MSIX is a pain to install. please support EXE

[bjarthur]

Standard Executables (.exe) run through Windows Defender SmartScreen. If the app is untrusted, unsigned, or lacks reputation, SmartScreen displays a warning but provides a direct user override via the "Run anyway" button.

MSIX Packages (.msix) rely on the Windows AppX deployment engine, which enforces strict package integrity. Windows strictly prohibits the installation of any .msix package unless its signing certificate chains back to a root authority already trusted by the system. If signed with a self-signed certificate, the "Install" button remains disabled until the certificate is manually imported into the Trusted Root Certification Authorities store.

[JanisErdmanis]

MSIX requires a trusted certificate before installation, unlike .exe files, which allow users to override SmartScreen warnings. It is possible to handle this with a PowerShell bootstrap script, as I demonstrated in my last JuliaCon presentation. The script is currently available in [AppBundler.jl issue #38] and will eventually be moved into the documentation:

bootstrap.ps1 myapp.msix

This adds the self-signed certificate to the trusted root store before installing the MSIX. The script could also be modified to download the installer, allowing users to run a single command such as:

Invoke-RestMethod https://trust.me/install.ps1 | Invoke-Expression

I have also been investigating a more .exe-like approach: wrapping the MSIX with 7-Zip so that the executable first runs a PowerShell script to trust the certificate and then launches the MSIX installer. This is currently speculative and not planned unless one does the field work and demonstrates it's feasability.

[JanisErdmanis]

With the help of Claude, I had great success this evening wrapping an MSIX into a self-extracting installer with 7-Zip, using the following script:

using p7zip_jll
using Downloads
using SHA

# ---------------------------------------------------------------------------
# Inputs
# ---------------------------------------------------------------------------

#const MSIX_PATH      = joinpath(@__DIR__, "qmlapp.msix")
const MSIX_PATH      = joinpath(homedir(), "Downloads", "jumbo-26.8.8-x86_64.msix")
const BOOTSTRAP_PATH = joinpath(@__DIR__, "bootstrap.ps1")
const OUTPUT_EXE     = joinpath(@__DIR__, "MyAppSetup7z.exe")

# LZMA SDK, from the official ip7z GitHub releases.
const SDK_VERSION = "26.02"
const SDK_FILE    = "lzma2602.7z"
const SDK_URL     = "https://github.com/ip7z/7zip/releases/download/$SDK_VERSION/$SDK_FILE"
const SDK_SHA256  = "2878c85f5f43a4a4e0952b1fd4e5fe097c1c143997a8047c7e1e788892aa9357"

# The installer module. bin/7zS2.sfx and bin/7zS2con.sfx are the "small" SFX
# variants built from C/Util/SfxSetup and do not read this config format.
# Note 7zSD.sfx is a 32-bit GUI PE linked against msvcrt.dll; it runs on x64
# via WoW64 and on ARM64 via x86 emulation.
const SFX_MEMBER = "bin/7zSD.sfx"

# Skip the download by pointing at a stub you already have.
const SFX_LOCAL = ""

const CACHE_DIR = joinpath(@__DIR__, ".sfx-cache")

# ---------------------------------------------------------------------------
# Installer config
# ---------------------------------------------------------------------------

const TITLE = "MyApp Installer"

# Written as the logical string; quotes and backslashes are escaped on the way
# out. %%T is left alone -- the module expands it at runtime, so the paths stay
# correct even when the temp directory contains spaces.
#
# The .msix is passed positionally. Drop that second argument only if
# bootstrap.ps1 derives the path itself from $PSScriptRoot.
const RUN_PROGRAM = string(
    "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass",
    " -File \"%%T\\", basename(BOOTSTRAP_PATH), "\"",
    " \"%%T\\", basename(MSIX_PATH), "\"",
)

# const RUN_PROGRAM = string(
#     "powershell.exe -NoProfile -ExecutionPolicy Bypass",
#     " -File \"%%T\\", basename(BOOTSTRAP_PATH), "\"",
#     " \"%%T\\", basename(MSIX_PATH), "\"",
# )

"""
    escape_value(s) -> String

Escape a config value for the SFX text-config parser, which recognises
\\\\, \\", \\n and \\t and passes any other backslash through literally.
"""
escape_value(s::AbstractString) = replace(s, "\\" => "\\\\", "\"" => "\\\"")

"""
    sfx_config(; title, run_program) -> Vector{UInt8}

The installer config block: UTF-8, CRLF, no BOM, between the sentinel lines the
module scans for.
"""
function sfx_config(; title::AbstractString, run_program::AbstractString)
    for (k, v) in ("Title" => title, "RunProgram" => run_program)
        ('\r' in v || '\n' in v) && error("$k may not contain a newline")
    end
    lines = [
        ";!@Install@!UTF-8!",
        "Title=\"$(escape_value(title))\"",
        "Directory=\"\"",                      # see header note -- required
        "RunProgram=\"$(escape_value(run_program))\"",
        ";!@InstallEnd@!",
    ]
    return Vector{UInt8}(codeunits(join(lines, "\r\n") * "\r\n"))
end

# ---------------------------------------------------------------------------
# 7-Zip helpers
# ---------------------------------------------------------------------------

sevenzip(args::Cmd) = p7zip() do exe
    run(pipeline(`$exe $args`, stdout = devnull))
end

sevenzip_out(args::Cmd) = p7zip() do exe
    read(`$exe $args`, String)
end

# ---------------------------------------------------------------------------
# Obtaining the stub
# ---------------------------------------------------------------------------

function fetch_sdk()
    mkpath(CACHE_DIR)
    dest = joinpath(CACHE_DIR, SDK_FILE)

    if !isfile(dest)
        @info "downloading LZMA SDK" SDK_URL
        Downloads.download(SDK_URL, dest)
    end

    got = bytes2hex(open(sha256, dest))
    if isempty(SDK_SHA256)
        @warn "SDK is not pinned; set SDK_SHA256 before shipping" sha256 = got
    elseif got != lowercase(SDK_SHA256)
        rm(dest; force = true)
        error("""
              SHA256 mismatch for $SDK_FILE
                expected: $(lowercase(SDK_SHA256))
                actual:   $got
              Cached copy deleted. If you bumped SDK_VERSION, update SDK_SHA256.
              """)
    end
    return dest
end

function extract_stub()
    if !isempty(SFX_LOCAL)
        isfile(SFX_LOCAL) || error("SFX_LOCAL does not exist: $SFX_LOCAL")
        @info "using local stub" SFX_LOCAL
        return read(SFX_LOCAL)
    end

    sdk = fetch_sdk()
    dir = mktempdir()

    # `e` flattens, so bin/7zSD.sfx lands as 7zSD.sfx. A filter that matches
    # nothing still exits 0, hence the explicit isfile check below.
    sevenzip(`e -y -o$dir $sdk $SFX_MEMBER`)

    stub = joinpath(dir, basename(SFX_MEMBER))
    if !isfile(stub)
        error("""
              $SFX_MEMBER not found in $SDK_FILE. Archive contents:

              $(sevenzip_out(`l $sdk`))
              """)
    end
    @info "using SFX module" SFX_MEMBER bytes = filesize(stub)
    return read(stub)
end

# ---------------------------------------------------------------------------
# Build
# ---------------------------------------------------------------------------

"""
    make_payload(files) -> Vector{UInt8}

Store-only .7z. The MSIX is already a zip, so recompressing costs build time
and gains almost nothing.
"""
function make_payload(files::Vector{String})
    names = basename.(files)
    allunique(names) || error("payload file names collide: $names")

    dir = mktempdir()
    staging = joinpath(dir, "payload")
    mkpath(staging)
    for f in files
        cp(f, joinpath(staging, basename(f)))
    end

    archive = joinpath(dir, "payload.7z")
    sevenzip(`a -mx0 -bso0 -bsp0 $archive $(joinpath(staging, "."))`)
    return read(archive)
end

"""
    verify(exe, expected)

Confirm the appended archive is discoverable and holds exactly what we put in.
7-Zip prefers the trailing 7z over the PE container, so this works on the
finished executable.
"""
function verify(exe::AbstractString, expected::Vector{String})
    out = sevenzip_out(`l $exe`)
    absent = filter(n -> !occursin(n, out), expected)
    isempty(absent) || error("payload not readable back from $exe: $absent\n\n$out")

    m = match(r"Offset = (\d+)", out)
    m === nothing || @info "archive offset" offset = parse(Int, m[1])
    occursin("Method = Copy", out) || @warn "payload is not store-only"
end

function main()
    inputs = String[BOOTSTRAP_PATH, MSIX_PATH]
    for p in inputs
        isfile(p) || error("missing input file: $p")
    end

    stub    = extract_stub()
    config  = sfx_config(title = TITLE, run_program = RUN_PROGRAM)
    payload = make_payload(inputs)

    open(OUTPUT_EXE, "w") do io
        write(io, stub)
        write(io, config)
        write(io, payload)
    end

    verify(OUTPUT_EXE, basename.(inputs))
    @info "done" output = OUTPUT_EXE bytes = filesize(OUTPUT_EXE)
end

abspath(PROGRAM_FILE) == (@__FILE__) && main()

The produced MyAppSetup7z.exe can be double-clicked, which bootstraps trust and then opens the familiar MSIX installation wizard.

This doesn't look hard at all to support within AppBundler — one could simply pass an additional argument for MSIX to request a self-extracting installer. I'm not sure yet what to call the option; perhaps something like msix_bootstrapped_exe could work.