release proposal are green; metadata-only notes reviewed. - [x] New signed1.2.1 annotation includes this checklist URL; workflow succeeds and protected publication is approved. - [x] All actual public bundle assets verify SHA256, strict source/workflow/tag provenance and exact hosted builder bytes. - [x] Final publication notes and app caller pin updated; close after proof.
Published verification
Standards v1.2.1 at70b555bd5658273090769991bfc4c9b6681dde18 is public and immutable; protected production run38405432024 succeeded. Its signed tag annotation links this checklist. All five downloaded bundle assets verify SHA256, strict source/workflow/tag provenance and exact hosted workflow bytes. Receipt: AppKit/artifacts/standards-1.2.1-verification/verified.json. MarkdownViewr caller pins this exact digest; both public1.0.3 stable/dev releases additionally pass actual MSI signing, payload and install/launch/uninstall verification. Failed v1.2.0 is preserved.