diff --git a/.github/workflows/unsigned-msix-test.yml b/.github/workflows/unsigned-msix-test.yml deleted file mode 100644 index 423562a..0000000 --- a/.github/workflows/unsigned-msix-test.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Unsigned MSIX development test - -on: - pull_request: - paths: - - .github/workflows/unsigned-msix-test.yml - - build/msix/** - - scripts/build-unsigned-msix-test.ps1 - - scripts/check-windows-distribution.cjs - - package.json - - package-lock.json - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - runs-on: windows-latest - steps: - - name: Checkout - uses: actions/checkout@v7 - - name: Use Node.js - uses: actions/setup-node@v7 - with: - node-version: 24.x - cache: npm - - name: Install locked dependencies - run: npm ci - - name: Build unpacked Windows editor - run: npm run build:windows:dir - - name: Build unsigned MSIX test package - shell: pwsh - run: ./scripts/build-unsigned-msix-test.ps1 - - name: Upload internal MSIX test artifact - uses: actions/upload-artifact@v7 - with: - name: parlyn-unsigned-msix-development-test - path: | - release/msix-test/*.msix - release/msix-test/SHA256SUMS.txt - if-no-files-found: error - retention-days: 7 diff --git a/build/msix/AppxManifest.xml b/build/msix/AppxManifest.xml deleted file mode 100644 index 61084fe..0000000 --- a/build/msix/AppxManifest.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - - Parlyn Engine Development - WebCrew - Assets\StoreLogo.png - - - - - - - - - - - - diff --git a/build/msix/Square150x150Logo.png b/build/msix/Square150x150Logo.png deleted file mode 100644 index 01b67b1..0000000 Binary files a/build/msix/Square150x150Logo.png and /dev/null differ diff --git a/build/msix/Square44x44Logo.png b/build/msix/Square44x44Logo.png deleted file mode 100644 index d697e7a..0000000 Binary files a/build/msix/Square44x44Logo.png and /dev/null differ diff --git a/build/msix/StoreLogo.png b/build/msix/StoreLogo.png deleted file mode 100644 index 93e70ee..0000000 Binary files a/build/msix/StoreLogo.png and /dev/null differ diff --git a/docs/WINDOWS-DISTRIBUTION.md b/docs/WINDOWS-DISTRIBUTION.md index e485147..5408db4 100644 --- a/docs/WINDOWS-DISTRIBUTION.md +++ b/docs/WINDOWS-DISTRIBUTION.md @@ -16,12 +16,6 @@ This work does not activate the broader launcher, account or online ecosystem scope from Phase 8. It provides a reproducible packaged editor, an NSIS installer and a strict boundary for future trusted code signing. -An additional development-only experiment packages the unchanged editor as an -unsigned MSIX with Microsoft's required OID identity. It is an internal -maintainer test, not a public distribution method, and is installed only with -the documented Windows 11 \`Add-AppxPackage -AllowUnsigned\` mechanism. Smart App -Control remains enabled throughout the test. - ## Installer behavior The Windows build produces a 64-bit per-user NSIS installer named: diff --git a/scripts/build-unsigned-msix-test.ps1 b/scripts/build-unsigned-msix-test.ps1 deleted file mode 100644 index 4c30cd3..0000000 --- a/scripts/build-unsigned-msix-test.ps1 +++ /dev/null @@ -1,41 +0,0 @@ -[CmdletBinding()] -param( - [string]$SourceDirectory = "release/win-unpacked", - [string]$OutputDirectory = "release/msix-test" -) - -$ErrorActionPreference = "Stop" -$source = (Resolve-Path -LiteralPath $SourceDirectory).Path -$output = [System.IO.Path]::GetFullPath((Join-Path $PWD $OutputDirectory)) -$staging = Join-Path $output "staging" -$package = Join-Path $output "Parlyn-Engine-Development-0.5.0-beta.18-x64.msix" - -if (-not (Test-Path -LiteralPath (Join-Path $source "Parlyn Engine.exe"))) { - throw "The unpacked Parlyn executable was not found." -} - -$kitsRoot = Join-Path ([Environment]::GetFolderPath("ProgramFilesX86")) "Windows Kits\10\bin" -$makeAppx = Get-ChildItem -LiteralPath $kitsRoot -Filter MakeAppx.exe -Recurse | - Where-Object { $_.FullName -match '\\x64\\MakeAppx\.exe$' } | - Sort-Object FullName -Descending | Select-Object -First 1 -if (-not $makeAppx) { throw "MakeAppx.exe was not found in the Windows SDK." } - -if (Test-Path -LiteralPath $output) { - Remove-Item -LiteralPath $output -Recurse -Force -} -New-Item -ItemType Directory -Path $staging | Out-Null -Copy-Item -Path (Join-Path $source "*") -Destination $staging -Recurse -Copy-Item -LiteralPath "build/msix/AppxManifest.xml" -Destination $staging -New-Item -ItemType Directory -Path (Join-Path $staging "Assets") | Out-Null -Copy-Item -Path "build/msix/*.png" -Destination (Join-Path $staging "Assets") - -& $makeAppx.FullName pack /d $staging /p $package /o -if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $package)) { - throw "MakeAppx failed to create the unsigned MSIX package." -} - -$hash = Get-FileHash -LiteralPath $package -Algorithm SHA256 -"$($hash.Hash.ToLower()) $([System.IO.Path]::GetFileName($package))" | - Set-Content -LiteralPath (Join-Path $output "SHA256SUMS.txt") -Encoding utf8 -Remove-Item -LiteralPath $staging -Recurse -Force -Write-Host "Unsigned MSIX test package created: $package" diff --git a/scripts/check-windows-distribution.cjs b/scripts/check-windows-distribution.cjs index d8cd97a..b8e171d 100644 --- a/scripts/check-windows-distribution.cjs +++ b/scripts/check-windows-distribution.cjs @@ -22,7 +22,6 @@ requireValue(icon[0] === 0 && icon[1] === 0 && icon[2] === 1 && icon[3] === 0, ' const workflow = fs.readFileSync(path.join(root, '.github/workflows/windows-installer.yml'), 'utf8'); const previewWorkflow = fs.readFileSync(path.join(root, '.github/workflows/publish-unsigned-preview.yml'), 'utf8'); -const msixWorkflow = fs.readFileSync(path.join(root, '.github/workflows/unsigned-msix-test.yml'), 'utf8'); requireValue(workflow.includes('signpath/github-action-submit-signing-request@v2'), 'Windows workflow is missing the SignPath signing action.'); for (const setting of [ 'SIGNPATH_API_TOKEN', @@ -40,16 +39,6 @@ requireValue(!workflow.includes('BEGIN PRIVATE KEY'), 'Signing material must nev requireValue(previewWorkflow.includes('Compress-Archive'), 'Unsigned previews must create a portable ZIP test artifact.'); requireValue(previewWorkflow.includes('Parlyn-Engine-Portable-0.5.0-beta.18-x64.zip'), 'Portable preview artifact has an unexpected name.'); requireValue(previewWorkflow.includes('release/win-unpacked/Parlyn Engine.exe'), 'Portable preview must verify its packaged executable.'); -requireValue(msixWorkflow.includes('workflow_dispatch:'), 'Unsigned MSIX testing must support explicit manual dispatch.'); -requireValue(msixWorkflow.includes('actions/upload-artifact@v7'), 'Unsigned MSIX testing must upload only an internal workflow artifact.'); - -const msixManifest = fs.readFileSync(path.join(root, 'build/msix/AppxManifest.xml'), 'utf8'); -requireValue(msixManifest.includes('Publisher="CN=AppModelSamples, OID.2.25.311729368913984317654407730594956997722=1"'), "Unsigned MSIX identity must match Microsoft's documented unsigned namespace publisher."); -requireValue(msixManifest.includes('WebCrew.ParlynEngine.Development'), 'Unsigned MSIX must use a development-only identity.'); -requireValue(msixManifest.includes('runFullTrust'), 'Packaged Electron editor requires the full-trust capability.'); -const msixScript = fs.readFileSync(path.join(root, 'scripts/build-unsigned-msix-test.ps1'), 'utf8'); -requireValue(msixScript.includes('MakeAppx.exe'), 'Unsigned MSIX build must use the Windows SDK packager.'); -requireValue(msixScript.includes('Get-FileHash'), 'Unsigned MSIX build must produce a SHA-256 checksum.'); const gitignore = fs.readFileSync(path.join(root, '.gitignore'), 'utf8'); for (const sensitivePattern of ['*.pfx', '*.p12', '*.key']) {