From ecb9f40eeab5e9195dd597f56752c71164090d26 Mon Sep 17 00:00:00 2001
From: 11cookies11 <gao13048663696@163.com>
Date: Mon, 9 Mar 2026 13:52:50 +0800
Subject: [PATCH] fix(release): default unsigned MSIX in CI for Store
 submission
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[中文]

- 变更内容：

  - release workflow 默认将 MSIX_SKIP_SIGN 设为 true（仅当未配置 secret 时）

  - build_msix.ps1 在使用自签证书时，验签失败改为告警，不再导致 CI 失败

  - 更新 where progress 记录本次任务状态

- 影响范围：

  - .github/workflows/release.yml

  - scripts/build_msix.ps1

  - .where-agent-progress.md

- 兼容性/行为变化：

  - 默认产物改为未签名 MSIX（适用于上传 Microsoft Store 由平台签名）

  - 提供正式证书时仍可按原流程签名

- 依赖/环境：

  - 无新增依赖

[English]

- Changes:

  - Set MSIX_SKIP_SIGN to true by default in release workflow when secret is empty

  - Downgrade self-signed SignTool verification failures to warnings in build_msix.ps1

  - Update where progress file for this task

- Impact:

  - .github/workflows/release.yml

  - scripts/build_msix.ps1

  - .where-agent-progress.md

- Compatibility / Behavior Changes:

  - CI now produces unsigned MSIX by default for Store submission

  - Signed flow remains available when a real certificate is provided

- Dependencies / Environment:

  - No new dependencies
---
 .github/workflows/release.yml |  4 ++++
 .where-agent-progress.md      | 10 ++++------
 scripts/build_msix.ps1        | 14 ++++++++++++++
 3 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acba4f4..e82ed0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,10 @@ jobs:
           MSIX_CERT_PASSWORD: ${{ secrets.MSIX_CERT_PASSWORD }}
           MSIX_SKIP_SIGN: ${{ secrets.MSIX_SKIP_SIGN }}
         run: |
+          $skipSign = "${{ secrets.MSIX_SKIP_SIGN }}"
+          if ([string]::IsNullOrWhiteSpace($skipSign)) { $skipSign = "true" }
+          $env:MSIX_SKIP_SIGN = $skipSign
+
           $version = "${{ github.event.inputs.build_version }}"
           if ([string]::IsNullOrWhiteSpace($version)) { $version = "${{ github.ref_name }}" }
           .\\scripts\\build_msix.ps1 `
diff --git a/.where-agent-progress.md b/.where-agent-progress.md
index 285e783..e872ffa 100644
--- a/.where-agent-progress.md
+++ b/.where-agent-progress.md
@@ -1,6 +1,4 @@
-# Plan: 全链路 Logo 统一
-- [x] 任务栏/安装器图标统一到指定 Logo（ico）
-- [x] 桌面运行时应用图标链路统一（AppUserModelID + QApplication/窗口图标）
-- [x] 前端侧边栏品牌图标替换为同款 Logo
-- [x] 前端 favicon 替换为同款 Logo
-- [x] 完成基础验证（py_compile + 前端组件测试）
+# Plan: 生成 Store 提交用未签名 MSIX
+- [x] 确认现有脚本支持跳过签名
+- [x] 调整 GitHub Actions 默认启用 MSIX_SKIP_SIGN
+- [x] 校验变更并给出 Store 提交流程建议
diff --git a/scripts/build_msix.ps1 b/scripts/build_msix.ps1
index 1af4fad..026a400 100644
--- a/scripts/build_msix.ps1
+++ b/scripts/build_msix.ps1
@@ -209,6 +209,7 @@ if (-not (Test-Path -LiteralPath $certDir)) {
 }
 $certPfx = Join-Path $certDir "ProtoFlow_msix_signing.pfx"
 $certCer = Join-Path $certDir "ProtoFlow_msix_signing.cer"
+$usingSelfSignedCert = $false
 
 if ($env:MSIX_CERT_PFX_BASE64 -and $env:MSIX_CERT_PASSWORD) {
   Write-Host "==> Use provided signing certificate"
@@ -217,6 +218,7 @@ if ($env:MSIX_CERT_PFX_BASE64 -and $env:MSIX_CERT_PASSWORD) {
 }
 else {
   Write-Host "==> Generate self-signed certificate for MSIX"
+  $usingSelfSignedCert = $true
   $cert = New-SelfSignedCertificate -Type Custom `
     -KeyAlgorithm RSA `
     -KeyLength 2048 `
@@ -247,6 +249,18 @@ catch {
 
 Write-Host "==> Verify signature"
 & $signTool verify /pa $msixPath | Out-Host
+$verifyExitCode = $LASTEXITCODE
+if ($verifyExitCode -ne 0) {
+  if ($usingSelfSignedCert) {
+    Write-Warning "SignTool verify failed (exit code $verifyExitCode) because self-signed root is not trusted on this machine. Continue."
+    if (Test-Path -LiteralPath $certCer) {
+      Write-Warning "Install certificate to Trusted Root and Trusted People before local installation: $certCer"
+    }
+  }
+  else {
+    throw "SignTool verify failed with exit code $verifyExitCode. Check certificate chain trust (root/intermediate)."
+  }
+}
 
 Write-Host "MSIX generated: $msixPath"
 if (Test-Path -LiteralPath $certCer) {