George Lambert
778763737e
Some checks failed
windows-msi / full-msi-unsigned (push) Has been cancelled
Consolidate Authenticode, Apple notary, VM C, and digest-paste into platform/windows/wix/OPERATOR-READY.md (runbook + commands + secret names only). Cross-link from CI-SIGN-NOTARY, VM-C-ONE-PAGER, PACKAGING, and COMMERCIAL-INSTALLER-BACKLOG. Live enable remains blocked only on org secret store / clean VM — no secret values invented.
47 lines
3.4 KiB
Markdown
47 lines
3.4 KiB
Markdown
# VM C one-pager — enable CAs → MSI → smoke → sign dry-run → manifest
|
||
|
||
**Issue 1** commercial MSI path for clean-VM **C** (printer CA parity). Narrative: [DUAL-SHIP.md](DUAL-SHIP.md). Printable A/B/C ticks: [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md). Still left: [OPEN-ISSUES Issue 1](../../../../verae-2026-screens/OPEN-ISSUES.md) (Commercial MSI / notarize).
|
||
|
||
**From repo root on Windows** (Go + WiX v3 `candle`/`light` on PATH). HelperVersion **0.3.6** unless `VERSION=` override.
|
||
|
||
```powershell
|
||
# 1) Enable deferred printer CAs in Product-Full.wxs (default tree is OFF)
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1 -Status
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1
|
||
|
||
# 2) Rebuild elevated full MSI (StageFull → candle/light)
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\build-full-msi.ps1
|
||
|
||
# 3) Offline dual-ship smoke + local artifact existence/hash (does not install/drive VM)
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\dual-ship-smoke.ps1 -VerifyArtifacts
|
||
|
||
# 4) Authenticode dry-run only (find signtool; verify unsigned; print cmds — no secrets, no sign)
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\sign-dry-run.ps1
|
||
|
||
# 5) SHA-256 → DOWNLOADS-MANIFEST rows (no upload; paste TBD only after CDN)
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 `
|
||
-Path .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-0.3.6.msi
|
||
# optional NSIS leg:
|
||
# -Path .\dist\VeraePrintStamp-windows-amd64-0.3.6-setup.exe, .\platform\windows\wix\out\...
|
||
```
|
||
|
||
| Step | Script | Does | Does **not** |
|
||
|------|--------|------|----------------|
|
||
| 1 | `enable-printer-cas.ps1` | Unwrap `DEFERRED_PRINTER_CAS` body | Build, install, dual-ship pass |
|
||
| 2 | `build-full-msi.ps1` | StageFull + MSI under `wix/out/` | Authenticode; exit 1 if WiX missing |
|
||
| 3 | `dual-ship-smoke.ps1 -VerifyArtifacts` | Print A/B/C; hash local MSI/NSIS | Drive a VM; replace clean-VM C sign-off |
|
||
| 4 | `sign-dry-run.ps1` | `signtool verify` + print sign templates | Live sign / org secrets |
|
||
| 5 | `fill-manifest-sha256.ps1` | Print SHA256SUMS / MD rows | Upload or edit site files |
|
||
|
||
**Then on clean VM C** (checklist § VM C): default elevated MSI (or `VERAE_SKIP_PRINTERS=0`) → files + IPP/`127.0.0.1:8631` + **Verae Print Helper** task + one-page PDF stamp (receipt/CID ≠ jobId) → uninstall clean. Parity with VM A required.
|
||
|
||
**Rules**
|
||
|
||
- Enabling CAs + rebuilding is **not** dual-ship complete — [DUAL-SHIP.md](DUAL-SHIP.md) thin-NSIS exit **A–D** still open.
|
||
- NSIS stays **primary** until live Authenticode + VM C sign-off + site cutover.
|
||
- Hold / jobId is never evidence.
|
||
- Re-disable CAs for files-only tree: `enable-printer-cas.ps1 -Disable`.
|
||
|
||
**Operator package:** [OPERATOR-READY.md](OPERATOR-READY.md) — all four external legs (sign / notary / VM C / digests) with commands + secret **names**. Status: **READY: blocked only on org secret/VM**.
|
||
|
||
**Still left (org-side only):** org secrets for live CI sign; live notary (macOS); clean-VM **C** sign-off; paste real digests after upload — see [OPEN-ISSUES](../../../../verae-2026-screens/OPEN-ISSUES.md) row 1 · [PUBLISH-DIGESTS.md](../../../docs/PUBLISH-DIGESTS.md) · [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md).
|