Skip to content

feat(package): add MSIX/MSI/AppX package, resource, and signature analysis - #450

Merged
morluto merged 1 commit into
mainfrom
codex/msix-msi-appx-363
Jul 28, 2026
Merged

feat(package): add MSIX/MSI/AppX package, resource, and signature analysis#450
morluto merged 1 commit into
mainfrom
codex/msix-msi-appx-363

Conversation

@morluto

@morluto morluto commented Jul 28, 2026

Copy link
Copy Markdown
Owner

Summary

Add static analysis for MSIX, MSI, AppX packages, their resources, and digital signatures.

Closes #363.

Changes

  • Package formats: MSIX, MSI, AppX with detection from file extensions
  • Resource types: manifest, icon, configuration, certificate, executable, library, data, other
  • Resource classification: Identifies resource type from path (manifest XML, icons, configs, executables, libraries, certificates)
  • Digital signatures: Tracks signed state, signer subject, certificate thumbprint, validity, timestamping
  • Package metadata: Name, publisher, version, architecture, framework flag, dependencies, capabilities

Verification

npm run typecheck   # passes
npx vitest run tests/packageAnalysis.test.ts  # 8 tests pass

Acceptance criteria

  • ✅ Package and resource contents are inventoried without execution
  • ✅ Signature and container metadata are evidence-backed

Continue this on Linzumi

@cursor

cursor Bot commented Jul 28, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

…lysis

Add static analysis for MSIX, MSI, AppX packages, their resources,
and digital signatures (#363).

- packageAnalysis.ts: domain schemas for Windows package formats
  (MSIX, MSI, AppX), resources (manifest, icon, configuration,
  certificate, executable, library, data), and digital signatures.
- detectPackageFormat: classifies from file extension
- classifyResource: identifies resource type from path
- Digital signature validation with timestamp detection
- Package and resource contents are inventoried without execution

Closes #363
@morluto
morluto force-pushed the codex/msix-msi-appx-363 branch from 744e4a0 to 6c03f83 Compare July 28, 2026 05:42
@morluto
morluto merged commit 0ef1b91 into main Jul 28, 2026
13 checks passed
@morluto
morluto deleted the codex/msix-msi-appx-363 branch July 28, 2026 06:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add MSIX/MSI/AppX package, resource, and signature analysis

1 participant