MSI: Add support for signing of installers by lrandersson · Pull Request #1224 · conda/constructor

lrandersson · 2026-04-24T15:42:15Z

Description

Adds code signing support for MSI installers built via Briefcase, reusing the existing EXE signing infrastructure.

Add sign() method to WindowsSignTool and AzureSignTool for direct file signing (post-build)
Extract signing tool initialization into create_signing_tool() factory to reduce duplication
Sign MSI after Briefcase builds it, using the same windows_signing_tool/signing_certificate config as EXE
Add signature verification to test_example_signing

Checklist - did you ...

Add a file to the news directory (using the template) for the next release's release notes?
Add / update necessary tests?
Add / update outdated documentation?

lrandersson · 2026-04-24T15:51:46Z

            certificate_file=certificate_file,
        )

+    def _get_signing_params(self):


About the changes in this file to simplify review: The new code is based on existing patterns, _get_signing_params() extracts the same environment variables already used in get_signing_command(), and sign() builds the same command structure but as a list for direct execution. The create_signing_tool() function is essentially the same logic that was already in winexe.py, just moved to reduce duplicated code, but reuses existing logic to enable MSI signing.

lrandersson · 2026-04-24T15:54:30Z

        CONSTRUCTOR_SIGNING_CERTIFICATE=str(cert_path),
        CONSTRUCTOR_PFX_CERTIFICATE_PASSWORD=cert_pwd,
    ):
+        _verify_windows_signature(installer)


I added this because I thought it was odd that this test was even passing before signing of installers was supported for MSI Installers. This example was already running for EXE and MSI installers before this PR, and passed for MSI due to lack of actual verification during the testing.

marcoesters · 2026-04-28T13:54:39Z

        outpath.unlink(missing_ok=True)
        shutil.move(msi_paths[0], outpath)
+
+        if signing_tool:


Should we sign before moving the installer out of the staging directory?

Good point I like that idea, 72d0414

marcoesters · 2026-04-28T14:13:01Z

            command += ' /p "%CONSTRUCTOR_PFX_CERTIFICATE_PASSWORD%"'
        return command

+    def sign(self, file_path: str | Path):


There is still some duplication here since get_signing_command is just the " ".join() on the list you're building inside sign()

Yeah this is with some code duplication but its kept intentionally because I tried to keep it simple, here get_signing_command and sign have very different requirements.
To unify them, we'd need some kind of helper function that returns the command as a list of tuples like (value, needs_escaping, is_env_reference). Then sign() would extract just the values, while get_signing_command() would iterate through, apply win_str_esc() where needs_escaping=True, and replace actual values with %VAR% syntax where is_env_reference=True. For context:

paths: sign() uses actual value, get_signing_command() needs win_str_esc(value)

password: sign() uses actual value, get_signing_command() emits "%ENV_VAR%" literal for NSIS to expand during runtime.
Most elements just need optional escaping, but password is fundamentally different.

I'm happy to do this refactoring if we are OK with the added complexity.

In that case, I think keeping them separate is good.

marcoesters · 2026-04-28T14:14:56Z

+            "tenant_id": os.environ.get("AZURE_SIGNTOOL_KEY_VAULT_TENANT_ID"),
+        }
+
+    def sign(self, file_path: str | Path):


Same here: get_signing_command and what you need for sign are just two different representations of the same data.

marcoesters · 2026-04-28T14:15:16Z

+
+
+def create_signing_tool(info: dict) -> SigningTool | None:
+    """Create a signing tool based on construct.yaml configuration.


Suggested change

"""Create a signing tool based on construct.yaml configuration.

"""Create a signing tool based on construct.yaml.

marcoesters · 2026-04-28T14:16:20Z

+        signing_tool = WindowsSignTool(certificate_file=info.get("signing_certificate"))
+    elif signing_tool_name == "azuresigntool":
+        signing_tool = AzureSignTool()
+    else:


This function seems to only cover Windows, but this file also contains macOS signing tools.

I renamed it to make it more clear 72d0414

lrandersson · 2026-04-29T13:30:30Z

@marcoesters I just added two more commits

1b2d01c - which wasn't enough
e7771ba
The reason for this is that the macos-latest, Python 3.12 was failing with a bizarre error and it seems that the latest runner system Python has been updated to Python 3.14, because the command pip install -e was failing. I don't know why (is it intentional) that we use system pip? The pip command was finding /Library/Frameworks/Python.framework/Versions/3.14/bin/pip first in PATH, even though the conda environment is activated.
With the above mentioned reason I explicitly now invoke pip via python (that hopefully is the python from the conda environment), then the second commit I guess we need ever since the update to conda-libmamba-solver with sharded repodata enabled as default (since we saw that pip was no longer included as a dependency).
The jobs are still running with these changes so there might be additional changes needed to make it work.

marcoesters · 2026-04-29T18:24:46Z

2. I don't know why (is it intentional) that we use system pip?

This is strange. The environment should have been activated (and it is, or conda install wouldn't have worked). Maybe it's the way setup-miniconda is used? There has been a major release recently.

lrandersson · 2026-04-29T18:30:44Z

This is strange. The environment should have been activated (and it is, or conda install wouldn't have worked). Maybe it's the way setup-miniconda is used? There has been a major release recently.

@marcoesters Im not sure, this branch is still pinned to the previous version conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0. It also only happened on the macos latest runner which is odd so I wonder if its just due to updates in the environment upstream.

lrandersson · 2026-05-01T11:37:14Z

@marcoesters this has also been rebased and I removed the python/pip specific commits after the rebase so it also needs a new approval.

* add signing of installers - work in progress * Review fixes: sign before move, docstring update, rename func

lrandersson self-assigned this Apr 24, 2026

conda-bot added this to 🔎 Review Apr 24, 2026

github-project-automation Bot moved this to 🆕 New in 🔎 Review Apr 24, 2026

conda-bot added the cla-signed [bot] added once the contributor has signed the CLA label Apr 24, 2026

lrandersson commented Apr 24, 2026

View reviewed changes

lrandersson force-pushed the briefcase-integration branch from 6173fcf to c9cb1bd Compare April 24, 2026 16:18

lrandersson force-pushed the dev-ra-822 branch from ee24073 to e643359 Compare April 24, 2026 16:43

lrandersson marked this pull request as ready for review April 24, 2026 19:13

lrandersson requested a review from a team as a code owner April 24, 2026 19:13

marcoesters reviewed Apr 28, 2026

View reviewed changes

lrandersson requested a review from marcoesters April 28, 2026 16:15

marcoesters approved these changes Apr 28, 2026

View reviewed changes

github-project-automation Bot moved this from 🆕 New to ✅ Approved in 🔎 Review Apr 28, 2026

lrandersson requested a review from marcoesters April 29, 2026 13:30

lrandersson mentioned this pull request Apr 29, 2026

Improved error handling of long paths for EXE installers #1228

Merged

3 tasks

lrandersson force-pushed the briefcase-integration branch from 0bc0fc6 to f0ec7b7 Compare May 1, 2026 09:52

lrandersson added 2 commits May 1, 2026 05:55

add signing of installers - work in progress

3690326

Review fixes: sign before move, docstring update, rename func

457b66c

lrandersson force-pushed the dev-ra-822 branch from e7771ba to 457b66c Compare May 1, 2026 09:56

marcoesters approved these changes May 1, 2026

View reviewed changes

lrandersson merged commit 7f2977e into conda:briefcase-integration May 1, 2026
20 checks passed

github-project-automation Bot moved this from ✅ Approved to 🏁 Done in 🔎 Review May 1, 2026

lrandersson added a commit to lrandersson/constructor that referenced this pull request May 28, 2026

MSI: Add support for signing of installers (conda#1224)

122f692

* add signing of installers - work in progress * Review fixes: sign before move, docstring update, rename func



		def create_signing_tool(info: dict) -> SigningTool \| None:
		"""Create a signing tool based on construct.yaml configuration.

Conversation

lrandersson commented Apr 24, 2026

Description

Checklist - did you ...

Uh oh!

lrandersson Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lrandersson commented Apr 29, 2026

Uh oh!

marcoesters commented Apr 29, 2026

Uh oh!

lrandersson commented Apr 29, 2026

Uh oh!

lrandersson commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lrandersson Apr 24, 2026 •

edited

Loading