modified release pipeline

README.md

@@ -181,8 +181,8 @@ The package is downloaded to the temp folder and handed to the Windows app
 installer: it shows the publisher, asks for a confirmation and replaces the
 installed version. Windows checks the signature, so the package attached to a
 release has to be signed — an unsigned one installs nowhere but a machine in
-developer mode. The running app keeps working off the old files until it is
-restarted.
+developer mode; the pipeline signs what it attaches. The running app keeps
+working off the old files until it is restarted.
 
 An app installed from the Store has no updates section at all: the Store
 updates it, and a package from the side is something Windows would not accept
@@ -257,7 +257,7 @@ running agent and fails if any part of the WPF renderer is in it.
 
 The pipelines live in `.gitea/workflows` and run on Gitea Actions. A pull
 request into `master` is built and tested; a tag of the form `v1.2.3` is built,
-tested, packed into an MSIX and published as a release with the packages
+tested, packed into an MSIX and published as a release with the signed packages
 attached. The version is taken from the tag alone — a tag shaped any other way
 stops the run right at the start. The package version ends up as `1.2.3.0`: the
 Store takes four numbers and keeps the last one for itself, so the tag has no
@@ -271,9 +271,31 @@ need a desktop of their own — the end-to-end ones, and those that ask for the
 foreground window or the caret — skip themselves on a runner that lives as a
 service in session 0, where there is no desktop to show a window on.
 
-The package the release carries goes to Partner Center as it is. The identity
-comes from repository variables and falls back to the defaults of the script when
-unset: `MSIX_IDENTITY_NAME`, `MSIX_PUBLISHER` and `MSIX_PUBLISHER_DISPLAY_NAME`.
+The package is built twice over, because the Store and a release want different
+things of it.
+
+The Store one carries the identity reserved in Partner Center and no signature —
+Partner Center signs it there. It never leaves the artifacts of the run: someone
+picks it up and uploads it by hand. Its name says which one it is —
+`CursorLang-1.2.3.0-store.msixbundle`. The identity comes from repository
+variables and falls back to the defaults of the script when unset:
+`MSIX_IDENTITY_NAME`, `MSIX_PUBLISHER` and `MSIX_PUBLISHER_DISPLAY_NAME`.
+
+The one attached to the release is signed by the pipeline with a certificate
+from SSL.com, whose private key stays in their HSM and never comes down to the
+runner: eSigner CKA is installed on it as a key storage provider, and `signtool`
+asks that for the key the way it would ask a token. The account is three
+repository secrets — `ESIGNER_USERNAME`, `ESIGNER_PASSWORD` and
+`ESIGNER_TOTP_SECRET`; the last one is the secret eSigner hands out for
+automated signing, not a code read off a phone. They are checked before the
+build rather than at the signing step: a release without a signed package is
+not a release.
+
+Its `Publisher` is not `MSIX_PUBLISHER` but the subject of that certificate,
+read off it in the run — Windows takes a package naming anyone else for a
+forgery. Together with the identity that subject decides the family name of the
+package, so both have to stay as they are from release to release, or an update
+installs beside the old version instead of replacing it.
 
 ## Building the MSIX package
 
@@ -291,13 +313,22 @@ powershell -File Packaging\build-msix.ps1 -Architectures x64
 
 # For Partner Center — the identity is the one reserved there
 powershell -File Packaging\build-msix.ps1 -Version 1.0.1.0 `
-    -IdentityName 12345AleksandrNeychev.CursorLang -Publisher "CN=ABCD1234-..."
+    -IdentityName 12345AleksandrNeichev.CursorLang -Publisher "CN=ABCD1234-..."
 ```
 
 The result is `artifacts\packages\CursorLang-<version>.msixbundle` covering x64
 and arm64; next to it lie the packages of single architectures. Upload the bundle
 to Partner Center as it is.
 
+`-CertificateThumbprint` signs everything the build produces, with the
+certificate of that thumbprint out of the personal store of the current user;
+`-Publisher` then has to name its subject, and the script says so before it
+starts building rather than after. The pipeline is what normally signs, but the
+same works by hand once eSigner CKA — or a certificate of any other kind — has
+put a certificate into the store. `-PackageSuffix` goes at the end of the file
+names: the builds for the Store and for a release differ in what is inside them
+and in nothing else.
+
 The app ships with its own copy of .NET: Windows does not include .NET 10, and
 MSIX cannot install a runtime as a package dependency.
 
@@ -318,5 +349,5 @@ the Store answers to the same name and is left alone.
 To remove it by hand:
 
 ```powershell
-Remove-AppxPackage (Get-AppxPackage -Name AleksandrNeychev.CursorLang).PackageFullName
+Remove-AppxPackage (Get-AppxPackage -Name AleksandrNeichev.CursorLang).PackageFullName
 ```