Installer: internal MSI file is not signed

[klylesatepic]

Microsoft PowerToys version

0.57.0

Running as admin

• Yes

Area(s) with issue?

Installer

Steps to reproduce

It helps to have security software that only runs allowed software (including software signed with certain certificates), such as CarbonBlack. You can see the lack of signing without that, though it won't cause any functional issues.

1. Install an old version of PowerToys
2. Update it from within PowerToys
3. If you have said security software, see that it blocks execution of C:\ProgramData\Package Cache{45E073FD-1ED7-4787-B445-2980175F449A}v0.57.0\PowerToysSetup-0.57.0-x64.msi and the update fails to install
4. If you don't have said security software, inspect that .msi file and see that it is unsigned (no Digital Signatures tab in the Properties window)

✔️ Expected Behavior

The .msi file would be signed by Microsoft

❌ Actual Behavior

The .msi file is not signed (by Microsoft or anyone else)

Other Software

No response

[franky920920]

cc: @crutkas

[DHowett]

Ugh. Thanks for reporting this.

My initial thought was, "this was a case we explicitly covered."

(1) Content is signed:

PowerToys/.pipelines/release.yml

Line 204 in 04588bc

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1

(2) MSI is signed:

PowerToys/.pipelines/release.yml

Line 250 in 04588bc

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1

(3) Bootstrapper bundle is unpacked-
Engine is signed:

PowerToys/.pipelines/release.yml

Line 278 in 04588bc

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1

(4) Bootstrapper bundle is re-packed-
Bundle is signed:

PowerToys/.pipelines/release.yml

Line 314 in 04588bc

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1

However, it turns out that the build phase for the bootstrapper (which happens in between 2 and 3) was set to clean: true and was deleting the newly-signed MSI.

The correct fix is to stage our outputs somewhere else where MSBuild can't get to them, and direct the bootstrapper build to use those copies. However, I'm trying the lazy fix first: https://github.com/microsoft/PowerToys/compare/dev/duhowett/ffs-msbuild

[klylesatepic]

Ugh. Thanks for reporting this.

My initial thought was, "this was a case we explicitly covered."

Yeah, I saw lots of older issues about code signing of various things, but they were all slightly different and already fixed. I'm glad I didn't miss one that still applied!

[Aaron-Junker]

This got implemented in the 0.58 update.