ci: build a test-signed MSI installer

.github/workflows/build.yml

@@ -11,10 +11,10 @@ name: build-and-package
 on:
   workflow_dispatch:
   push:
-    branches: [master]
+    branches: [master, vnext]
     tags: ["v*"]
+  # Every PR, including ones stacked on other PR branches or on vnext.
   pull_request:
-    branches: [master]
 
 permissions:
   contents: read
@@ -242,3 +242,108 @@ jobs:
           name: sar-asio-${{ matrix.platform }}
           path: artifacts/${{ matrix.platform }}/
           if-no-files-found: error
+
+  # ---------------------------------------------------------------------------
+  # MSI installer around the TEST-SIGNED driver, for manual testing on machines
+  # with test signing enabled. A release MSI needs the attestation-signed
+  # driver instead; that comes after signing, not from this job.
+  # ---------------------------------------------------------------------------
+  installer:
+    name: installer (x64, test-signed)
+    needs: [driver, usermode]
+    runs-on: windows-2022
+    env:
+      WIX_URL: https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip
+      WIX_SHA256: 6ac824e1642d6f7277d0ed7ea09411a508f6116ba6fae0aa5f2c7daa2ff43d31
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Add MSBuild to PATH
+        uses: microsoft/setup-msbuild@v2
+        with:
+          vs-version: "[17.0,18.0)"
+
+      - name: Install WiX 3.14
+        shell: pwsh
+        run: |
+          # Pinned binaries zip rather than whatever the runner image carries.
+          $zip = "$env:RUNNER_TEMP\wix.zip"
+          Invoke-WebRequest $env:WIX_URL -OutFile $zip
+          $hash = (Get-FileHash $zip -Algorithm SHA256).Hash
+          if ($hash -ne $env:WIX_SHA256) { throw "WiX zip hash mismatch: $hash" }
+          $wix = "$env:RUNNER_TEMP\wix314"
+          Expand-Archive $zip $wix
+          # SarInstallerActions.vcxproj expects $(WIX) with a trailing slash.
+          "WIX=$wix\" | Out-File $env:GITHUB_ENV -Append
+
+      - name: Build custom actions
+        shell: pwsh
+        run: |
+          & msbuild SynchronousAudioRouter.sln /t:SarInstallerActions `
+              /p:Configuration=Release /p:Platform=x64 /m /verbosity:minimal /nologo
+          if ($LASTEXITCODE -ne 0) { throw "msbuild failed (exit $LASTEXITCODE)" }
+
+      - name: Download test-signed driver
+        uses: actions/download-artifact@v4
+        with:
+          name: sar-driver-x64-testsigned
+          path: stage/driver
+
+      - name: Download SarAsio (x64)
+        uses: actions/download-artifact@v4
+        with:
+          name: sar-asio-x64
+          path: stage/x64
+
+      - name: Download SarAsio (x86)
+        uses: actions/download-artifact@v4
+        with:
+          name: sar-asio-x86
+          path: stage/x86
+
+      - name: Build MSI
+        shell: pwsh
+        run: |
+          $stage = (Resolve-Path stage).Path
+          Copy-Item x64/Release/SarInstallerActions.dll "$stage/x64" -Force
+          # MSI versions compare major.minor.build only; the run number in the
+          # fourth field just labels the build (same-version upgrades are on).
+          $version = "0.13.99.$env:GITHUB_RUN_NUMBER"
+          # A response file keeps the semicolons in DefineConstants away from
+          # PowerShell's argument quoting; msbuild splits them into -d defines.
+          @(
+            "/p:Configuration=Release"
+            "/p:Platform=x64"
+            "/p:WixInstallPath=$env:WIX"
+            "/p:WixTargetsPath=$env:WIX\wix.targets"
+            "/p:DefineConstants=`"ProductVersion=$version;Bin64=$stage\x64;Bin32=$stage\x86;DriverDir=$stage\driver`""
+          ) | Out-File "$env:RUNNER_TEMP\installer.rsp" -Encoding ascii
+          & msbuild SarInstaller/SarInstaller.wixproj "@$env:RUNNER_TEMP\installer.rsp" /verbosity:minimal /nologo
+          if ($LASTEXITCODE -ne 0) { throw "msbuild failed (exit $LASTEXITCODE)" }
+
+          $out = 'artifacts/installer-x64-testsigned'
+          New-Item -ItemType Directory -Force -Path $out | Out-Null
+          Copy-Item SarInstaller/bin/x64/Release/SynchronousAudioRouter.msi "$out/SynchronousAudioRouter-$version-x64-testsigned.msi"
+          Copy-Item "$stage/driver/testsign.cer" $out
+          $lines = Get-ChildItem $out -File | Get-FileHash -Algorithm SHA256 |
+                   ForEach-Object { '{0}  {1}' -f $_.Hash, (Split-Path $_.Path -Leaf) }
+          $lines | Out-File "$out/SHA256SUMS.txt" -Encoding ascii
+          @"
+          TEST-SIGNED installer: the driver inside only loads with test signing on.
+          Not for distribution. On the test machine, as administrator:
+
+            bcdedit /set testsigning on      (then reboot; Secure Boot must be off)
+            certutil -addstore Root testsign.cer
+            certutil -addstore TrustedPublisher testsign.cer
+            msiexec /i SynchronousAudioRouter-$version-x64-testsigned.msi
+
+          Every CI run signs with a fresh certificate, so trust this run's
+          testsign.cer before installing this run's MSI.
+          "@ | Out-File "$out/README.txt" -Encoding ascii
+
+      - name: Upload installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: sar-installer-x64-testsigned
+          path: artifacts/installer-x64-testsigned/
+          if-no-files-found: error

BUILDING.md

@@ -71,9 +71,11 @@ These are tracked here so nothing is silently missing:
 - **`DriverVer` in source.** The committed INF still has the placeholder
   `DriverVer=0.1`; the pipeline stamps a valid value at build time but the source
   value should eventually be fixed too.
-- **Installer (MSI).** The WiX `SarInstaller` project is not built by this
-  pipeline yet (needs the WiX 3.x toolset on the runner). The driver package is
-  sufficient for signing; the MSI is a packaging convenience to add back later.
+- **Release installer (MSI).** The `installer` job builds the WiX
+  `SarInstaller` project (pinned WiX 3.14 binaries) around the *test-signed*
+  driver, as artifact `sar-installer-x64-testsigned`, for manual testing on
+  machines with test signing on (see the README.txt inside). A redistributable
+  MSI needs the attestation-signed driver, so it has to be built after signing.
 - **EWDK alternative.** For maximum reproducibility you can swap the
   `Install-WdkBuildEnv.ps1` step for a pinned **Enterprise WDK** ISO (a fully
   self-contained, version-locked build environment). That removes the dependency

SarInstaller/Product.wxs

@@ -1,11 +1,16 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <?define bitness = "(64 bit)" ?>
+<!-- Build outputs; CI overrides these to point at its staged artifacts. -->
+<?ifndef ProductVersion ?><?define ProductVersion = "0.13.99.1" ?><?endif ?>
+<?ifndef Bin64 ?><?define Bin64 = "..\x64\Release" ?><?endif ?>
+<?ifndef Bin32 ?><?define Bin32 = "..\Release" ?><?endif ?>
+<?ifndef DriverDir ?><?define DriverDir = "$(var.Bin64)\SynchronousAudioRouter" ?><?endif ?>
 
 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
      xmlns:difx="http://schemas.microsoft.com/wix/DifxAppExtension">
 	<Product Id="*"
            Name="Synchronous Audio Router $(var.bitness)"
-           Language="1033" Version="0.13.99.1"
+           Language="1033" Version="$(var.ProductVersion)"
            Manufacturer="Many Worlds"
            UpgradeCode="8cae7fd4-4469-4cc1-ba9a-76c00fbb5e05">
 		<Package InstallerVersion="200" Compressed="yes"
@@ -31,7 +36,7 @@
 	</Feature>
 
     <Binary Id="SarInstallerActions"
-            SourceFile="..\x64\Release\SarInstallerActions.dll"/>
+            SourceFile="$(var.Bin64)\SarInstallerActions.dll"/>
 
     <CustomAction Id="CreateDeviceNode.SetProperty"
                   Return="check"
@@ -80,15 +85,15 @@
                  Win64="yes">
         <File Id="SynchronousAudioRouter.sys"
               Name="SynchronousAudioRouter.sys"
-              Source="..\x64\Release\SynchronousAudioRouter.sys"
+              Source="$(var.DriverDir)\SynchronousAudioRouter.sys"
               KeyPath="yes"/>
         <File Id="SynchronousAudioRouter.cat"
               Name="SynchronousAudioRouter.cat"
-              Source="..\x64\Release\SynchronousAudioRouter\SynchronousAudioRouter.cat"
+              Source="$(var.DriverDir)\SynchronousAudioRouter.cat"
               KeyPath="no"/>
         <File Id="SynchronousAudioRouter.inf"
               Name="SynchronousAudioRouter.inf"
-              Source="..\x64\Release\SynchronousAudioRouter\SynchronousAudioRouter.inf"
+              Source="$(var.DriverDir)\SynchronousAudioRouter.inf"
               KeyPath="no"/>
         <difx:Driver PlugAndPlayPrompt="no"/>
       </Component>
@@ -98,7 +103,7 @@
                  Win64="yes">
         <File Id="SarAsio_x64.dll"
               Name="SarAsio_x64.dll"
-              Source="..\x64\Release\SarAsio.dll"
+              Source="$(var.Bin64)\SarAsio.dll"
               KeyPath="yes"/>
         <!--<File Id="SarCtl.exe" Source="..\x64\Release\SarCtl.exe" KeyPath="no"/>-->
         <RegistryValue Root="HKCR"
@@ -161,7 +166,7 @@
                  Win64="yes">
         <File Id="SarAsio_x64_32.dll"
               Name="SarAsio.dll"
-              Source="..\Release\SarAsio.dll"
+              Source="$(var.Bin32)\SarAsio.dll"
               KeyPath="yes"/>
         <RegistryValue Root="HKLM"
                        Key="SOFTWARE\Wow6432Node\Classes\CLSID\{0569D852-1F6A-44A7-B7B5-EFB78B66BE21}\InProcServer32"
@@ -222,7 +227,7 @@
                  Win64="yes">
         <File Id="SarConfigure.exe"
               Name="SarConfigure.exe"
-              Source="..\x64\Release\SarConfigure.exe"
+              Source="$(var.Bin64)\SarConfigure.exe"
               KeyPath="yes"/>
       </Component>
     </DirectoryRef>

SarInstaller/SarInstaller.wixproj

@@ -55,13 +55,13 @@
   </ItemGroup>
   <ItemGroup Condition="'$(Platform)' == 'x64'">
     <WixLibrary Include="difxapp_x64">
-      <HintPath>..\..\..\..\..\Program Files (x86)\WiX Toolset v3.10\bin\difxapp_x64.wixlib</HintPath>
+      <HintPath>$(WixExtDir)\difxapp_x64.wixlib</HintPath>
       <Name>difxapp_x64</Name>
     </WixLibrary>
   </ItemGroup>
   <ItemGroup Condition="'$(Platform)' == 'x86'">
     <WixLibrary Include="difxapp_x86">
-      <HintPath>..\..\..\..\..\Program Files (x86)\WiX Toolset v3.10\bin\difxapp_x86.wixlib</HintPath>
+      <HintPath>$(WixExtDir)\difxapp_x86.wixlib</HintPath>
       <Name>difxapp_x86</Name>
     </WixLibrary>
   </ItemGroup>

SarInstallerActions/SarInstallerActions.vcxproj

@@ -93,7 +93,7 @@
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
       <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(WIX)sdk\inc;$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CUSTOMACTIONTEST_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <MinimalRebuild>true</MinimalRebuild>
       <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
@@ -114,7 +114,7 @@
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <ClCompile>
       <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(WIX)sdk\inc;$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CUSTOMACTIONTEST_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
@@ -134,7 +134,7 @@
     <ClCompile>
       <Optimization>MaxSpeed</Optimization>
       <IntrinsicFunctions>true</IntrinsicFunctions>
-      <AdditionalIncludeDirectories>$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(WIX)sdk\inc;$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CUSTOMACTIONTEST_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <FunctionLevelLinking>true</FunctionLevelLinking>
@@ -157,7 +157,7 @@
     <ClCompile>
       <Optimization>MaxSpeed</Optimization>
       <IntrinsicFunctions>true</IntrinsicFunctions>
-      <AdditionalIncludeDirectories>$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(WIX)sdk\inc;$(WIX)sdk\VS2015\inc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CUSTOMACTIONTEST_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <FunctionLevelLinking>true</FunctionLevelLinking>