marchon/PrintToVeraeTimeStamp
Watch
1
0
Fork
You've already forked PrintToVeraeTimeStamp
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
PrintToVeraeTimeStamp/platform/windows/wix/VM-C-ONE-PAGER.md
George Lambert a15db6ffc7
Some checks failed
windows-msi / full-msi-unsigned (push) Has been cancelled
Details
docs: VM-C-ONE-PAGER single-page dual-ship printer CA unlock path 
enable-printer-cas → build-full-msi → dual-ship-smoke → sign-dry-run → fill-manifest.
2026-10-14 01:30:49 -04:00

3.2 KiB
Raw Blame History

VM C one-pager — enable CAs → MSI → smoke → sign dry-run → manifest

Issue 1 commercial MSI path for clean-VM C (printer CA parity). Narrative: DUAL-SHIP.md. Printable A/B/C ticks: VM-DUAL-SHIP-CHECKLIST.md. Still left: OPEN-ISSUES Issue 1 (Commercial MSI / notarize).

From repo root on Windows (Go + WiX v3 candle/light on PATH). HelperVersion 0.3.6 unless VERSION= override.

# 1) Enable deferred printer CAs in Product-Full.wxs (default tree is OFF)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1 -Status
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1

# 2) Rebuild elevated full MSI (StageFull → candle/light)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\build-full-msi.ps1

# 3) Offline dual-ship smoke + local artifact existence/hash (does not install/drive VM)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\dual-ship-smoke.ps1 -VerifyArtifacts

# 4) Authenticode dry-run only (find signtool; verify unsigned; print cmds — no secrets, no sign)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\sign-dry-run.ps1

# 5) SHA-256 → DOWNLOADS-MANIFEST rows (no upload; paste TBD only after CDN)
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 `
  -Path .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-0.3.6.msi
# optional NSIS leg:
#   -Path .\dist\VeraePrintStamp-windows-amd64-0.3.6-setup.exe, .\platform\windows\wix\out\...
Step Script Does Does not
1 enable-printer-cas.ps1 Unwrap DEFERRED_PRINTER_CAS body Build, install, dual-ship pass
2 build-full-msi.ps1 StageFull + MSI under wix/out/ Authenticode; exit 1 if WiX missing
3 dual-ship-smoke.ps1 -VerifyArtifacts Print A/B/C; hash local MSI/NSIS Drive a VM; replace clean-VM C sign-off
4 sign-dry-run.ps1 signtool verify + print sign templates Live sign / org secrets
5 fill-manifest-sha256.ps1 Print SHA256SUMS / MD rows Upload or edit site files

Then on clean VM C (checklist § VM C): default elevated MSI (or VERAE_SKIP_PRINTERS=0) → files + IPP/127.0.0.1:8631 + Verae Print Helper task + one-page PDF stamp (receipt/CID ≠ jobId) → uninstall clean. Parity with VM A required.

Rules

  • Enabling CAs + rebuilding is not dual-ship complete — DUAL-SHIP.md thin-NSIS exit A–D still open.
  • NSIS stays primary until live Authenticode + VM C sign-off + site cutover.
  • Hold / jobId is never evidence.
  • Re-disable CAs for files-only tree: enable-printer-cas.ps1 -Disable.

Still left (Issue 1): org secrets for live CI sign; live notary (macOS); clean-VM C sign-off; paste real digests after upload — see OPEN-ISSUES row 1 · PUBLISH-DIGESTS.md · CI-SIGN-NOTARY.md.