Skip to content

Fix: Windows installers ship unsigned application EXE and DLLs#520

Open
Copilot wants to merge 4 commits intodevfrom
copilot/fix-windows-assembly-signing
Open

Fix: Windows installers ship unsigned application EXE and DLLs#520
Copilot wants to merge 4 commits intodevfrom
copilot/fix-windows-assembly-signing

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 8, 2026 •
edited
Loading

NSIS and MSI installers embedded an unsigned Power Platform ToolBox.exe because signing ran after electron-builder had already assembled the installers. The portable ZIP was patched by a repackage workaround, but the installed app binary remained unsigned.

Changes

Three-phase Windows signing (prod-release.yml, nightly-release.yml)

  • Phase 1 – Build app directory only: --dir --x64 / --dir --arm64 produces the unpacked app directory before any installer is assembled
  • Phase 2 – Sign app binaries: Azure Trusted Signing recurses into the unpacked directory and signs all .exe and .dll files (adds DLL signing per issue requirements)
  • Phase 3 – Package then sign installers: --prepackaged builds NSIS/MSI/MSIWrapped/ZIP from the already-signed directory; a second (non-recursive) signing pass then authenticates the top-level installer .exe/.msi files

Cleanup

  • Removed the "Repackage portable ZIP" step — no longer needed since ZIP is assembled from the pre-signed --prepackaged directory
  • Added win_arch: x64 / arm64 matrix property for canonical --dir flag usage
  • Added win_unpacked_dir matrix property with the correct electron-builder output paths (win-unpacked for x64, win-arm64-unpacked for arm64) — fixes "No files were found to sign" error caused by incorrect path assumption

Docs

  • Updated docs/azure-trusted-signing.md to document the three-phase approach with correct unpacked directory paths

  • Use a meaningful title for the pull request.

  • Follow the guidelines from the CONTRIBUTING.md.

  • Mention the bug or the feature number the PR will be targeting.

  • Test the change in your own code. (Compile and run)

  • Resolve all GH Copilot comments.

Copilot AI linked an issue Apr 8, 2026 that may be closed by this pull request
[Bug]: Windows assembly signing not signing all required files #381
Open
@Power-Maverick
Fix Windows assembly signing: sign app binaries before packaging into…
939ffc4 
… installers

Agent-Logs-Url: https://github.com/PowerPlatformToolBox/desktop-app/sessions/1c00549d-1aa5-4784-be1b-0fc190cf013e

Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix assembly signing not applying to all required files Fix: Windows installers ship unsigned application EXE and DLLs Apr 8, 2026
Copilot AI requested a review from Power-Maverick April 8, 2026 13:53
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 8, 2026

Bundle Size Report 📦

Bundle Size
Main Process 955.73 KB
Renderer JS 545.09 KB
Renderer CSS 96.19 KB
Total 1.56 MB

Bundle Analysis Reports

The detailed bundle analysis reports are available in the workflow artifacts:

  • 📊 Main Process: stats-main.html
  • 📊 Renderer Process: stats-renderer.html

Download the artifacts from the workflow run to view interactive visualizations.

Bundle size tracking is now active! This helps prevent bundle bloat.

@Power-Maverick Power-Maverick marked this pull request as ready for review April 8, 2026 19:17
Copilot AI review requested due to automatic review settings April 8, 2026 19:17
Copilot AI reviewed Apr 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Windows release workflows to ensure the installed application binaries (EXE + DLLs) are signed before NSIS/MSI installers are assembled, addressing the issue where installers were shipping with unsigned embedded app binaries.

Changes:

  • Adjust Windows release jobs to build an unpacked app directory, sign EXE/DLLs recursively, then build installers from the pre-signed directory and sign the installer wrappers.
  • Remove the prior “repackage portable ZIP” workaround since ZIPs are now produced from the pre-signed --prepackaged directory.
  • Update signing documentation to describe the new multi-phase signing flow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
docs/azure-trusted-signing.md Documents the updated multi-phase signing approach for Windows artifacts.
.github/workflows/prod-release.yml Implements the new Windows build/sign/package/sign workflow for stable releases.
.github/workflows/nightly-release.yml Implements the same Windows build/sign/package/sign workflow for insider/nightly releases.

Comment thread .github/workflows/prod-release.yml Outdated
Comment thread .github/workflows/prod-release.yml Outdated
Comment thread .github/workflows/nightly-release.yml Outdated
Comment thread .github/workflows/nightly-release.yml Outdated
@Power-Maverick Power-Maverick added the unit-testing Unit testing is in process. Dev was completed label Apr 8, 2026
@Power-Maverick
Apply suggestions from code review
48ed9b7 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 9, 2026 21:31
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 9, 2026

Bundle Size Report 📦

Bundle Size
Main Process 955.73 KB
Renderer JS 545.09 KB
Renderer CSS 96.19 KB
Total 1.56 MB

Bundle Analysis Reports

The detailed bundle analysis reports are available in the workflow artifacts:

  • 📊 Main Process: stats-main.html
  • 📊 Renderer Process: stats-renderer.html

Download the artifacts from the workflow run to view interactive visualizations.

Bundle size tracking is now active! This helps prevent bundle bloat.

Copilot AI reviewed Apr 9, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

@Power-Maverick
Copy link
Copy Markdown
Contributor

Power-Maverick commented Apr 11, 2026

@copilot apply changes based on the comments in this thread. Also got error "No files were found to sign" under step "Sign app binaries using Azure Trusted Signing" - it may be related to the PR comment

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 11, 2026

@copilot apply changes based on the comments in this thread. Also got error "No files wer...

Fixed in 8f02025. The "No files were found to sign" error was caused by an incorrect unpacked directory path — electron-builder outputs build/win-unpacked for x64 (not build/win-x64-unpacked).

Changes applied:

  • Added win_unpacked_dir matrix field with the correct paths: win-unpacked (x64) and win-arm64-unpacked (arm64)
  • All files-folder and --prepackaged references now use build/${{ matrix.win_unpacked_dir }} instead of the broken build/win-${{ matrix.win_arch }}-unpacked
  • Normalized the --dir flag to --dir --${{ matrix.win_arch }} (canonical electron-builder CLI) in both workflows

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Power-Maverick Power-Maverick Awaiting requested review from Power-Maverick

At least 1 approving review is required to merge this pull request.

Assignees

@Power-Maverick Power-Maverick

Copilot code review Copilot

Labels

unit-testing Unit testing is in process. Dev was completed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Windows assembly signing not signing all required files

3 participants

@Power-Maverick