feat(releases): provide signed MSI installers alongside EXE #36
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/MarkdownViewr.Windows#36
Reference in new issue
Block a user
The maintainer requests downloadable MSI and EXE installers for users, rather than source archives alone. The current reviewed shared builder produces signed Setup.exe, portable ZIP, and update packages; it does not enable MSI.
Exact installedvpk1.2.161 exposes
--msi,--msiVersion, and--instLocation. Package source is Velopack commit92d6a1c91716729d449034df5c50307dcce39493. Confirm the exact-version install/update semantics before selecting the MSI scope; current upstream docs are https://docs.velopack.io/packaging/installer.Acceptance:
Published assets are immutable: do not append an unverified MSI to an existing release or change its signed tag. Current1.0 release timing is awaiting the maintainer's installer-format preference;#33 tracks publication. Substantial AI assistance: Codex.
Publication timing clarification is still unanswered. Automatic approval review rejected holding/cancelling active runs without an explicit maintainer instruction. No cancellation/hold was applied and no workaround was used. Current workflows remain EXE/ZIP-only; do not claim MSI exists or that this request is complete.
The owner's latest decision supersedes the earlier hold request: keep EXE/portable ZIP releases first and deliver MSI in the next release. Neither current release is published because independent signing-tool/bootstrap and acceptance timing blockers are being fixed in standards PR44 and app PR37. MSI is not a prerequisite for this initial EXE/ZIP publication, and remains open for actual signed installer/installed-update acceptance.
The maintainer renewed MSI delivery: "please please please release the exe and MSI files"; this supersedes the earlier deferral. Stable1.0.2 and dev1.0.2-beta.1 signed EXEs/ZIPs are now public and their actual downloaded signatures/timestamps/payloads/checksums/SBOM/provenance/updater feeds verify. No production MSI is published yet.
Minimal native MSI builder is signed8463119 on standards feat/signed-msi. It adds optional per-user MSI through the existing pinned Velopack/signing hook, verifies exact MSI payload bytes, gates actual install/launch/uninstall before publication, and includes MSI SBOM subjects. Syntax/security and40 signing regressions pass; real MSI compilation/extraction preserves all6 signed fixture inputs. App caller is being prepared for1.0.3 stable/dev and exact-source CI proof so release tags reuse genuine17-check PR validation instead of repeating unchanged full Windows suites. No further human-review request; keep original branch gates and truthful bounded waiver records.
Published and verified: stable v1.0.3 and dev v1.0.3-beta.1. Both public immutable releases include signed Setup.exe, MSI and portable ZIP downloads, update packages/feed, CycloneDX SBOM and SHA256SUMS.
Production runs 38410286325 and 38410289420 succeeded on main
a44449b991, using standards v1.2.1 at 70b555bd5658273090769991bfc4c9b6681dde18. Each of the eight actual downloaded assets has strict source/builder/tag provenance; all seven checksum entries verify. Native Authenticode publisher/trust/timestamp verification and exact shipped payload checks pass. Each MSI installed, opened the application, closed and uninstalled successfully in hosted Windows; downloaded MSI payloads also match the signed build. All 18 original branch requirements are restored and verified.Receipts: AppKit/artifacts/release-verification/v1.0.3/verified.json and v1.0.3-beta.1/verified.json. User README and installation guide link the actual downloads. Failed historical tags remain preserved. OpenSSF remains an honest 70% assessment; no passing badge is claimed.
Delivery is complete. Keep this issue open only for the broader MSI-specific update/restart, extension-registration/default-preservation and cross-channel coexistence acceptance requested in its original checklist. Existing EXE/shared application acceptance covers those behaviors, but the new MSI-specific evidence establishes installation, launch, normal close, uninstall, exact payloads and signatures; it does not independently prove every broader MSI scenario. This follow-up does not hold the published installers.