Add Gpg4win as a Windows FMA

[kitzy]

Related issue: #50020

What this does

Adds Gpg4win as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed.

Why it was failing

Same root cause as GNU Privacy Guard (#50025) — Gpg4win bundles GnuPG. The install worked; the script never returned:

20:30:53  INFO  msg="Executing install script..." app=Gpg4win
20:40:53  ERROR msg="Error executing install script: exit status 1"   # exactly 10:00 later
20:40:53  INFO  msg="New application detected at: C:\Program Files\Gpg4win"

Ten minutes on the nose is the validator's executeScript timeout. Start-Process -Wait waits for the process and all of its descendants, and Gpg4win leaves gpg-agent, dirmngr, keyboxd and scdaemon resident (plus Kleopatra), so -Wait never returns. The same run left gpg4win-5.0.2.exe locked in the validator's temp dir, confirming a live child process.

The install script now follows the pattern already established by ollama_install.ps1: start with -PassThru (no -Wait), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry, then stop the leftovers.

The uninstall script stops those processes up front (they hold file locks that make the uninstall fail), uses NSIS's _?=<dir> switch so the uninstaller runs in place rather than relaunching itself detached from %TEMP%, and polls the ARP key to confirm removal.

Notes

• Versioned ARP name. The registry DisplayName is Gpg4win (5.0.2), so the input uses fuzzy_match_name and the exists query is name LIKE 'Gpg4win %'. The uninstall script matches the same prefix.
• x86-only installer. Publisher The Gpg4win Project.
• Ships a new catalog icon and website asset.

Checklist for submitter

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.
• Timeouts are implemented and retries are limited to avoid infinite loops

Testing

• FMA CI validator (install → detect → uninstall) passes on the SYSTEM-context Windows runner — run 30384125610 (All checks passed)
• Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, apps.json is valid JSON with a description filled in.
• QA'd all new/changed functionality manually

Summary by CodeRabbit

• New Features
  • Added Gpg4win as a supported Windows application.
  • Added Gpg4win version 5.0.2 with Security categorization.
  • Added a Gpg4win icon to the software interface.
  • Introduced silent install and uninstall support with process cleanup, timeouts, and registry-based verification to confirm install/removal outcomes.

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 68.03%. Comparing base (b64fdaa) to head (3ef175e).
⚠️ Report is 32 commits behind head on main.

Files with missing lines	Patch %	Lines
...nd/pages/SoftwarePage/components/icons/Gpg4Win.tsx	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50026      +/-   ##
==========================================
+ Coverage   67.97%   68.03%   +0.06%     
==========================================
  Files        3922     3930       +8     
  Lines      250032   250268     +236     
  Branches    13334    13270      -64     
==========================================
+ Hits       169949   170273     +324     
+ Misses      64781    64691      -90     
- Partials    15302    15304       +2     

Flag	Coverage Δ
frontend	60.88% <50.00%> (+0.47%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds Gpg4win as a Windows Fleet-maintained app (FMA), including install/uninstall scripts designed to avoid validator timeouts caused by lingering child processes, and adds a catalog icon + app metadata so it appears correctly in Fleet’s UI and FMA library.

Changes:

• Adds Winget input (gpg4win.json) and PowerShell install/uninstall scripts for Gpg4win.
• Adds generated FMA output manifest (outputs/gpg4win/windows.json) and registers the app in outputs/apps.json.
• Adds a new software catalog icon component and maps gpg4win to it.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
frontend/pages/SoftwarePage/components/icons/index.ts	Registers the Gpg4win icon in the software-name → icon map.
frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx	Adds the Gpg4win icon component.
ee/maintained-apps/inputs/winget/gpg4win.json	Adds Winget input metadata for the new Windows FMA.
ee/maintained-apps/inputs/winget/scripts/gpg4win_install.ps1	Adds install script with bounded wait and post-install registration polling.
ee/maintained-apps/inputs/winget/scripts/gpg4win_uninstall.ps1	Adds uninstall script with defensive UninstallString parsing and ARP polling.
ee/maintained-apps/outputs/gpg4win/windows.json	Adds the generated output manifest embedding scripts and queries.
ee/maintained-apps/outputs/apps.json	Adds the app entry to the maintained-apps catalog list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kitzy]

This is already handled — the finding looks to predate the current revision. .ExitCode is only read inside the else branch of if (-not $process.HasExited), so it's never touched while the process is alive; the timeout path logs and falls through to the registration check instead. Registration, not the exit code, is the success signal on that path, since a killed installer's code says nothing.

[kitzy]

The quoting concern doesn't reproduce: this exact form installs and uninstalls Gpg4win under C:\Program Files\Gpg4win in CI (run 30372747618), a path with a space. NSIS requires _?= to be the final argument, and the single-string form is what's been validated for this installer, so I'd rather not swap it for an unvalidated one — the misleading part of the comment is fixed.

See also the reply on #50025: the repo uses both the array and quoted forms, and some NSIS uninstallers reject _?= entirely (DBeaver exit 2, Logitech Unifying exit 10).

[kitzy]

Regenerated — the ref now carries the HKCU lookup and the publisher predicate. run 30372747618 passes. On the _?= quoting specifically, see the reply on the source script: it is validated against C:\Program Files\Gpg4win, which contains a space.

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/gpg4win/windows.json

=== Install // 1c9be45b -> d0e1cf40 ===

--- /tmp/old.OEnY2j	2026-07-28 00:31:15.471989366 +0000
+++ /tmp/new.xvvq5A	2026-07-28 00:31:15.471989366 +0000
@@ -3,21 +3,38 @@
 
 $exeFilePath = "${env:INSTALLER_PATH}"
 
-# Gpg4win bundles GnuPG, so the install starts the same resident daemons
-# (gpg-agent, dirmngr, keyboxd, scdaemon) and can leave Kleopatra running.
-# PowerShell's "Start-Process -Wait" waits for the process *and all of its
-# descendants*, so those keep the install script blocked indefinitely. Start
-# without -Wait, wait on the installer process itself with a timeout, then stop
-# the leftovers -- the same approach ollama_install.ps1 uses.
+# The Gpg4win installer process does not exit on its own on a headless machine,
+# and killing it is not enough: like GnuPG's installer (which it bundles), its
+# NSIS script writes the Add/Remove Programs entry in a late section, so an
+# installer stopped part-way leaves files on disk with no registry entry and
+# nothing for inventory to match.
+#
+# What stalls it is a modal dialog. The NSIS script has MessageBox calls with no
+# /SD default -- most relevantly the GpgEX shell-extension registration failure
+# ("regsvr32 /s gpgex.dll"), which is exactly the kind of thing that fails with no
+# interactive desktop. With nobody to click OK, the installer waits forever.
+#
+# So: leave the installer's children alone (killing regsvr32 would *guarantee*
+# that dialog), and instead close any window the installer puts up. Closing an
+# MB_OK dialog is equivalent to acknowledging it, and the install then runs on to
+# the section that writes the registry entry. Each poll also logs what is on
+# screen and which children are alive, so a future failure is diagnosable from
+# the CI log alone.
 $leftovers = @("gpg-agent", "dirmngr", "keyboxd", "scdaemon", "gpg-connect-agent", "gpgconf", "kleopatra", "gpgme-w32spawn")
-$installTimeoutSeconds = 300
-$registrationTimeoutSeconds = 120
+$installTimeoutSeconds = 420
+$pollSeconds = 10
+# Let the installer get on with it before we start closing windows, so a dialog
+# that is genuinely transient isn't dismissed prematurely.
+$graceSeconds = 30
 
 $machineKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $machineKey32on64 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
+# The uninstall info is written with SHCTX, so check the per-user hive too in case
+# the installer resolves to current-user mode.
+$userKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 
 function Test-Gpg4winRegistered {
-    $null -ne (Get-ChildItem -Path @($machineKey, $machineKey32on64) -ErrorAction SilentlyContinue |
+    $null -ne (Get-ChildItem -Path @($machineKey, $machineKey32on64, $userKey) -ErrorAction SilentlyContinue |
         ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |
         Where-Object { $_.DisplayName -like "Gpg4win*" } |
         Select-Object -First 1)
@@ -31,22 +48,32 @@
 # Start-Process -PassThru otherwise returns $null for .ExitCode.
 $null = $process.Handle
 
-if (-not $process.WaitForExit($installTimeoutSeconds * 1000)) {
-  Write-Host "Installer process did not exit within ${installTimeoutSeconds}s, stopping it."
-  Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue
-  Start-Sleep -Seconds 2
+$elapsed = 0
+while (-not $process.HasExited -and ($elapsed -lt $installTimeoutSeconds)) {
+  Start-Sleep -Seconds $pollSeconds
+  $elapsed += $pollSeconds
+  $process.Refresh()
+  if ($process.HasExited) { break }
+
+  $children = @(Get-Process -Name $leftovers -ErrorAction SilentlyContinue |
+    Select-Object -ExpandProperty Name -Unique)
+  $windowTitle = ""
+  try { $windowTitle = $process.MainWindowTitle } catch { }
+
+  Write-Host "Installing... ($elapsed seconds, registered: $(Test-Gpg4winRegistered), window: '$windowTitle', children: $($children -join ', '))"
+
+  if ($elapsed -ge $graceSeconds -and $process.MainWindowHandle -ne [IntPtr]::Zero) {
+    Write-Host "Installer is showing a window ('$windowTitle'); closing it so the install can continue."
+    $null = $process.CloseMainWindow()
+  }
 }
 
-$exitCode = $process.ExitCode
-Write-Host "Install exit code: $exitCode"
-
-# The installer can return before the Add/Remove Programs entry is written; wait
-# for it so software inventory sees a complete install.
-$elapsed = 0
-while (-not (Test-Gpg4winRegistered) -and ($elapsed -lt $registrationTimeoutSeconds)) {
-  Start-Sleep -Seconds 5
-  $elapsed += 5
-  Write-Host "Waiting for Gpg4win to register... ($elapsed seconds)"
+if (-not $process.HasExited) {
+  Write-Host "Installer still running after ${installTimeoutSeconds}s; stopping it."
+  Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue
+  Start-Sleep -Seconds 2
+} else {
+  Write-Host "Install exit code: $($process.ExitCode)"
 }
 
 # Stop the resident processes the installer started. Leaving them running holds
@@ -55,15 +82,15 @@
   Stop-Process -Name $name -Force -ErrorAction SilentlyContinue
 }
 
+# Registration is the success signal, not the exit code: on the timeout path the
+# installer was killed, so its exit code says nothing about the install.
 if (-not (Test-Gpg4winRegistered)) {
   Write-Host "Gpg4win did not register in Add/Remove Programs."
   Exit 1
 }
 
-# 3010 (reboot required) and 1641 (reboot initiated) are successful installs.
-if ($exitCode -eq 3010 -or $exitCode -eq 1641) { Exit 0 }
-
-Exit $exitCode
+Write-Host "Gpg4win is registered in Add/Remove Programs."
+Exit 0
 
 } catch {
   Write-Host "Error: $_"

=== Uninstall Script (no changes) ===

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

[kitzy]

Good catch — fixed the same way as #50025. The lookup now covers HKCU and HKCU\Wow6432Node as well as HKLM.

I also added the publisher predicate here, and this one earned its keep: The Gpg4win Project is the winget package publisher — precisely the class of value that was wrong for Spyder in #50016 — and it couldn't be confirmed statically (the PE resource says g10 Code GmbH, and the NSIS script that writes the real value is compressed). CI now proves it: run 30372747618 finds Gpg4win (5.0.2) with that publisher and removes it. On a miss the script logs every Gpg4win entry with its actual publisher, so a future mismatch is answered in one run.

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/gpg4win/windows.json

=== Install // d0e1cf40 -> 29b7fd7f ===

--- /tmp/old.MMONWa	2026-07-28 01:04:19.615675269 +0000
+++ /tmp/new.ctnl3C	2026-07-28 01:04:19.615675269 +0000
@@ -33,6 +33,25 @@
 # the installer resolves to current-user mode.
 $userKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 
+# Collect the installer process and everything descended from it, so a dialog
+# owned by a child (rather than the installer itself) is still visible to us.
+function Get-InstallerTree([int]$rootId) {
+    $all = @{}
+    Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
+        ForEach-Object { $all[[int]$_.ProcessId] = [int]$_.ParentProcessId }
+
+    $ids = New-Object System.Collections.Generic.HashSet[int]
+    $null = $ids.Add($rootId)
+    # Walk down a bounded number of generations; the tree here is shallow.
+    for ($depth = 0; $depth -lt 5; $depth++) {
+        foreach ($procId in @($all.Keys)) {
+            if ($ids.Contains($all[$procId])) { $null = $ids.Add($procId) }
+        }
+    }
+
+    Get-Process -ErrorAction SilentlyContinue | Where-Object { $ids.Contains($_.Id) }
+}
+
 function Test-Gpg4winRegistered {
     $null -ne (Get-ChildItem -Path @($machineKey, $machineKey32on64, $userKey) -ErrorAction SilentlyContinue |
         ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |
@@ -55,16 +74,26 @@
   $process.Refresh()
   if ($process.HasExited) { break }
 
-  $children = @(Get-Process -Name $leftovers -ErrorAction SilentlyContinue |
-    Select-Object -ExpandProperty Name -Unique)
+  # Look at the whole process tree, not just the installer: the previous attempt
+  # showed the installer itself never owns a window, so whatever is waiting for a
+  # click belongs to a child it spawned (regsvr32 registering the GpgEX shell
+  # extension is the likely one).
+  $tree = Get-InstallerTree $process.Id
+  $names = @($tree | Select-Object -ExpandProperty ProcessName -Unique)
   $windowTitle = ""
   try { $windowTitle = $process.MainWindowTitle } catch { }
+  $childWindows = @($tree | Where-Object { $_.MainWindowHandle -ne [IntPtr]::Zero } |
+    ForEach-Object { "$($_.ProcessName): '$($_.MainWindowTitle)'" })
 
-  Write-Host "Installing... ($elapsed seconds, registered: $(Test-Gpg4winRegistered), window: '$windowTitle', children: $($children -join ', '))"
+  Write-Host "Installing... ($elapsed seconds, registered: $(Test-Gpg4winRegistered), window: '$windowTitle', tree: $($names -join ', '), child windows: $($childWindows -join ' | '))"
 
-  if ($elapsed -ge $graceSeconds -and $process.MainWindowHandle -ne [IntPtr]::Zero) {
-    Write-Host "Installer is showing a window ('$windowTitle'); closing it so the install can continue."
-    $null = $process.CloseMainWindow()
+  if ($elapsed -ge $graceSeconds) {
+    foreach ($p in $tree) {
+      if ($p.MainWindowHandle -ne [IntPtr]::Zero) {
+        Write-Host "Closing window owned by $($p.ProcessName) ('$($p.MainWindowTitle)') so the install can continue."
+        $null = $p.CloseMainWindow()
+      }
+    }
   }
 }
 

=== Uninstall Script (no changes) ===

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

ee/maintained-apps/inputs/winget/scripts/gpg4win_uninstall.ps1:17

• Uninstall key lookup only checks HKLM (both native + Wow6432Node), but the install script explicitly notes the installer may resolve to current-user mode and checks HKCU. If Gpg4win registers in HKCU, this uninstall will fail to find the uninstaller and will incorrectly report that the app is still registered at the end.

$machineKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
$machineKey32on64 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
$exitCode = 0

function Get-Gpg4winUninstallKey {

ee/maintained-apps/inputs/winget/scripts/gpg4win_uninstall.ps1:55

• Building $uninstallArgs as a single unquoted string will be split on spaces (e.g. "C:\Program Files (x86)...") and can break the NSIS _?= argument. Passing arguments as separate elements avoids whitespace-splitting while still keeping _?= as the final argument.

    # "_?=<dir>" runs it in place instead, which makes it synchronous. It must be
    # the last argument and must not be quoted, so pass one argument string rather
    # than an array (PowerShell would quote an element containing spaces).
    $installDir = Split-Path -Parent $uninstallCommand
    $uninstallArgs = "/S _?=$installDir"

[kitzy]

You're right, the description was stale after the rewrite — fixed. The cap is 420s, and the description now says so and notes it sits below the caller's 10-minute script budget.

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/gpg4win/windows.json

=== Install Script (no changes) ===
=== Uninstall // 969aeebd -> 9375da9a ===

--- /tmp/old.przUbs	2026-07-28 15:21:17.910396044 +0000
+++ /tmp/new.2Usw2I	2026-07-28 15:21:17.910396044 +0000
@@ -1,6 +1,19 @@
 # The registry DisplayName carries a parenthesised version ("Gpg4win (5.0.2)"),
 # so match on a prefix rather than an exact string.
 $softwareName = "Gpg4win"
+# Require the publisher too, mirroring the manifest's exists query. This puts the
+# value under test: the validator's appExists looks up by name only, so a wrong
+# exists-query publisher would otherwise ship a manifest that can never match an
+# install (cf. the Spyder finding in #50016).
+#
+# This one is the least certain in the batch. "The Gpg4win Project" comes from the
+# winget locale manifest -- a *package* publisher, which is exactly the kind of
+# value that was wrong for Spyder -- and it could not be confirmed statically: the
+# installer's PE version resource says "g10 Code GmbH", and the NSIS script that
+# writes the real value is compressed. If it is wrong the uninstall below finds
+# nothing, and the diagnostic prints the Gpg4win entries actually present with
+# their publishers, so a single CI run settles it.
+$softwarePublisher = "The Gpg4win Project"
 
 # Gpg4win bundles GnuPG, so the same daemons stay resident (gpg-agent, dirmngr,
 # keyboxd, scdaemon) along with Kleopatra. They hold file locks that make the
@@ -12,15 +25,34 @@
 
 $machineKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $machineKey32on64 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
+# The uninstall info is written with SHCTX, so it can land in the per-user hive.
+# The install script already accounts for that; mirror it here.
+$userKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
+$userKey32on64 = 'HKCU:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $exitCode = 0
 
+$allKeys = @($machineKey, $machineKey32on64, $userKey, $userKey32on64)
+
 function Get-Gpg4winUninstallKey {
-    Get-ChildItem -Path @($machineKey, $machineKey32on64) -ErrorAction SilentlyContinue |
+    Get-ChildItem -Path $allKeys -ErrorAction SilentlyContinue |
         ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |
-        Where-Object { $_.DisplayName -like "$softwareName*" } |
+        Where-Object { $_.DisplayName -like "$softwareName*" -and $_.Publisher -eq $softwarePublisher } |
         Select-Object -First 1
 }
 
+# Print every Gpg4win-ish entry with its publisher, so a publisher mismatch names
+# the correct value instead of just failing.
+function Write-Gpg4winCandidates {
+    Write-Host "Registry entries matching '$softwareName*':"
+    $found = Get-ChildItem -Path $allKeys -ErrorAction SilentlyContinue |
+        ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |
+        Where-Object { $_.DisplayName -like "$softwareName*" }
+    if (-not $found) { Write-Host "  (none)" ; return }
+    foreach ($f in $found) {
+        Write-Host "  DisplayName='$($f.DisplayName)' Publisher='$($f.Publisher)' Version='$($f.DisplayVersion)'"
+    }
+}
+
 foreach ($name in $leftovers) {
     Stop-Process -Name $name -Force -ErrorAction SilentlyContinue
 }
@@ -28,8 +60,12 @@
 try {
     $key = Get-Gpg4winUninstallKey
     if (-not $key) {
-        Write-Host "Uninstaller for '$softwareName' not found."
-        Exit 1
+        Write-Gpg4winCandidates
+        # Nothing to remove is not a failure: uninstall scripts are idempotent here,
+        # as in nordpass_uninstall.ps1 and windsurf_uninstall.ps1. If the app *is*
+        # still installed the validator's own post-uninstall check catches it.
+        Write-Host "Uninstall entry not found for '$softwareName' with publisher '$softwarePublisher'."
+        Exit 0
     }
 
     $uninstallString = if ($key.QuietUninstallString) { $key.QuietUninstallString } else { $key.UninstallString }
@@ -48,9 +84,12 @@
 
     # NSIS uninstallers copy themselves to %TEMP% and relaunch by default, so the
     # process we start exits immediately while the real uninstall runs detached.
-    # "_?=<dir>" runs it in place instead, which makes it synchronous. It must be
-    # the last argument and must not be quoted, so pass one argument string rather
-    # than an array (PowerShell would quote an element containing spaces).
+    # "_?=<dir>" runs it in place instead, which makes it synchronous, and it has
+    # to be the last argument. Other scripts here pass it as its own ArgumentList
+    # element (bdash, binance, canva) or quoted (android_studio); this passes one
+    # argument string, which is what was validated in CI for this installer. Note
+    # not every NSIS uninstaller accepts it -- DBeaver's returns exit 2 and
+    # Logitech Unifying's exit 10, so both of those omit it.
     $installDir = Split-Path -Parent $uninstallCommand
     $uninstallArgs = "/S _?=$installDir"
 
@@ -88,6 +127,7 @@
 }
 
 if (Get-Gpg4winUninstallKey) {
+    Write-Gpg4winCandidates
     Write-Host "'$softwareName' is still registered after the uninstall."
     Exit 1
 }

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

[coderabbitai]

Walkthrough

Adds Gpg4win as a maintained Windows application with package metadata, a version 5.0.2 manifest, unattended PowerShell install and uninstall workflows, registry-based lifecycle validation, catalog output, and a frontend icon mapping.

Possibly related PRs

• fleetdm/fleet#49923: Updates the frontend software icon registry with additional application mappings.
• fleetdm/fleet#50016: Extends the frontend software icon registry with application-specific mappings.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary change: adding Gpg4win as a Windows Fleet-maintained app.
Description check	✅ Passed	The description explains the change, failure cause, implementation, related issue, validation, testing, and manual QA.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-gpg4win-windows-fma

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx (1)

6-10: 🚀 Performance & Scalability | 🔵 Trivial | 🏗️ Heavy lift

Replace the large embedded PNG with a bundled asset.

Gpg4Win.tsx is roughly 18 MB because of the data:image/png;base64,... payload inside a statically imported icon. Move this to an optimized static asset/SVG referenced via import, following the repository’s icon pipeline, to prevent this large payload from inflating the frontend JavaScript bundle.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx` around lines 6 -
10, Replace the base64 PNG payload in the Gpg4Win SVG image with an optimized
bundled asset or repository-standard SVG icon import. Update the Gpg4Win
component’s image reference while preserving its 32×32 rendering and existing
props behavior, ensuring the large inline data URI is removed from the frontend
bundle.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/inputs/winget/scripts/gpg4win_uninstall.ps1`:
- Around line 129-135: Update the final exit behavior after the
Get-Gpg4winUninstallKey check so a confirmed registry removal exits with success
code 0 rather than the raw $exitCode; preserve Exit 1 when the uninstall
registration remains present.

In `@ee/maintained-apps/outputs/gpg4win/windows.json`:
- Line 19: Update Test-Gpg4winRegistered to validate the same Gpg4win identity
used by the catalog, exists query, and uninstall logic: require both a matching
Gpg4win display name and publisher “The Gpg4win Project.” Keep the existing
registry hive checks and return behavior unchanged.

In `@frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx`:
- Around line 6-10: Add a viewBox attribute of “0 0 32 32” to the root svg
element in Gpg4Win while preserving its existing fixed width and height and
embedded image attributes.

---

Nitpick comments:
In `@frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx`:
- Around line 6-10: Replace the base64 PNG payload in the Gpg4Win SVG image with
an optimized bundled asset or repository-standard SVG icon import. Update the
Gpg4Win component’s image reference while preserving its 32×32 rendering and
existing props behavior, ensuring the large inline data URI is removed from the
frontend bundle.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c2b26457-e4bf-4144-8c93-0fa2b7cbff02

📥 Commits

Reviewing files that changed from the base of the PR and between b64fdaa and f849057.

⛔ Files ignored due to path filters (1)

• website/assets/images/app-icon-gpg4win-60x60@2x.png is excluded by !**/*.png

📒 Files selected for processing (7)

• ee/maintained-apps/inputs/winget/gpg4win.json
• ee/maintained-apps/inputs/winget/scripts/gpg4win_install.ps1
• ee/maintained-apps/inputs/winget/scripts/gpg4win_uninstall.ps1
• ee/maintained-apps/outputs/apps.json
• ee/maintained-apps/outputs/gpg4win/windows.json
• frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx
• frontend/pages/SoftwarePage/components/icons/index.ts

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Final Exit $exitCode undermines the registry-based success check it just performed.

By the time execution reaches line 135, the preceding poll (lines 122-127) has already confirmed the uninstall entry is gone — that's the success signal, per this same file's own reasoning and the install script's stated philosophy ("Registration is the success signal, not the exit code"). Yet this line exits with the raw NSIS process exit code instead of 0. If Gpg4win's uninstaller ever returns a benign nonzero code on success (as this file itself notes DBeaver and Logitech Unifying do for their NSIS uninstallers), a fully successful, registry-confirmed removal will still be reported as a failure.

🐛 Proposed fix

 if (Get-Gpg4winUninstallKey) {
     Write-Gpg4winCandidates
     Write-Host "'$softwareName' is still registered after the uninstall."
     Exit 1
 }

-Exit $exitCode
+# Registry state already confirms removal succeeded; don't fail on a benign
+# nonzero exit code from the uninstaller (cf. the DBeaver/Logitech notes above).
+Write-Host "Uninstall exit code was $exitCode; registry confirms removal succeeded."
+Exit 0

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (Get-Gpg4winUninstallKey) {
	Write-Gpg4winCandidates
	Write-Host "'$softwareName' is still registered after the uninstall."
	Exit 1
	}
	Exit $exitCode
	if (Get-Gpg4winUninstallKey) {
	Write-Gpg4winCandidates
	Write-Host "'$softwareName' is still registered after the uninstall."
	Exit 1
	}
	# Registry state already confirms removal succeeded; don't fail on a benign
	# nonzero exit code from the uninstaller (cf. the DBeaver/Logitech notes above).
	Write-Host "Uninstall exit code was $exitCode; registry confirms removal succeeded."
	Exit 0

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/inputs/winget/scripts/gpg4win_uninstall.ps1` around lines
129 - 135, Update the final exit behavior after the Get-Gpg4winUninstallKey
check so a confirmed registry removal exits with success code 0 rather than the
raw $exitCode; preserve Exit 1 when the uninstall registration remains present.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Align install success validation with the catalog identity.

Test-Gpg4winRegistered matches only DisplayName -like "Gpg4win*", while ee/maintained-apps/inputs/winget/gpg4win.json Line [7], this file’s exists query at Line [6], and the uninstall script require publisher The Gpg4win Project. A stale or mismatched ARP entry can therefore make installation return success without registering the target app identity.

Proposed fix

+ $softwarePublisher = "The Gpg4win Project"
...
-        Where-Object { $_.DisplayName -like "Gpg4win*" } |
+        Where-Object { $_.DisplayName -like "Gpg4win*" -and $_.Publisher -eq $softwarePublisher } |

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	"29b7fd7f": "# Learn more about .exe install scripts:\n# http://fleetdm.com/learn-more-about/exe-install-scripts\n\n$exeFilePath = \"${env:INSTALLER_PATH}\"\n\n# The Gpg4win installer process does not exit on its own on a headless machine,\n# and killing it is not enough: like GnuPG's installer (which it bundles), its\n# NSIS script writes the Add/Remove Programs entry in a late section, so an\n# installer stopped part-way leaves files on disk with no registry entry and\n# nothing for inventory to match.\n#\n# What stalls it is a modal dialog. The NSIS script has MessageBox calls with no\n# /SD default -- most relevantly the GpgEX shell-extension registration failure\n# (\"regsvr32 /s gpgex.dll\"), which is exactly the kind of thing that fails with no\n# interactive desktop. With nobody to click OK, the installer waits forever.\n#\n# So: leave the installer's children alone (killing regsvr32 would *guarantee*\n# that dialog), and instead close any window the installer puts up. Closing an\n# MB_OK dialog is equivalent to acknowledging it, and the install then runs on to\n# the section that writes the registry entry. Each poll also logs what is on\n# screen and which children are alive, so a future failure is diagnosable from\n# the CI log alone.\n$leftovers = @(\"gpg-agent\", \"dirmngr\", \"keyboxd\", \"scdaemon\", \"gpg-connect-agent\", \"gpgconf\", \"kleopatra\", \"gpgme-w32spawn\")\n$installTimeoutSeconds = 420\n$pollSeconds = 10\n# Let the installer get on with it before we start closing windows, so a dialog\n# that is genuinely transient isn't dismissed prematurely.\n$graceSeconds = 30\n\n$machineKey = 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n$machineKey32on64 = 'HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n# The uninstall info is written with SHCTX, so check the per-user hive too in case\n# the installer resolves to current-user mode.\n$userKey = 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n\n# Collect the installer process and everything descended from it, so a dialog\n# owned by a child (rather than the installer itself) is still visible to us.\nfunction Get-InstallerTree([int]$rootId) {\n $all = @{}\n Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |\n ForEach-Object { $all[[int]$_.ProcessId] = [int]$_.ParentProcessId }\n\n $ids = New-Object System.Collections.Generic.HashSet[int]\n $null = $ids.Add($rootId)\n # Walk down a bounded number of generations; the tree here is shallow.\n for ($depth = 0; $depth -lt 5; $depth++) {\n foreach ($procId in @($all.Keys)) {\n if ($ids.Contains($all[$procId])) { $null = $ids.Add($procId) }\n }\n }\n\n Get-Process -ErrorAction SilentlyContinue | Where-Object { $ids.Contains($_.Id) }\n}\n\nfunction Test-Gpg4winRegistered {\n $null -ne (Get-ChildItem -Path @($machineKey, $machineKey32on64, $userKey) -ErrorAction SilentlyContinue |\n ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |\n Where-Object { $_.DisplayName -like \"Gpg4win*\" } |\n Select-Object -First 1)\n}\n\ntry {\n\n# Gpg4win uses an NSIS installer.\n$process = Start-Process -FilePath \"$exeFilePath\" -ArgumentList \"/S\" -PassThru\n# Touch .Handle so the exit code is still readable after the process ends:\n# Start-Process -PassThru otherwise returns $null for .ExitCode.\n$null = $process.Handle\n\n$elapsed = 0\nwhile (-not $process.HasExited -and ($elapsed -lt $installTimeoutSeconds)) {\n Start-Sleep -Seconds $pollSeconds\n $elapsed += $pollSeconds\n $process.Refresh()\n if ($process.HasExited) { break }\n\n # Look at the whole process tree, not just the installer: the previous attempt\n # showed the installer itself never owns a window, so whatever is waiting for a\n # click belongs to a child it spawned (regsvr32 registering the GpgEX shell\n # extension is the likely one).\n $tree = Get-InstallerTree $process.Id\n $names = @($tree | Select-Object -ExpandProperty ProcessName -Unique)\n $windowTitle = \"\"\n try { $windowTitle = $process.MainWindowTitle } catch { }\n $childWindows = @($tree | Where-Object { $_.MainWindowHandle -ne [IntPtr]::Zero } |\n ForEach-Object { \"$($_.ProcessName): '$($_.MainWindowTitle)'\" })\n\n Write-Host \"Installing... ($elapsed seconds, registered: $(Test-Gpg4winRegistered), window: '$windowTitle', tree: $($names -join ', '), child windows: $($childWindows -join ' | '))\"\n\n if ($elapsed -ge $graceSeconds) {\n foreach ($p in $tree) {\n if ($p.MainWindowHandle -ne [IntPtr]::Zero) {\n Write-Host \"Closing window owned by $($p.ProcessName) ('$($p.MainWindowTitle)') so the install can continue.\"\n $null = $p.CloseMainWindow()\n }\n }\n }\n}\n\nif (-not $process.HasExited) {\n Write-Host \"Installer still running after ${installTimeoutSeconds}s; stopping it.\"\n Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue\n Start-Sleep -Seconds 2\n} else {\n Write-Host \"Install exit code: $($process.ExitCode)\"\n}\n\n# Stop the resident processes the installer started. Leaving them running holds\n# file locks that make a later uninstall fail.\nforeach ($name in $leftovers) {\n Stop-Process -Name $name -Force -ErrorAction SilentlyContinue\n}\n\n# Registration is the success signal, not the exit code: on the timeout path the\n# installer was killed, so its exit code says nothing about the install.\nif (-not (Test-Gpg4winRegistered)) {\n Write-Host \"Gpg4win did not register in Add/Remove Programs.\"\n Exit 1\n}\n\nWrite-Host \"Gpg4win is registered in Add/Remove Programs.\"\nExit 0\n\n} catch {\n Write-Host \"Error: $_\"\n Exit 1\n}\n",
	$leftovers = @("gpg-agent", "dirmngr", "keyboxd", "scdaemon", "gpg-connect-agent", "gpgconf", "kleopatra", "gpgme-w32spawn")
	$installTimeoutSeconds = 420
	$pollSeconds = 10
	# Let the installer get on with it before we start closing windows, so a dialog
	# that is genuinely transient isn't dismissed prematurely.
	$graceSeconds = 30
	$softwarePublisher = "The Gpg4win Project"
	$machineKey = 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'
	$machineKey32on64 = 'HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'
	# The uninstall info is written with SHCTX, so check the per-user hive too in case
	# the installer resolves to current-user mode.
	$userKey = 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'
	# Collect the installer process and everything descended from it, so a dialog
	# owned by a child (rather than the installer itself) is still visible to us.
	function Get-InstallerTree([int]$rootId) {
	$all = @{}
	Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
	ForEach-Object { $all[[int]$_.ProcessId] = [int]$_.ParentProcessId }
	$ids = New-Object System.Collections.Generic.HashSet[int]
	$null = $ids.Add($rootId)
	# Walk down a bounded number of generations; the tree here is shallow.
	for ($depth = 0; $depth -lt 5; $depth++) {
	foreach ($procId in @($all.Keys)) {
	if ($ids.Contains($all[$procId])) { $null = $ids.Add($procId) }
	}
	}
	Get-Process -ErrorAction SilentlyContinue | Where-Object { $ids.Contains($_.Id) }
	}
	function Test-Gpg4winRegistered {
	$null -ne (Get-ChildItem -Path @($machineKey, $machineKey32on64, $userKey) -ErrorAction SilentlyContinue |
	ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |
	Where-Object { $_.DisplayName -like "Gpg4win*" -and $_.Publisher -eq $softwarePublisher } |
	Select-Object -First 1)
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/gpg4win/windows.json` at line 19, Update
Test-Gpg4winRegistered to validate the same Gpg4win identity used by the
catalog, exists query, and uninstall logic: require both a matching Gpg4win
display name and publisher “The Gpg4win Project.” Keep the existing registry
hive checks and return behavior unchanged.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Locate file =="
fd -a 'Gpg4Win\.tsx$' . || true

echo "== Inspect candidate file =="
file="$(fd 'Gpg4Win\.tsx$' . | head -n1)"
if [ -n "$file" ]; then
  wc -l "$file"
  cat -n "$file"
fi

echo "== Search SVG icon patterns for viewBox/image usage =="
rg -n "<svg|viewBox|<image|href=\"data:image" frontend/pages/SoftwarePage/components/icons -S || true

Repository: fleetdm/fleet

Length of output: 50370

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file="$(fd 'Gpg4Win\.tsx$' . | head -n1 || true)"
if [ -z "$file" ]; then
  echo "Gpg4Win.tsx not found"
  exit 0
fi

echo "== file location and line count =="
echo "$file"
wc -l "$file"

echo "== first 20 lines with line numbers =="
sed -n '1,20p' "$file" | cat -n

echo "== nearby SVG/image attributes in surrounding icon files without expanding embedded data =="
python3 - <<'PY'
import pathlib, re, sys
root = pathlib.Path('frontend/pages/SoftwarePage/components/icons')
for p in sorted(root.glob('*.tsx')):
    text = p.read_text(errors='ignore')
    match = re.search(r'<svg[^>]+>|<image\s+([^>]*)>', text[:500], re.S)
    if not match:
        continue
    start=line_match=index_match=match.start()
    line= text[:start].count("\n")+1
    # print only SVG/image tag, not full base64 by trimming href body
    tag = match.group(0)
    if "<image" in tag:
        tag = re.sub(r'href="([^"]*)"', lambda m: r'href="...base64..."' if len(m.group(1))>80 else m.group(0), tag)
    print(f"{p}:{line}: {tag[:300]}")
PY

echo "== SVG/viewBox/image occurrences in this file =="
python3 - <<'PY'
import pathlib, re
p = pathlib.Path('frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx')
text = p.read_text()
for i,line in enumerate(text.splitlines(),1):
    if re.search(r'<svg|<image|viewBox', line):
        print(f"{i}: {line.strip()}")
PY

Repository: fleetdm/fleet

Length of output: 50370

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Gpg4Win.tsx svg/image/search for viewBox =="
wc -l frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx
sed -n '1,20p' frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx | cat -n
rg -n '<svg|<image|viewBox' frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx -S

echo "== base64 image dimensions in Gpg4Win.tsx XML header =="
python3 - <<'PY'
import base64, re, pathlib, io
p= pathlib.Path('frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx')
text = p.read_text()
m = re.search(r'href="data:image/png;base64,([^"]+)"', text, re.S)
payload = base64.b64decode(m.group(1))
print("payload_size", len(payload))
png_struct = payload[:8]
if png_struct == b'\x89PNG\r\n\x1a\n':
    print("recognized_png")
print("first_512bytes", payload[:512])
PY

Repository: fleetdm/fleet

Length of output: 16640

---

Preserve the icon coordinate system when resizing.

Callers can override width and height, but Gpg4Win has no viewBox while the embedded image has a 128×128 viewBox inside a 32×32 presentation box. Adding viewBox="0 0 32 32" makes the root SVG viewBox-match the intended icon box without changing the fixed 32×32 rendering.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/pages/SoftwarePage/components/icons/Gpg4Win.tsx` around lines 6 -
10, Add a viewBox attribute of “0 0 32 32” to the root svg element in Gpg4Win
while preserving its existing fixed width and height and embedded image
attributes.

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/gpg4win/windows.json

=== Install // 29b7fd7f -> 33dd6930 ===

--- /tmp/old.Y9tqhH	2026-07-28 17:44:00.908326055 +0000
+++ /tmp/new.NpQmn2	2026-07-28 17:44:00.908326055 +0000
@@ -3,38 +3,21 @@
 
 $exeFilePath = "${env:INSTALLER_PATH}"
 
-# The Gpg4win installer process does not exit on its own on a headless machine,
-# and killing it is not enough: like GnuPG's installer (which it bundles), its
-# NSIS script writes the Add/Remove Programs entry in a late section, so an
-# installer stopped part-way leaves files on disk with no registry entry and
-# nothing for inventory to match.
-#
-# What stalls it is a modal dialog. The NSIS script has MessageBox calls with no
-# /SD default -- most relevantly the GpgEX shell-extension registration failure
-# ("regsvr32 /s gpgex.dll"), which is exactly the kind of thing that fails with no
-# interactive desktop. With nobody to click OK, the installer waits forever.
-#
-# So: leave the installer's children alone (killing regsvr32 would *guarantee*
-# that dialog), and instead close any window the installer puts up. Closing an
-# MB_OK dialog is equivalent to acknowledging it, and the install then runs on to
-# the section that writes the registry entry. Each poll also logs what is on
-# screen and which children are alive, so a future failure is diagnosable from
-# the CI log alone.
+# The installer stalls on a modal dialog with no interactive desktop and never
+# exits. Closing the window lets it run through to the section that writes the
+# Add/Remove Programs entry; killing it instead would leave a partial install.
+# The dialog belongs to a child process, so search the whole tree.
 $leftovers = @("gpg-agent", "dirmngr", "keyboxd", "scdaemon", "gpg-connect-agent", "gpgconf", "kleopatra", "gpgme-w32spawn")
 $installTimeoutSeconds = 420
 $pollSeconds = 10
-# Let the installer get on with it before we start closing windows, so a dialog
-# that is genuinely transient isn't dismissed prematurely.
 $graceSeconds = 30
 
 $machineKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $machineKey32on64 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
-# The uninstall info is written with SHCTX, so check the per-user hive too in case
-# the installer resolves to current-user mode.
+# Uninstall info is written with SHCTX, so it can land per-user.
 $userKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 
-# Collect the installer process and everything descended from it, so a dialog
-# owned by a child (rather than the installer itself) is still visible to us.
+# The installer process plus its descendants.
 function Get-InstallerTree([int]$rootId) {
     $all = @{}
     Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
@@ -42,7 +25,6 @@
 
     $ids = New-Object System.Collections.Generic.HashSet[int]
     $null = $ids.Add($rootId)
-    # Walk down a bounded number of generations; the tree here is shallow.
     for ($depth = 0; $depth -lt 5; $depth++) {
         foreach ($procId in @($all.Keys)) {
             if ($ids.Contains($all[$procId])) { $null = $ids.Add($procId) }
@@ -61,10 +43,8 @@
 
 try {
 
-# Gpg4win uses an NSIS installer.
 $process = Start-Process -FilePath "$exeFilePath" -ArgumentList "/S" -PassThru
-# Touch .Handle so the exit code is still readable after the process ends:
-# Start-Process -PassThru otherwise returns $null for .ExitCode.
+# Keeps .ExitCode readable after the process ends.
 $null = $process.Handle
 
 $elapsed = 0
@@ -74,10 +54,6 @@
   $process.Refresh()
   if ($process.HasExited) { break }
 
-  # Look at the whole process tree, not just the installer: the previous attempt
-  # showed the installer itself never owns a window, so whatever is waiting for a
-  # click belongs to a child it spawned (regsvr32 registering the GpgEX shell
-  # extension is the likely one).
   $tree = Get-InstallerTree $process.Id
   $names = @($tree | Select-Object -ExpandProperty ProcessName -Unique)
   $windowTitle = ""
@@ -105,14 +81,12 @@
   Write-Host "Install exit code: $($process.ExitCode)"
 }
 
-# Stop the resident processes the installer started. Leaving them running holds
-# file locks that make a later uninstall fail.
+# Stop resident processes; they hold file locks the uninstall needs released.
 foreach ($name in $leftovers) {
   Stop-Process -Name $name -Force -ErrorAction SilentlyContinue
 }
 
-# Registration is the success signal, not the exit code: on the timeout path the
-# installer was killed, so its exit code says nothing about the install.
+# Registration is the success signal: a killed installer's exit code says nothing.
 if (-not (Test-Gpg4winRegistered)) {
   Write-Host "Gpg4win did not register in Add/Remove Programs."
   Exit 1

=== Uninstall // 9375da9a -> 5b342b42 ===

--- /tmp/old.CxCdf5	2026-07-28 17:44:00.935325868 +0000
+++ /tmp/new.ww9li3	2026-07-28 17:44:00.935325868 +0000
@@ -1,32 +1,16 @@
 # The registry DisplayName carries a parenthesised version ("Gpg4win (5.0.2)"),
 # so match on a prefix rather than an exact string.
 $softwareName = "Gpg4win"
-# Require the publisher too, mirroring the manifest's exists query. This puts the
-# value under test: the validator's appExists looks up by name only, so a wrong
-# exists-query publisher would otherwise ship a manifest that can never match an
-# install (cf. the Spyder finding in #50016).
-#
-# This one is the least certain in the batch. "The Gpg4win Project" comes from the
-# winget locale manifest -- a *package* publisher, which is exactly the kind of
-# value that was wrong for Spyder -- and it could not be confirmed statically: the
-# installer's PE version resource says "g10 Code GmbH", and the NSIS script that
-# writes the real value is compressed. If it is wrong the uninstall below finds
-# nothing, and the diagnostic prints the Gpg4win entries actually present with
-# their publishers, so a single CI run settles it.
 $softwarePublisher = "The Gpg4win Project"
 
-# Gpg4win bundles GnuPG, so the same daemons stay resident (gpg-agent, dirmngr,
-# keyboxd, scdaemon) along with Kleopatra. They hold file locks that make the
-# uninstall fail, and because "Start-Process -Wait" waits for descendants as well
-# as the process itself, anything the uninstaller re-spawns would block this
-# script indefinitely. Stop them first, then wait only on the uninstaller.
+# The bundled GnuPG daemons and Kleopatra hold file locks and would block -Wait,
+# so stop them first and wait only on the uninstaller process.
 $leftovers = @("gpg-agent", "dirmngr", "keyboxd", "scdaemon", "gpg-connect-agent", "gpgconf", "kleopatra", "gpgme-w32spawn")
 $timeoutSeconds = 300
 
 $machineKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $machineKey32on64 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
-# The uninstall info is written with SHCTX, so it can land in the per-user hive.
-# The install script already accounts for that; mirror it here.
+# Uninstall info is written with SHCTX, so it can land per-user.
 $userKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $userKey32on64 = 'HKCU:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
 $exitCode = 0
@@ -40,8 +24,7 @@
         Select-Object -First 1
 }
 
-# Print every Gpg4win-ish entry with its publisher, so a publisher mismatch names
-# the correct value instead of just failing.
+# Logs matching entries and their publishers to diagnose a name/publisher miss.
 function Write-Gpg4winCandidates {
     Write-Host "Registry entries matching '$softwareName*':"
     $found = Get-ChildItem -Path $allKeys -ErrorAction SilentlyContinue |
@@ -61,9 +44,6 @@
     $key = Get-Gpg4winUninstallKey
     if (-not $key) {
         Write-Gpg4winCandidates
-        # Nothing to remove is not a failure: uninstall scripts are idempotent here,
-        # as in nordpass_uninstall.ps1 and windsurf_uninstall.ps1. If the app *is*
-        # still installed the validator's own post-uninstall check catches it.
         Write-Host "Uninstall entry not found for '$softwareName' with publisher '$softwarePublisher'."
         Exit 0
     }
@@ -71,8 +51,7 @@
     $uninstallString = if ($key.QuietUninstallString) { $key.QuietUninstallString } else { $key.UninstallString }
     Write-Host "Uninstall string: $uninstallString"
 
-    # Parse the executable path, handling quoted paths, unquoted paths containing
-    # spaces, and bare tokens.
+    # Handles quoted paths, unquoted paths with spaces, and bare tokens.
     $uninstallCommand = $uninstallString
     if ($uninstallCommand -match '^\s*"([^"]+)"\s*(.*)$') {
         $uninstallCommand = $Matches[1]
@@ -82,14 +61,8 @@
         $uninstallCommand = $Matches[1]
     }
 
-    # NSIS uninstallers copy themselves to %TEMP% and relaunch by default, so the
-    # process we start exits immediately while the real uninstall runs detached.
-    # "_?=<dir>" runs it in place instead, which makes it synchronous, and it has
-    # to be the last argument. Other scripts here pass it as its own ArgumentList
-    # element (bdash, binance, canva) or quoted (android_studio); this passes one
-    # argument string, which is what was validated in CI for this installer. Note
-    # not every NSIS uninstaller accepts it -- DBeaver's returns exit 2 and
-    # Logitech Unifying's exit 10, so both of those omit it.
+    # NSIS uninstallers relaunch from %TEMP% and detach by default; "_?=<dir>"
+    # runs in place so this stays synchronous. Must be the last argument.
     $installDir = Split-Path -Parent $uninstallCommand
     $uninstallArgs = "/S _?=$installDir"
 
@@ -97,8 +70,7 @@
     Write-Host "Uninstall args: $uninstallArgs"
 
     $process = Start-Process -FilePath $uninstallCommand -ArgumentList $uninstallArgs -PassThru
-    # Touch .Handle so the exit code is still readable after the process ends:
-    # Start-Process -PassThru otherwise returns $null for .ExitCode.
+    # Keeps .ExitCode readable after the process ends.
     $null = $process.Handle
 
     if (-not $process.WaitForExit($timeoutSeconds * 1000)) {
@@ -114,7 +86,7 @@
     Exit 1
 }
 
-# Stop anything the uninstaller restarted, then wait for the ARP entry to clear.
+# Stop anything restarted, then wait for the ARP entry to clear.
 foreach ($name in $leftovers) {
     Stop-Process -Name $name -Force -ErrorAction SilentlyContinue
 }