George Lambert
778763737e
Consolidate Authenticode, Apple notary, VM C, and digest-paste into platform/windows/wix/OPERATOR-READY.md (runbook + commands + secret names only). Cross-link from CI-SIGN-NOTARY, VM-C-ONE-PAGER, PACKAGING, and COMMERCIAL-INSTALLER-BACKLOG. Live enable remains blocked only on org secret store / clean VM — no secret values invented.
3.4 KiB
VM C one-pager — enable CAs → MSI → smoke → sign dry-run → manifest
Issue 1 commercial MSI path for clean-VM C (printer CA parity). Narrative: DUAL-SHIP.md. Printable A/B/C ticks: VM-DUAL-SHIP-CHECKLIST.md. Still left: OPEN-ISSUES Issue 1 (Commercial MSI / notarize).
From repo root on Windows (Go + WiX v3 candle/light on PATH). HelperVersion 0.3.6 unless VERSION= override.
# 1) Enable deferred printer CAs in Product-Full.wxs (default tree is OFF)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1 -Status
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1
# 2) Rebuild elevated full MSI (StageFull → candle/light)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\build-full-msi.ps1
# 3) Offline dual-ship smoke + local artifact existence/hash (does not install/drive VM)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\dual-ship-smoke.ps1 -VerifyArtifacts
# 4) Authenticode dry-run only (find signtool; verify unsigned; print cmds — no secrets, no sign)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\sign-dry-run.ps1
# 5) SHA-256 → DOWNLOADS-MANIFEST rows (no upload; paste TBD only after CDN)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 `
-Path .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-0.3.6.msi
# optional NSIS leg:
# -Path .\dist\VeraePrintStamp-windows-amd64-0.3.6-setup.exe, .\platform\windows\wix\out\...
| Step | Script | Does | Does not |
|---|---|---|---|
| 1 | enable-printer-cas.ps1 |
Unwrap DEFERRED_PRINTER_CAS body |
Build, install, dual-ship pass |
| 2 | build-full-msi.ps1 |
StageFull + MSI under wix/out/ |
Authenticode; exit 1 if WiX missing |
| 3 | dual-ship-smoke.ps1 -VerifyArtifacts |
Print A/B/C; hash local MSI/NSIS | Drive a VM; replace clean-VM C sign-off |
| 4 | sign-dry-run.ps1 |
signtool verify + print sign templates |
Live sign / org secrets |
| 5 | fill-manifest-sha256.ps1 |
Print SHA256SUMS / MD rows | Upload or edit site files |
Then on clean VM C (checklist § VM C): default elevated MSI (or VERAE_SKIP_PRINTERS=0) → files + IPP/127.0.0.1:8631 + Verae Print Helper task + one-page PDF stamp (receipt/CID ≠ jobId) → uninstall clean. Parity with VM A required.
Rules
- Enabling CAs + rebuilding is not dual-ship complete — DUAL-SHIP.md thin-NSIS exit A–D still open.
- NSIS stays primary until live Authenticode + VM C sign-off + site cutover.
- Hold / jobId is never evidence.
- Re-disable CAs for files-only tree:
enable-printer-cas.ps1 -Disable.
Operator package: OPERATOR-READY.md — all four external legs (sign / notary / VM C / digests) with commands + secret names. Status: READY: blocked only on org secret/VM.
Still left (org-side only): org secrets for live CI sign; live notary (macOS); clean-VM C sign-off; paste real digests after upload — see OPEN-ISSUES row 1 · PUBLISH-DIGESTS.md · CI-SIGN-NOTARY.md.