Repository navigation
Install lab: test a signed Windows installer without a paid certificate - #170
Merged
Merged
Conversation
`lab.py run windows --gui-installer <setup.exe> --test-sign` signs the unsigned installer inside the disposable VM with a throwaway certificate the VM trusts machine-wide (private key deleted after signing), before the baseline. The guest's existing check must then report `Valid`. Refused outside app install runs on the windows VM target. The OneDrive self-update's version and Codecs folders join the measured desktop noise. Release signing is tracked in theontho/gui-for-cli#167. Verified: the v0.6.1 release installer, test-signed, passes 25/25 checks; `mutate` catches every corruption, including signature-flipped. Closes #97 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 86b87a6d-09a0-4852-9280-a9e685946179
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
There was a problem hiding this comment.
🟡 Changes recommended
An unescaped apostrophe in a valid installer filename breaks PowerShell parsing in the signing and cleanup commands, causing --test-sign to abort.
1 open issue
What changed in this PR
Adds disposable-VM test signing to exercise the Windows install lab’s signed-installer checks without a paid certificate. This validates the signed path, not public release signing.
Changes:
- Adds
--test-sign, restricted to Windows VM app-install runs, with updated signature metadata. - Creates a temporary signing certificate, trusts it in the guest, signs the installer, and deletes the private key.
- Documents the workflow, tests unsupported invocations, and expands OneDrive noise exclusions.
| File | Description |
|---|---|
| tests/test_lab_gui_build.py | Tests rejection of unsupported test-signing runs. |
| scripts/installlab/windows_gui_vm.py | Adds guest-side certificate creation and installer signing. |
| scripts/installlab/noise/windows-gui.txt | Excludes OneDrive version and Codecs folders from measured changes. |
| scripts/installlab/lab.py | Adds the CLI flag, validation, signing step, and metadata updates. |
| docs/install_testing.md | Explains test signing and its verification limits. |
Review effort: Balanced
The installer's host file name was quoted into PowerShell, so a name with an apostrophe broke signing. Authenticode doesn't cover the file name, and the guest still downloads the installer under its own name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 86b87a6d-09a0-4852-9280-a9e685946179
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
lab.py run windows --gui-installer <setup.exe> --test-signsigns theunsigned installer inside the disposable VM with a throwaway certificate
the VM trusts machine-wide (private key deleted after signing), before
the baseline. The guest's existing check must then report
Valid.Refused outside app install runs on the windows VM target. The
OneDrive self-update's version and Codecs folders join the measured
desktop noise. Release signing is tracked in theontho/gui-for-cli#167.
Verified: the v0.6.1 release installer, test-signed, passes 25/25
checks;
mutatecatches every corruption, including signature-flipped.Closes #97
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
Copilot-Session: 86b87a6d-09a0-4852-9280-a9e685946179