KofTwentyTwo/AppKit
2
0 Fork 0
Code Issues 22 Pull Requests 4 Actions Packages Projects Releases 1 Wiki Activity

release: complete Windows Authenticode signing integration #12

New Issue
Open
opened 2026-10-10 16:58:42 +00:00 by KofTwentyTwo · 8 comments
KofTwentyTwo commented 2026-10-10 16:58:42 +00:00 (Migrated from github.com)
Copy link
Copy source

Problem

Windows release signing is not yet verified. The owner now reports an existing working Azure Artifact Signing account, Completed publisher identity validation and an Active Public Trust profile. Reuse that deployment; do not recreate the tenant/account/validation. Actual tenant GUID, region, final profile name and publisher subject still require inspection.

Acceptance criteria

  1. Verify the deployed account/profile/region/subject and actual tenant GUID.
  2. Reuse or configure a suitable scoped Entra CI identity, repository/environment-bound GitHub OIDC trust and Certificate Profile Signer role at profile scope. Preserve other apps' identities/assignments and coordinate shared changes.
  3. Integrate current official pinned azure/login and azure/artifact-signing-action on trusted Windows release jobs; exclude pull-request signing access. Sign owned final binaries before packaging, preserve third-party signatures, use packaging hooks for generated installers, and create checksums/updater metadata after signing.
  4. Configure local Artifact Signing Client Tools/SignTool authentication and metadata without exporting private keys or using administrator passwords in CI.
  5. Verify representative and exact distributed artifacts with signtool verify /pa /all /v, expected publisher/trust/timestamp checks; signing/verification failures must block production publication.
  6. Update EX-0002 status only after applicable runtime/release proof. If Azure access is unavailable, finish possible repository work and provide precise administrator commands for remaining setup.

Scope

AppKit Windows foundations and the starter's generated application releases. Existing Azure setup is reusable; Microsoft 365, company sign-ins/custom domains, tenant recreation and publisher onboarding are outside scope. Commit, push and publication boundaries remain in force.

Local work is not completion until applicable deployed and shipped artifacts are verified. Substantial AI assistance: Codex (GPT-6).

## Problem Windows release signing is not yet verified. The owner now reports an existing working Azure Artifact Signing account, Completed publisher identity validation and an Active Public Trust profile. Reuse that deployment; do not recreate the tenant/account/validation. Actual tenant GUID, region, final profile name and publisher subject still require inspection. ## Acceptance criteria 1. Verify the deployed account/profile/region/subject and actual tenant GUID. 2. Reuse or configure a suitable scoped Entra CI identity, repository/environment-bound GitHub OIDC trust and Certificate Profile Signer role at profile scope. Preserve other apps' identities/assignments and coordinate shared changes. 3. Integrate current official pinned azure/login and azure/artifact-signing-action on trusted Windows release jobs; exclude pull-request signing access. Sign owned final binaries before packaging, preserve third-party signatures, use packaging hooks for generated installers, and create checksums/updater metadata after signing. 4. Configure local Artifact Signing Client Tools/SignTool authentication and metadata without exporting private keys or using administrator passwords in CI. 5. Verify representative and exact distributed artifacts with `signtool verify /pa /all /v`, expected publisher/trust/timestamp checks; signing/verification failures must block production publication. 6. Update EX-0002 status only after applicable runtime/release proof. If Azure access is unavailable, finish possible repository work and provide precise administrator commands for remaining setup. ## Scope AppKit Windows foundations and the starter's generated application releases. Existing Azure setup is reusable; Microsoft 365, company sign-ins/custom domains, tenant recreation and publisher onboarding are outside scope. Commit, push and publication boundaries remain in force. Local work is not completion until applicable deployed and shipped artifacts are verified. Substantial AI assistance: Codex (GPT-6).
KofTwentyTwo commented 2026-10-10 19:35:31 +00:00 (Migrated from github.com)
Copy link
Copy source

Prepared and committed the existing-service integration locally:

  • AppKit a8d9cf7efe5a3ca03c88442d776765ad4de9bc41: read-only deployed tenant/account/profile/publisher discovery; additive repository-specific OIDC and profile-scoped signer setup; local SignTool/client integration; verification helpers and CI regression gates; release preflight blocks another unsigned publication until the shared builder and verified settings are enabled.
  • Isolated standards branch fix/artifact-signing-appkit, head 7bd3cfe5fff8468c1f06667d6248540aff97bb13, with immutable helper snapshot b5ab18cba211ac7bfc381b60356c4af03ca4a38e. NuGet signs before pack; Velopack signs only explicitly owned files plus its branded packaging helpers. Verification checks publisher, trust, timestamps, SHA256, exact shipped bytes, dependency preservation, and Setup's embedded full-package hash. SBOMs use signed output; checksums/provenance follow verification. The original standards checkout is untouched.

Validation: 31 Pester checks passed (21 signing/distribution, six Azure administration boundaries, four existing coverage gates); full PowerShell analysis, workflow syntax/security checks and commit hooks passed. Shared conformance self-test and standards package regression checks passed; signing docs pass Markdown lint. Both repository commits are SSH-signed and DCO-signed-off. Microsoft's client tools 1.0.146 passed author/repository signature verification. The real installed SignTool passed trust/timestamp verification on its Microsoft signature; an unsigned AppKit DLL was correctly rejected.

No claim of successful AppKit signing: Azure CLI still has no authenticated context. The device-code attempt ended with authorization pending. Therefore actual tenant GUID, account region/endpoint, active profile name and publisher subject remain unverified; no CI identity, federation, role assignment or GitHub signing variable was created. No pushes, merges, account onboarding or release publication occurred.

Exact administrator commands, variable mapping, caller activation and real signed-build verification are in docs/release-signing.md (local commit; link becomes available after authorized push). Remaining: complete CLI login; inspect the deployed existing service; provision/reuse the reviewed identity and profile role; publish the reviewed shared builder through the normal authorized process; update caller pins/config; prove real signatures and final distributed bytes. Keep this issue and EX-0002 open until that evidence exists. Installed delta/channel reconstruction remains tracked separately in #11.

Prepared and committed the existing-service integration locally: - AppKit `a8d9cf7efe5a3ca03c88442d776765ad4de9bc41`: read-only deployed tenant/account/profile/publisher discovery; additive repository-specific OIDC and profile-scoped signer setup; local SignTool/client integration; verification helpers and CI regression gates; release preflight blocks another unsigned publication until the shared builder and verified settings are enabled. - Isolated standards branch `fix/artifact-signing-appkit`, head `7bd3cfe5fff8468c1f06667d6248540aff97bb13`, with immutable helper snapshot `b5ab18cba211ac7bfc381b60356c4af03ca4a38e`. NuGet signs before pack; Velopack signs only explicitly owned files plus its branded packaging helpers. Verification checks publisher, trust, timestamps, SHA256, exact shipped bytes, dependency preservation, and Setup's embedded full-package hash. SBOMs use signed output; checksums/provenance follow verification. The original standards checkout is untouched. Validation: 31 Pester checks passed (21 signing/distribution, six Azure administration boundaries, four existing coverage gates); full PowerShell analysis, workflow syntax/security checks and commit hooks passed. Shared conformance self-test and standards package regression checks passed; signing docs pass Markdown lint. Both repository commits are SSH-signed and DCO-signed-off. Microsoft's client tools 1.0.146 passed author/repository signature verification. The real installed SignTool passed trust/timestamp verification on its Microsoft signature; an unsigned AppKit DLL was correctly rejected. No claim of successful AppKit signing: Azure CLI still has no authenticated context. The device-code attempt ended with authorization pending. Therefore actual tenant GUID, account region/endpoint, active profile name and publisher subject remain unverified; no CI identity, federation, role assignment or GitHub signing variable was created. No pushes, merges, account onboarding or release publication occurred. Exact administrator commands, variable mapping, caller activation and real signed-build verification are in [docs/release-signing.md](https://github.com/KofTwentyTwo/AppKit/blob/a8d9cf7efe5a3ca03c88442d776765ad4de9bc41/docs/release-signing.md) (local commit; link becomes available after authorized push). Remaining: complete CLI login; inspect the deployed existing service; provision/reuse the reviewed identity and profile role; publish the reviewed shared builder through the normal authorized process; update caller pins/config; prove real signatures and final distributed bytes. Keep this issue and EX-0002 open until that evidence exists. Installed delta/channel reconstruction remains tracked separately in #11.
KofTwentyTwo commented 2026-10-10 21:32:55 +00:00 (Migrated from github.com)
Copy link
Copy source

Progress: inspected gclo's current release workflow, its protected release variables, standards PR #29 and the newly published standards v1.0.0. Gclo beta.3 run 38087007507 passed OIDC login, signing, Velopack packing, pre-publication signature verification and publication. Its separate post-publication verification failed because that job could not read the publisher variable. This is reference evidence, not AppKit signing proof.

Committed locally in the isolated standards branch fix/artifact-signing-appkit:

  • 14860e13a9edec40fb1ef17e349524b0025e4cc9: use the Azure CLI-backed SignTool/dlib wrapper through --signTemplate, preserve valid existing signatures, refuse invalid existing signatures, and stop on signing or verification errors; five tests exercise the actual wrapper.
  • 4dfde0976a59f3a2b07b974444e837574310c083: reject missing third-party binaries from portable, full update and CLI archives, preserving hashes and documented helper exclusions.

AppKit 146138957506b79459a6d811a1e70a626e006699 carries the same distribution checks and updated docs/release-signing.md. All commits are signed/DCO signed off and remain unpushed. Validation: 31 shared signing/wrapper tests, 36 AppKit script tests, PowerShell analysis, workflow security/syntax and relevant hooks; documentation lint passes with the shared standards configuration.

Observed gclo configuration identifies the tenant, East US endpoint and releases profile, but these still need authenticated deployment verification. Do not copy its client ID or infer a full certificate subject from its partial publisher match. Published standards v1.0.0 includes the Velopack fix but still lacks AppKit's required NuGet signing inputs, so our caller remains fail closed pending publication of the prepared builder.

Remaining acceptance: actual profile/subject lookup, reviewed AppKit OIDC identity and profile-scoped Signer role, environment configuration, representative real signing, and exact final shipped artifact verification. Azure sign-in retry remains deferred at the owner's request. No Azure/settings changes, pushes or new releases were performed by this session. Issue remains open. Substantial AI assistance: Codex (GPT-6).

Progress: inspected gclo's current release workflow, its protected release variables, standards PR #29 and the newly published standards v1.0.0. Gclo beta.3 run [38087007507](https://github.com/KofTwentyTwo/gclo/actions/runs/38087007507) passed OIDC login, signing, Velopack packing, pre-publication signature verification and publication. Its separate post-publication verification failed because that job could not read the publisher variable. This is reference evidence, not AppKit signing proof. Committed locally in the isolated standards branch `fix/artifact-signing-appkit`: - `14860e13a9edec40fb1ef17e349524b0025e4cc9`: use the Azure CLI-backed SignTool/dlib wrapper through `--signTemplate`, preserve valid existing signatures, refuse invalid existing signatures, and stop on signing or verification errors; five tests exercise the actual wrapper. - `4dfde0976a59f3a2b07b974444e837574310c083`: reject missing third-party binaries from portable, full update and CLI archives, preserving hashes and documented helper exclusions. AppKit `146138957506b79459a6d811a1e70a626e006699` carries the same distribution checks and updated `docs/release-signing.md`. All commits are signed/DCO signed off and remain unpushed. Validation: 31 shared signing/wrapper tests, 36 AppKit script tests, PowerShell analysis, workflow security/syntax and relevant hooks; documentation lint passes with the shared standards configuration. Observed gclo configuration identifies the tenant, East US endpoint and `releases` profile, but these still need authenticated deployment verification. Do not copy its client ID or infer a full certificate subject from its partial publisher match. Published standards v1.0.0 includes the Velopack fix but still lacks AppKit's required NuGet signing inputs, so our caller remains fail closed pending publication of the prepared builder. Remaining acceptance: actual profile/subject lookup, reviewed AppKit OIDC identity and profile-scoped Signer role, environment configuration, representative real signing, and exact final shipped artifact verification. Azure sign-in retry remains deferred at the owner's request. No Azure/settings changes, pushes or new releases were performed by this session. Issue remains open. Substantial AI assistance: Codex (GPT-6).
KofTwentyTwo commented 2026-10-10 21:59:07 +00:00 (Migrated from github.com)
Copy link
Copy source

Generated-application signing preflight is committed locally as signed/DCO commit 34d7543a3ce7434dcda6545ad9ab33b5b1426a02 in the isolated starter worktree.

Both CLI and GUI-only release callers now bind the configuration check to the protected release environment. Publication is blocked unless signing is explicitly enabled, the owned-file catalog is nonempty, and all seven signing variables are present. Client/tenant/subscription identifiers must be nonempty GUIDs; the endpoint must be HTTPS on the Artifact Signing domain. Modern variable names and the documented legacy fallback are supported. The content-only source-template NuGet workflow remains separate.

Validation: packed the actual template, generated renamed custom-owner CLI and GUI-only projects, and passed all 40 script boundary tests in source and each generated variant. Changed-file PSScriptAnalyzer checks passed in fresh processes after its intermittent internal exception. Source/generated workflow syntax, offline workflow security checks, documentation lint and required hooks passed. Commit signature verified.

The guide covers repository/environment-bound OIDC, profile-scoped signer permission, exact publisher verification, third-party signature preservation and final-byte verification. It explicitly requires a published reviewed shared builder supporting the owned-file catalog before enabling signing; published standards v1.0.0 does not expose that interface. No unpublished builder has been pinned.

This proves configuration guards, not Azure access or valid AppKit signatures. Actual deployed profile lookup, AppKit CI identity/federation/role, representative signed artifacts and hosted rollout remain acceptance requirements. Azure retry remains deferred by the owner. No push, merge, release or live settings/Azure change was performed. Substantial AI assistance: Codex (GPT-6).

Generated-application signing preflight is committed locally as signed/DCO commit `34d7543a3ce7434dcda6545ad9ab33b5b1426a02` in the isolated starter worktree. Both CLI and GUI-only release callers now bind the configuration check to the protected `release` environment. Publication is blocked unless signing is explicitly enabled, the owned-file catalog is nonempty, and all seven signing variables are present. Client/tenant/subscription identifiers must be nonempty GUIDs; the endpoint must be HTTPS on the Artifact Signing domain. Modern variable names and the documented legacy fallback are supported. The content-only source-template NuGet workflow remains separate. Validation: packed the actual template, generated renamed custom-owner CLI and GUI-only projects, and passed all 40 script boundary tests in source and each generated variant. Changed-file PSScriptAnalyzer checks passed in fresh processes after its intermittent internal exception. Source/generated workflow syntax, offline workflow security checks, documentation lint and required hooks passed. Commit signature verified. The guide covers repository/environment-bound OIDC, profile-scoped signer permission, exact publisher verification, third-party signature preservation and final-byte verification. It explicitly requires a published reviewed shared builder supporting the owned-file catalog before enabling signing; published standards v1.0.0 does not expose that interface. No unpublished builder has been pinned. This proves configuration guards, not Azure access or valid AppKit signatures. Actual deployed profile lookup, AppKit CI identity/federation/role, representative signed artifacts and hosted rollout remain acceptance requirements. Azure retry remains deferred by the owner. No push, merge, release or live settings/Azure change was performed. Substantial AI assistance: Codex (GPT-6).
KofTwentyTwo commented 2026-10-10 22:10:49 +00:00 (Migrated from github.com)
Copy link
Copy source

Signed local shared-builder commit ec242b0a5078cdc078dd62262f4301386bd5d315 reconciles the isolated signing preparation with the published standards v1.0.0 snapshot. Its published metadata, policies, exception dispositions and release documentation are preserved exactly; other agents' original checkouts were not edited or merged.

Prepared NuGet and Velopack builders retain the explicit owned-file catalog, third-party preservation and strict final verification. Their helper references now target 4dfde0976a59f3a2b07b974444e837574310c083, which includes final missing-dependency checks; helper action/module Git blob IDs match the tested current source exactly. Modern and legacy endpoint/account/profile/subject variable fallbacks are consistent. The threat model and rollout guide distinguish this preparation from deployment.

Validation: 31 signing/wrapper cases, checker self-test, static conformance (23 PASS, 5 REVIEW, 12 UNKNOWN, 1 N/A), source workflow syntax/offline security checks, nine changed Markdown files and required hooks passed. Lychee is not available locally; no internal-link gate or hosted CI pass is claimed.

The helper references remain explicitly unreleased preparation. Their reviewed snapshot must be available on GitHub and the completed builder published with proper version comments before consumer rollout. AppKit/generated callers remain blocked and have not been repinned to an unpublished builder. Actual deployed profile/identity/role and final AppKit signed artifacts remain unproved. No push, merge, release, Azure mutation or login retry was performed. Substantial AI assistance: Codex (GPT-6).

Signed local shared-builder commit `ec242b0a5078cdc078dd62262f4301386bd5d315` reconciles the isolated signing preparation with the published standards v1.0.0 snapshot. Its published metadata, policies, exception dispositions and release documentation are preserved exactly; other agents' original checkouts were not edited or merged. Prepared NuGet and Velopack builders retain the explicit owned-file catalog, third-party preservation and strict final verification. Their helper references now target `4dfde0976a59f3a2b07b974444e837574310c083`, which includes final missing-dependency checks; helper action/module Git blob IDs match the tested current source exactly. Modern and legacy endpoint/account/profile/subject variable fallbacks are consistent. The threat model and rollout guide distinguish this preparation from deployment. Validation: 31 signing/wrapper cases, checker self-test, static conformance (23 PASS, 5 REVIEW, 12 UNKNOWN, 1 N/A), source workflow syntax/offline security checks, nine changed Markdown files and required hooks passed. Lychee is not available locally; no internal-link gate or hosted CI pass is claimed. The helper references remain explicitly unreleased preparation. Their reviewed snapshot must be available on GitHub and the completed builder published with proper version comments before consumer rollout. AppKit/generated callers remain blocked and have not been repinned to an unpublished builder. Actual deployed profile/identity/role and final AppKit signed artifacts remain unproved. No push, merge, release, Azure mutation or login retry was performed. Substantial AI assistance: Codex (GPT-6).
KofTwentyTwo commented 2026-10-10 22:24:42 +00:00 (Migrated from github.com)
Copy link
Copy source

Implemented and verified the scoped production source-input gate in signed local commits:

  • AppKit bbf7efdba8e3d3a4cfe141923153dce53dc11fda.
  • Shared helper 4a7f028976163cb80730126eda1b029005803325.
  • Prepared shared workflows 2fdf22c48485c55248c59d195aec7b3556f68f02, referencing that exact helper snapshot.

Catalog creation now parses owned and preserved .exe/.dll headers before output. MSI/MSIX use their later format-specific checks; excluded, non-preserved files do not interfere with scoped NuGet signing. Original third-party signatures remain untouched. Initial test fixtures now use real PE bytes; different culture payloads retain different bytes.

The exact previously accepted malformed dependency is rejected before any catalog or manifest exists. Evidence: artifacts/readiness-issues/catalog-pe-rejection-f72a44f75aee484a8f56ba1455544f86/result.json. AppKit's 40 script cases and shared signing/wrapper 35 cases pass. Changed-source PowerShell checks passed in fresh processes after one analyzer internal exception; required hooks, workflow syntax/offline security and shared-policy Markdown checks passed. All commit signatures verified. Helper source blob matches the workflow reference.

Release guides and both threat models now explain this boundary. Closing the scoped source-validation implementation criteria; real Azure authorization/signatures and reviewed builder deployment remain #12/#20. The referenced helper is still explicitly unreleased preparation; consumers remain blocked and no unpublished builder was pinned. No push, merge, release, settings/Azure change or login retry occurred. The historical corruption cause remains unknown.

Implemented and verified the scoped production source-input gate in signed local commits: - AppKit `bbf7efdba8e3d3a4cfe141923153dce53dc11fda`. - Shared helper `4a7f028976163cb80730126eda1b029005803325`. - Prepared shared workflows `2fdf22c48485c55248c59d195aec7b3556f68f02`, referencing that exact helper snapshot. Catalog creation now parses owned and preserved `.exe`/`.dll` headers before output. MSI/MSIX use their later format-specific checks; excluded, non-preserved files do not interfere with scoped NuGet signing. Original third-party signatures remain untouched. Initial test fixtures now use real PE bytes; different culture payloads retain different bytes. The exact previously accepted malformed dependency is rejected before any catalog or manifest exists. Evidence: `artifacts/readiness-issues/catalog-pe-rejection-f72a44f75aee484a8f56ba1455544f86/result.json`. AppKit's 40 script cases and shared signing/wrapper 35 cases pass. Changed-source PowerShell checks passed in fresh processes after one analyzer internal exception; required hooks, workflow syntax/offline security and shared-policy Markdown checks passed. All commit signatures verified. Helper source blob matches the workflow reference. Release guides and both threat models now explain this boundary. Closing the scoped source-validation implementation criteria; real Azure authorization/signatures and reviewed builder deployment remain #12/#20. The referenced helper is still explicitly unreleased preparation; consumers remain blocked and no unpublished builder was pinned. No push, merge, release, settings/Azure change or login retry occurred. The historical corruption cause remains unknown.
KofTwentyTwo commented 2026-10-10 22:49:29 +00:00 (Migrated from github.com)
Copy link
Copy source

Current AppKit review at bbf7efdba8e3d3a4cfe141923153dce53dc11fda is recorded with resolved code findings, not a maintainer acknowledgement. Fresh locked restore/zero-warning full build/format, 161 unit tests with 100% core/update coverage, 14 WinUI/WPF UI tests, seven review-validator tests and ESLint pass. Retained 40 script tests remain passing. Both actual generated variants now pass complete local channel upgrades and 19 UI checks each; hosted enforcement and genuine owner acknowledgement remain required.

The shared rollout is now a separate branch based directly on published standards v1.0.0 (7c69368): helper 3334d02b907d44f4dca1b32553ad2bd6203c7b7f, integration 5887a839b23a405aa6b8148af61361e19da07643. Its exact helper is an ancestor, module bytes match the reviewed AppKit source, and only eleven signing-related files differ. All 35 signing/wrapper tests, workflow syntax/offline security, Markdown and existing security/message hooks pass. Both commits verify signed/DCO; older shared preparation and original checkouts remain intact.

Prepared local files: artifacts/readiness-issues/{APPKIT-REVIEW-bbf7efd.md,STANDARDS-REVIEW-5887a83.md,APPKIT-PR-bbf7efd.md,STANDARDS-PR-5887a83.md,ROLLOUT-bbf7efd-5887a83.md}. These describe exact branches, validation, unresolved hosted/bootstrap/publication criteria and administrator signing actions. Helper references remain unpublished preparation; do not repin consumers or remove release preflight until the reviewed builder is available and actual verified signing configuration is established. No successful AppKit signing is claimed.

Read-only hosted checks still show AppKit main 839fb72, standards main 7c69368, and no public KofTwentyTwo/windows-app-template repository. No push, PR, merge, new release, settings/Azure change or login retry occurred. Thirty signed local preparation commits are retained (22 across active rollout branches, eight older shared preparation commits). Azure retry remains owner-deferred. Current-SHA owner acknowledgement and live review/check enforcement must still be bootstrapped.

Current AppKit review at `bbf7efdba8e3d3a4cfe141923153dce53dc11fda` is recorded with resolved code findings, not a maintainer acknowledgement. Fresh locked restore/zero-warning full build/format, 161 unit tests with 100% core/update coverage, 14 WinUI/WPF UI tests, seven review-validator tests and ESLint pass. Retained 40 script tests remain passing. Both actual generated variants now pass complete local channel upgrades and 19 UI checks each; hosted enforcement and genuine owner acknowledgement remain required. The shared rollout is now a separate branch based directly on published standards v1.0.0 (`7c69368`): helper `3334d02b907d44f4dca1b32553ad2bd6203c7b7f`, integration `5887a839b23a405aa6b8148af61361e19da07643`. Its exact helper is an ancestor, module bytes match the reviewed AppKit source, and only eleven signing-related files differ. All 35 signing/wrapper tests, workflow syntax/offline security, Markdown and existing security/message hooks pass. Both commits verify signed/DCO; older shared preparation and original checkouts remain intact. Prepared local files: `artifacts/readiness-issues/{APPKIT-REVIEW-bbf7efd.md,STANDARDS-REVIEW-5887a83.md,APPKIT-PR-bbf7efd.md,STANDARDS-PR-5887a83.md,ROLLOUT-bbf7efd-5887a83.md}`. These describe exact branches, validation, unresolved hosted/bootstrap/publication criteria and administrator signing actions. Helper references remain unpublished preparation; do not repin consumers or remove release preflight until the reviewed builder is available and actual verified signing configuration is established. No successful AppKit signing is claimed. Read-only hosted checks still show AppKit main `839fb72`, standards main `7c69368`, and no public `KofTwentyTwo/windows-app-template` repository. No push, PR, merge, new release, settings/Azure change or login retry occurred. Thirty signed local preparation commits are retained (22 across active rollout branches, eight older shared preparation commits). Azure retry remains owner-deferred. Current-SHA owner acknowledgement and live review/check enforcement must still be bootstrapped.
KofTwentyTwo commented 2026-10-10 22:55:32 +00:00 (Migrated from github.com)
Copy link
Copy source

The authorized topic branches are now pushed and draft PRs are open:

Shared signing run 38093017631 completed successfully, including Windows signing tests, conformance, docs, CodeQL, security and PR gates. These are preparation tests, not proof of Azure authentication or real signatures.

AppKit's initial hosted run passed build-test, UI, JavaScript and security checks. It exposed a pinned analyzer recursive-analysis crash and uri-js development-license policy rejection, now tracked in #26. A signed, reviewed correction checks all nine PowerShell files separately with unchanged rules; all pass locally, and current-head hosted validation is running. The license failure remains enforced pending a recorded policy exception.

Both PRs remain drafts. Owner review acknowledgement, review-gate/settings bootstrap, shared publication/consumer adoption, public starter rollout and actual AppKit signing remain required where applicable. Push/draft approval did not authorize merge, release, repository creation, settings or Azure login retry.

The authorized topic branches are now pushed and draft PRs are open: - AppKit #25: https://github.com/KofTwentyTwo/AppKit/pull/25 (current signed head 09f9e0777e14043403de350477097ec212cbe61a) - Shared signing #31: https://github.com/KofTwentyTwo/standards/pull/31 (5887a839b23a405aa6b8148af61361e19da07643) Shared signing run 38093017631 completed successfully, including Windows signing tests, conformance, docs, CodeQL, security and PR gates. These are preparation tests, not proof of Azure authentication or real signatures. AppKit's initial hosted run passed build-test, UI, JavaScript and security checks. It exposed a pinned analyzer recursive-analysis crash and uri-js development-license policy rejection, now tracked in #26. A signed, reviewed correction checks all nine PowerShell files separately with unchanged rules; all pass locally, and current-head hosted validation is running. The license failure remains enforced pending a recorded policy exception. Both PRs remain drafts. Owner review acknowledgement, review-gate/settings bootstrap, shared publication/consumer adoption, public starter rollout and actual AppKit signing remain required where applicable. Push/draft approval did not authorize merge, release, repository creation, settings or Azure login retry.
KofTwentyTwo commented 2026-10-10 23:02:35 +00:00 (Migrated from github.com)
Copy link
Copy source

Final hosted checkpoint:

  • AppKit draft #25, head 09f9e0777e: build-test, format, WinUI/WPF UI, PowerShell (40/40), JavaScript/review tests, title/DCO, security and all three CodeQL language checks succeed. CodeQL run 38093181044 is completed SUCCESS. The only failed check is dependency-review's uri-js tooling-license policy rejection.
  • Shared signing draft #31, head 5887a83: run 38093017631 completed SUCCESS, all applicable checks.
  • Proposed tooling-license draft #32, head cd20e94: run 38093461441 completed SUCCESS, all applicable checks.

No CI job is still pending. License-policy acceptance remains unresolved: EX-0009 is Proposed, not Open/approved, and no caller exemption is enabled. Both the exact-version exception and any eventual caller correction need the normal reviewed process and updated current-head acknowledgement. No gate was weakened to obtain these results.

All three branches were pushed with explicit approval and remain drafts. No merge, release, starter creation/push, settings or Azure mutation/login retry occurred. Hosted results do not prove actual AppKit Azure signing, production feeds or full standards compliance. Scoped implementation/tests are verified; broader acceptance tickets remain open.

Final hosted checkpoint: - AppKit draft #25, head 09f9e0777e14043403de350477097ec212cbe61a: build-test, format, WinUI/WPF UI, PowerShell (40/40), JavaScript/review tests, title/DCO, security and all three CodeQL language checks succeed. CodeQL run 38093181044 is completed SUCCESS. The only failed check is dependency-review's uri-js tooling-license policy rejection. - Shared signing draft #31, head 5887a83: run 38093017631 completed SUCCESS, all applicable checks. - Proposed tooling-license draft #32, head cd20e94: run 38093461441 completed SUCCESS, all applicable checks. No CI job is still pending. License-policy acceptance remains unresolved: EX-0009 is Proposed, not Open/approved, and no caller exemption is enabled. Both the exact-version exception and any eventual caller correction need the normal reviewed process and updated current-head acknowledgement. No gate was weakened to obtain these results. All three branches were pushed with explicit approval and remain drafts. No merge, release, starter creation/push, settings or Azure mutation/login retry occurred. Hosted results do not prove actual AppKit Azure signing, production feeds or full standards compliance. Scoped implementation/tests are verified; broader acceptance tickets remain open.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 bug
Something isn't working
 deferred
Agreed follow-up, unscheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on the owner
 priority
Work this first
 quality
Tests, gates, and code quality
 question
Further information is requested
 refactor
Internal restructuring, no behavior change
 release
Release and packaging
 wontfix
This will not be worked on
No labels needs-owner release
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/AppKit#12