Provide optional per-user MSI alongside existing EXE/ZIP assets using
pinned Velopack1.2.161. Keep the existing signing hook, preserve
third-party signatures, verify the administratively extracted MSI
payload through the existing signed-archive verifier, require native MSI
install/window launch/uninstall before publication, and include MSI in
SBOM subjects/checksums/provenance. The default remains EXE-only for
existing callers.
Validation: actionlint and configured zizmor medium gate pass; all40
signing regressions pass with zero skips. A real native MSI fixture
compiles and the actual GitHub-wrapped extraction body preserves all6
signed input application binaries byte-for-byte. Native MSI ProductCode
lookup succeeds. The first local administrative target exceeded Windows
Installer's path limit; a short normal temporary root succeeds, matching
hosted runner paths. This fixture is unsigned and not published;
production MSI signing/installation is required before claiming
delivery.
The maintainer explicitly renewed EXE+MSI delivery and instructed
completion without further human-review requests. Existing publication
authorization applies. No Azure identity, scope or credential changes.
Substantial AI assistance: Codex GPT-6. Refs
KofTwentyTwo/MarkdownViewr.Windows#36 and #33.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
james.maesandCodex GPT-6
7584fa19cc