Windows: show installer failure stages and native errors for Agent 0.0.15

apps/maple-agent/Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/maple-agent", "crates/maple-billing", "crates/maple-agent-upd
 
 [workspace.package]
 edition = "2024"
-version = "0.0.14"
+version = "0.0.15"
 license = "MIT"
 
 [workspace.dependencies]

apps/maple-agent/app/src/main.rs

@@ -296,7 +296,10 @@ fn main() {
                             root,
                             profile::PROFILE,
                         )
-                        .map_err(|error| error.to_string())
+                        .map_err(|error| {
+                            internal_exit_code = error.windows_installer_exit_code();
+                            error.to_string()
+                        })
                     }),
             )
         } else if !cli.internal_windows_installer_prepare.is_empty() {
@@ -315,7 +318,10 @@ fn main() {
                             profile::PROFILE,
                             generation,
                         )
-                        .map_err(|error| error.to_string())
+                        .map_err(|error| {
+                            internal_exit_code = error.windows_installer_exit_code();
+                            error.to_string()
+                        })
                     }),
             )
         } else if let Some(generation) = &cli.internal_windows_installer_activate {

apps/maple-agent/crates/maple-agent-updater/examples/windows_signature_probe.rs

@@ -1,6 +1,11 @@
 //! Manual, read-only historical Authenticode interoperability probe. The selected
 //! executable is never launched; this is not installed-update qualification.
 
+#[cfg(windows)]
+use maple_agent_updater::installer::InstallError;
+#[cfg(windows)]
+type Result<T> = std::result::Result<T, InstallError>;
+
 #[cfg(windows)]
 #[allow(dead_code)]
 #[path = "../src/installer/windows_bundle/authenticode.rs"]

apps/maple-agent/crates/maple-agent-updater/src/installer.rs

@@ -105,6 +105,8 @@ pub enum InstallError {
     Invalid(&'static str),
     #[error("The update does not have the required Maple code signature and identity")]
     CodeSignature,
+    #[error("Windows could not verify Maple's code signature (WinTrust error 0x{status:08X})")]
+    WindowsCodeSignature { status: u32 },
     #[error("The update could not be installed: {0}")]
     Io(#[from] io::Error),
     #[error("Windows activation failed during {stage}: {source}")]
@@ -127,6 +129,26 @@ impl InstallError {
         }
     }
 
+    /// Report a failed preflight/preparation through NSIS without losing a
+    /// native error's high bits. Every category remains a nonzero failure;
+    /// activation keeps its existing separately decoded stage contract.
+    pub fn windows_installer_exit_code(&self) -> i32 {
+        match self {
+            Self::WindowsCodeSignature { status } if *status != 0 => *status as i32,
+            Self::CodeSignature | Self::WindowsCodeSignature { .. } => 0x4E00_0001,
+            Self::Busy => 0x4E00_0002,
+            Self::Invalid(_) => 0x4E00_0003,
+            Self::NotifyOnly(_) => 0x4E00_0004,
+            Self::Io(error) => error
+                .raw_os_error()
+                .filter(|code| *code != 0)
+                .unwrap_or(0x4E00_0005),
+            Self::WindowsActivation { .. } => {
+                self.windows_activation_exit_code().unwrap_or(0x4E00_0003)
+            }
+        }
+    }
+
     /// Encode only an activation failure, without paths, SIDs or error text.
     /// The original typed source remains available to direct callers.
     pub fn windows_activation_exit_code(&self) -> Option<i32> {
@@ -150,6 +172,92 @@ type Result<T> = std::result::Result<T, InstallError>;
 mod windows_activation_error_tests {
     use super::*;
 
+    #[test]
+    fn installer_status_retains_full_native_bits_including_negative_trust_errors() {
+        for status in [1, 0x800B_0109, 0x8009_2013, u32::MAX] {
+            let error = InstallError::WindowsCodeSignature { status };
+            let code = error.windows_installer_exit_code();
+            assert_eq!(code as u32, status);
+            assert_ne!(code, 0);
+        }
+        for code in [5, 32, 65_536, i32::MIN, i32::MAX, -1] {
+            let error = InstallError::Io(io::Error::from_raw_os_error(code));
+            assert_eq!(error.windows_installer_exit_code(), code);
+        }
+    }
+
+    #[test]
+    fn installer_status_fallbacks_never_return_success_or_change_activation_status() {
+        for (error, code) in [
+            (InstallError::CodeSignature, 0x4E00_0001),
+            (
+                InstallError::WindowsCodeSignature { status: 0 },
+                0x4E00_0001,
+            ),
+            (InstallError::Busy, 0x4E00_0002),
+            (InstallError::Invalid("public fixture"), 0x4E00_0003),
+            (InstallError::NotifyOnly("public fixture"), 0x4E00_0004),
+            (
+                InstallError::Io(io::Error::from(io::ErrorKind::PermissionDenied)),
+                0x4E00_0005,
+            ),
+            (
+                InstallError::Io(io::Error::from_raw_os_error(0)),
+                0x4E00_0005,
+            ),
+        ] {
+            assert_eq!(error.windows_installer_exit_code(), code);
+            assert_ne!(code, 0);
+        }
+        for source in [
+            InstallError::WindowsCodeSignature {
+                status: 0x800B_0109,
+            },
+            InstallError::Io(io::Error::from_raw_os_error(32)),
+            InstallError::Invalid("public fixture"),
+        ] {
+            let error = InstallError::WindowsActivation {
+                stage: WindowsActivationStage::GenerationVerification,
+                source: Box::new(source),
+            };
+            assert_eq!(
+                Some(error.windows_installer_exit_code()),
+                error.windows_activation_exit_code()
+            );
+            assert_ne!(error.windows_installer_exit_code(), 0);
+        }
+    }
+
+    #[test]
+    fn windows_signature_status_survives_activation_context_without_changing_error_policy() {
+        for status in [0x800B_0109, 0x8009_2013, 0x800B_0100, u32::MAX] {
+            let source = InstallError::WindowsCodeSignature { status };
+            assert_eq!(
+                source.to_string(),
+                format!(
+                    "Windows could not verify Maple's code signature (WinTrust error 0x{status:08X})"
+                )
+            );
+            assert!(!source.requires_manual_installation());
+            let error = InstallError::WindowsActivation {
+                stage: WindowsActivationStage::BootstrapIdentity,
+                source: Box::new(source),
+            };
+            assert!(error.to_string().contains("bootstrap-identity"));
+            assert!(error.to_string().contains(&format!("0x{status:08X}")));
+            // The existing bounded activation status is not repurposed to
+            // truncate or disguise a full WinTrust DWORD.
+            assert_eq!(error.windows_activation_exit_code(), Some(0x4D04_0000));
+            assert!(!error.requires_manual_installation());
+            let InstallError::WindowsActivation { source, .. } = error else {
+                unreachable!()
+            };
+            assert!(
+                matches!(*source, InstallError::WindowsCodeSignature { status: actual } if actual == status)
+            );
+        }
+    }
+
     #[test]
     fn activation_status_preserves_fixed_stage_and_original_native_error() {
         for (stage, number, label) in [

apps/maple-agent/crates/maple-agent-updater/src/installer/windows_bundle.rs

@@ -452,15 +452,15 @@ fn verify_identity_metadata(directory: &Path, bundle: &Bundle) -> Result<PathBuf
 fn verify_identity_for(directory: &Path, bundle: &Bundle, purpose: IdentityPurpose) -> Result<()> {
     let executable = verify_identity_metadata(directory, bundle)?;
     #[cfg(windows)]
-    if !match purpose {
+    match purpose {
         IdentityPurpose::Admission => {
-            authenticode::verify_or_unsigned(&executable, bundle.profile == "dev")
+            authenticode::verify_or_unsigned_detailed(&executable, bundle.profile == "dev")?;
         }
         IdentityPurpose::Startup => {
-            authenticode::verify_startup_or_unsigned(&executable, bundle.profile == "dev")
+            if !authenticode::verify_startup_or_unsigned(&executable, bundle.profile == "dev") {
+                return Err(InstallError::CodeSignature);
+            }
         }
-    } {
-        return Err(InstallError::CodeSignature);
     }
     #[cfg(not(windows))]
     let _ = (purpose, executable);
@@ -1168,10 +1168,10 @@ fn trusted_installer(executable: &Path, profile: &str) -> Result<serde_json::Val
             .as_str()
             .is_some_and(|v| manifest::stable_version(v).is_ok())
         || !info["source_sha"].as_str().is_some_and(valid_source)
-        || !authenticode::verify_or_unsigned(executable, profile == "dev")
     {
         return Err(InstallError::CodeSignature);
     }
+    authenticode::verify_or_unsigned_detailed(executable, profile == "dev")?;
     Ok(info)
 }
 
@@ -1870,11 +1870,10 @@ pub fn prepare_windows_installation(
                 .tempfile_in(&root)?
                 .into_temp_path();
             fs::copy(&checker, &temporary)?;
-            if exact_file_digest(&temporary)? != intent.executable_sha256
-                || !authenticode::verify_or_unsigned(&temporary, profile == "dev")
-            {
+            if exact_file_digest(&temporary)? != intent.executable_sha256 {
                 return Err(InstallError::CodeSignature);
             }
+            authenticode::verify_or_unsigned_detailed(&temporary, profile == "dev")?;
             windows_atomic_replace(&temporary, &root.join("maple-agent.exe"))?;
         }
         windows_sync_directory(&root)?;
@@ -2051,11 +2050,10 @@ pub fn cleanup_windows_installation(executable: &Path, profile: &str) -> Result<
             .ok_or(InstallError::Invalid("Windows uninstall parent"))?;
         windows_fs::validate_path(root)?;
         registered_root(root, profile)?;
-        if pe_build_info(&executable)?["profile"] != profile
-            || !authenticode::verify_or_unsigned(&executable, profile == "dev")
-        {
+        if pe_build_info(&executable)?["profile"] != profile {
             return Err(InstallError::CodeSignature);
         }
+        authenticode::verify_or_unsigned_detailed(&executable, profile == "dev")?;
         let lock = open_install_lock(root)?;
         lock.try_lock_exclusive().map_err(|_| InstallError::Busy)?;
         let owner = installer_owner()?;