search

Voxelum / x-minecraft-launcher

An Open Source Minecraft Launcher with Modern UX. Provide a Disk Efficient way to manage all your Mods!
https://xmcl.app/
MIT License
614 stars 93 forks source link

appx Installer has Untrusted Certificate #590

Open AngellusMortis opened 4 months ago

AngellusMortis commented 4 months ago

Is there an existing issue for this?

Launcher Version

v0.40.0+

Operating System

Windows

Architecture

x64

Current Behavior

It seems like any version of the launcher past v0.39.17 is not able to be installed on Windows. The appx installer package has an untrusted certificate. This also causes auto-update to break as well.

Expected Behavior

appx / auto-update should work

Steps To Reproduce

  1. Download appx installer for version newer then v0.39.17
  2. Attempt to install

Anything else?

No response

ci010 commented 4 months ago

My code sign certificate is expired, and due to the new policy, the OV certifiacte cannot sign without hardware token device. So the current pipeline won't work anymore.

I'm currently applying the code sign from signpath. The signpath will support the github action in one month.

I think after the signpath github action is GA, we can bring the appx back.

Soham52 commented 1 month ago

My code sign certificate is expired, and due to the new policy, the OV certifiacte cannot sign without hardware token device. So the current pipeline won't work anymore.

I'm currently applying the code sign from signpath. The signpath will support the github action in one month.

I think after the signpath github action is GA, we can bring the appx back.

I know that you must be trying to fix this, but when will this be fixed?

ci010 commented 1 month ago

I'm on the waitlist of Sign Path. It seems the https://github.com/SignPath/github-actions is already stable. I will send an email to apply the certificate again in next week.

NAKADZI commented 3 weeks ago

@ci010 It's been a month since your last reply, and more than two months since the APPX packaging disappeared if I'm not mistaken. Have you still not received a certificate?

I think it would be better to get rid of the APPX packaging in favor of the simpler Winget packaging and delivery method (which is integrated in modern versions of Windows 10/11), or use it as an alternative option alongside APPX packaging.

ci010 commented 3 weeks ago

I've submit the form to signpath.io and for some reason I still didn't get reply yet. I will ping the contact again if there is no reply this week

Soham52 commented 1 week ago

@ci010 Haven't you received a reply yet?

ci010 commented 1 week ago

@ci010 Haven't you received a reply yet?

I got the signpath certificate, but it's currently still beta, which mean it can only sign for testing not for production. We still need to wait it ready for production singing.