Skip to content

appinstaller.md

Latest commit

 

History

History
96 lines (83 loc) · 5.9 KB

appinstaller.md

File metadata and controls

96 lines (83 loc) · 5.9 KB
Raw

MSIX App Installer updates

electron_msix_appinstaller writes a deterministic .appinstaller descriptor from the final MSIX package or bundle's embedded identity. It runs on BB Linux with declared Python and MSIX inputs. No Windows SDK tool, signing key, clock or network enters this action. The MSIX bytes remain unchanged.

load("@rules_electron//electron:msix.bzl", "electron_msix_appinstaller")

electron_msix_appinstaller(
    name = "update",
    package = ":signed_msix",
    appinstaller_uri = "https://updates.example.com/windows/arm64/latest.appinstaller",
    package_uri = "https://updates.example.com/windows/arm64/Example-2.0.0.msix",
    hours_between_update_checks = 12,
    automatic_background_task = True,
)

Name, publisher, package version and CPU come from AppxManifest.xml inside the package. The descriptor version defaults to that package version; appinstaller_version overrides it with four numeric components. This validates metadata, not package signatures or certificate trust. Deploy final signed MSIX bytes with the exact identity and filename referenced by the descriptor.

The rule emits Microsoft's 2021 schema. check_on_launch controls OnLaunch; its default interval is 24 hours, with 0–255 accepted. show_prompt and update_blocks_activation declare launch policy; blocking requires a prompt. automatic_background_task enables the background element. force_update_from_any_version explicitly permits downgrades. update_uris and repair_uris accept up to ten distinct fallback URLs each. Windows owns scheduling, prompts and policy enforcement; see update settings.

URLs require HTTPS without credentials, query or fragment. Percent-encode Unicode or spaces. allow_http_loopback exists for explicit native fixtures. Use separate CPU URLs for individual packages. A final .msixbundle selects MainBundle automatically, deriving name, publisher and version from its bundle manifest. One descriptor then serves both CPUs; Windows selects the native payload. Dependency and optional-package sets remain unsupported.

Publish package bytes before promoting the descriptor. This rule neither uploads nor installs them. App Installer uses Windows deployment APIs; it does not make MSIX an electron-updater installer. Store distribution remains a separate flow.

@rules_electron//electron/tools:publish_appinstaller performs an explicit S3 release operation from BB Linux:

bazel run --config=bb-workflow @rules_electron//electron/tools:publish_appinstaller -- \
  --descriptor "$appinstaller_file" --package "$signed_msix" \
  --destination https://sample-updates.s3.us-west-2.amazonaws.com/windows/arm64/ \
  --region us-west-2

Credentials and multipart options follow the S3 publisher. Inputs must be regular files. The client snapshots their bytes and compares all package or bundle identity fields and descriptor type before contacting the service. Object names come from public descriptor/package URLs; local Bazel output names may differ. Map those public URLs to the chosen destination prefix. It uploads MSIX first with If-None-Match: *, verifies identical existing bytes, then promotes the descriptor with a strong ETag condition. Races stop promotion. Both upload modes set explicit application/msix, application/msixbundle and application/appinstaller content types. This operation does not validate certificate trust or publish dependency sets.

The 2b99e00 BB suite and seven cross-builds passed. Tests check identity, policy, URL boundaries, immutable inputs, relocation/mtime stability and UTF-8/UTF-16 manifests. Native x64/ARM64 fixtures serve only unchanged BB outputs on loopback, install v1 through App Installer, adopt its URI through GetAppInstallerInfo, update to v2, launch real Electron and remove the package. Existing signature/activation tests remain separate. All four native hosts passed, including the complete handoff on Windows x64/ARM64. The 3445e4f BB suite passed the public publication command against a signature-verifying server: exact bytes/names, MIME, ordering, retries, identity rejection and channel races. No live release was published.

An additional native gate now checks Windows' CheckUpdateAvailabilityAsync for no updates, an available v2, then no updates after installation. It uses PackageManager.FindPackageForUser rather than the documented unsupported Package.Current path. The 6d9edc2 native workflow passed all three states on both Windows CPUs and passed all four hosts. The short fixture does not prove background timing, prompt UX, fallback server failover or production certificate trust.

The 84c7f91 BB suite and cross-build passed bundle descriptor/publication tests. All four native hosts passed, including the complete MainBundle handoff on Windows x64/ARM64. The fixture reuses the same BB-built signed v1/v2 bundles for direct deployment and a separate App Installer handoff, checking native CPU selection, adopted URI, update availability, real Electron execution and uninstall. It serves unchanged descriptor/bundle bytes.