Introduces initial support for signing MSIX/MSIX Bundle files as an addition over the existing signappx code.
Why
Microsoft has not published official guidelines of how MSIX signing actually works, but trial and error shows that for the most part it is compatible with APPX signing, which several tools implement, despite that not being documented either.
How
When processing MSIX bundle files, avoid adding .msix packages into the BlockMap and messing the hashes.
When verifying the signature, do not enforce code integrity and catalog verification on resource packages, which do not and should not contain them.
Fix the bin patch codepath where the initial patch start was determined prior to adding all the files in the output package, and therefore the central directory of the zip file could end up misplaced; instead, calculate the path start once we know its final position
What
Introduces initial support for signing MSIX/MSIX Bundle files as an addition over the existing signappx code.
Why
Microsoft has not published official guidelines of how MSIX signing actually works, but trial and error shows that for the most part it is compatible with APPX signing, which several tools implement, despite that not being documented either.
How