feat: support completely custom AppxManifest.xml

[iongion]

PR tries to give total control over the manifest to the users.

To provide mitigation for issues like

• Custom AppXManifest.xml template #3072
• Invalid Identity.Publisher in AppxManifest.xml #3501
• Question: AppxManifest.xml - MaxVersionTested attribute - windows firewall rules - desktop2 namespace #6745

[changeset-bot]

🦋 Changeset detected

Latest commit: 7f59a95

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
app-builder-lib	Major
dmg-builder	Major
electron-builder-squirrel-windows	Major
electron-builder	Major
electron-forge-maker-appimage	Major
electron-forge-maker-nsis-web	Major
electron-forge-maker-nsis	Major
electron-forge-maker-snap	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[mmaietta]

Thanks for the contribution! 🙂

This functionality should already exist in an electron-builder Hook though. It's passed a path to the file on disk, just replace the file at that path?

electron-builder/packages/app-builder-lib/src/configuration.ts

Lines 343 to 346 in 74d98d8

	/**
	* The function (or path to file or module id) to be run after Appx manifest created on disk - not packed into .appx package yet.
	*/
	readonly appxManifestCreated?: Hook<string, any> | string | null

[iongion]

@mmaietta It is very confusing - I don't see how appxManifestCreated hook is returning a totally new manifest or something to replace the default path.

I think the PR should offer a way to replace two types of manifests, one just like the default, that has template variables and one raw XML - as is, no interpolation at all.

So that if should just become

const manifestFile = this.options.customManifestPath || stageDir.getTempFile("AppxManifest.xml")
await this.writeManifest(manifestFile, arch, await this.computePublisherName(), userAssets)

But I don't know how distinguish between raw and template based one.

[iongion]

I think I got it, but let's say we have this

• Question: AppxManifest.xml - MaxVersionTested attribute - windows firewall rules - desktop2 namespace #6745

So to support such a thing, the original template namespaces must be extended, plus new expressions for extensions.

If one would have direct template access, he could just

1. Add extra namespace to root element

xmlns:desktop2="http://schemas.microsoft.com/appx/manifest/desktop/windows10/2"

2. Added the desktop2 rules for the firewall inside the inner most Application node

      <Extensions>
        <desktop2:Extension Category="windows.firewallRules">
          <desktop2:FirewallRules>
            <desktop2:Rule Direction="in" Protocol="TCP" LocalPortMin="22022" LocalPortMax="24044" Profile="all" Action="allow" />
          </desktop2:FirewallRules>
        </desktop2:Extension>
      </Extensions>

With the existing hook, I came up to this - it does the job, but it is horrendous

  appxManifestCreated: async (appxPath) => {
    const manifest = await xml2js.parseStringPromise(fs.readFileSync(appxPath, "utf8").toString());
    manifest.Package.$["xmlns:desktop2"] = "http://schemas.microsoft.com/appx/manifest/desktop/windows10/2";
    const application = manifest.Package.Applications[0].Application[0];
    application.Extensions = application.Extensions || [];
    application.Extensions.push({
      "desktop2:Extension": {
        $: {
          Category: "windows.fileTypeAssociation",
        },
        "desktop2:FirewallRules": {
          "desktop2:Rule": {
            $: {
              Direction: "in",
              Profile: "private",
              Protocol: "TCP",
              LocalPortMin: "22022",
              LocalPortMax: "24044",
              Action: "allow",
            },
          },
        },
      },
    });
    const builder = new xml2js.Builder();
    const manifestDocument = builder.buildObject(manifest);
    fs.writeFileSync(appxPath, manifestDocument);
  }

[mmaietta]

Ohhhh I see, you want to be able to provide a custom AppxManifest that allows for both template or raw. The hook only allows to replace the file with a raw manifest.

But I don't know how distinguish between raw and template based one.

What if we allow both? Let the writeManifest parse for template vars, if none found, then the logic does no replacement. It think it should only require pulling in the temp file into the writeManifest function and alter the signature to return the file path

private async writeManifest(arch: Arch, publisher: string, userAssets: Array<string>): string {
   const outFile = stageDir.getTempFile("AppxManifest.xml")
   // logic
   const manifest = (await readFile(this.options.customManifestPath || path.join(getTemplatePath("appx"), "appxmanifest.xml"), "utf8"))).replace(/\${([a-zA-Z0-9]+)}/g, (match, p1): string => {
   // more logic

Related note, I'll also need two unit test cases written for this functionality if we go with that approach ☝️ . One with a raw manifest, and the other with a template manifest. I'm happy to help contribute to this PR by writing the unit tests, but I'll need both manifests from you committed to this branch first for me to build on top of 😄

[iongion]

That's great

Here it is a manifest that totally works for my project https://container-desktop.com

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10" xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10" xmlns:desktop="http://schemas.microsoft.com/appx/manifest/desktop/windows10" xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities" xmlns:desktop2="http://schemas.microsoft.com/appx/manifest/desktop/windows10/2">
  <Identity Name="IonutStoica.ContainerDesktop" ProcessorArchitecture="x64" Publisher="CN=52408AA8-2ECC-4E48-9A2C-6C1F69841C79" Version="5.2.13.0"/>
  <Properties>
    <DisplayName>Container Desktop</DisplayName>
    <PublisherDisplayName>Ionut.Stoica</PublisherDisplayName>
    <Description>Container Desktop</Description>
    <Logo>assets\StoreLogo.png</Logo>
  </Properties>
  <Resources>
    <Resource Language="en-US"/>
  </Resources>
  <Dependencies>
    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.18362.0" MaxVersionTested="10.0.18362.0"/>
  </Dependencies>
  <Capabilities>
    <Capability Name="internetClient"/>
    <Capability Name="privateNetworkClientServer"/>
    <rescap:Capability Name="runFullTrust"/>
  </Capabilities>
  <Applications>
    <Application Id="IonutStoica.ContainerDesktop" Executable="app\Container Desktop.exe" EntryPoint="Windows.FullTrustApplication">
      <uap:VisualElements BackgroundColor="#464646" DisplayName="Container Desktop" Square150x150Logo="assets\Square150x150Logo.png" Square44x44Logo="assets\Square44x44Logo.png" Description="Container Desktop">
        <uap:DefaultTile Wide310x150Logo="assets\Wide310x150Logo.png" Square310x310Logo="assets\LargeTile.png" Square71x71Logo="assets\SmallTile.png"/>
      </uap:VisualElements>
    </Application>
  </Applications>
  <Extensions>
    <desktop2:Extension Category="windows.firewallRules">
      <desktop2:FirewallRules Executable="app\bin\container-desktop-ssh-relay.exe">
        <desktop2:Rule Direction="in" Profile="private" IPProtocol="TCP" LocalPortMin="22022" LocalPortMax="24044"/>
      </desktop2:FirewallRules>
    </desktop2:Extension>
  </Extensions>
</Package>

To generate this manifest with the hook, I had to do this:

  appxManifestCreated: async (appxPath) => {
    const manifest = await xml2js.parseStringPromise(fs.readFileSync(appxPath, "utf8").toString());
    manifest.Package.$["xmlns:uap"] = "http://schemas.microsoft.com/appx/manifest/uap/windows10";
    manifest.Package.$["xmlns:desktop"] = "http://schemas.microsoft.com/appx/manifest/desktop/windows10";
    manifest.Package.$["xmlns:desktop2"] = "http://schemas.microsoft.com/appx/manifest/desktop/windows10/2";
    manifest.Package.Capabilities = [
      [
        { Capability: { $: { Name: "internetClient" } } },
        { Capability: { $: { Name: "privateNetworkClientServer" } } },
        { "rescap:Capability": { $: { Name: "runFullTrust" } } },
      ],
    ];
    manifest.Package.Extensions = manifest.Package.Extensions || [];
    manifest.Package.Extensions.push({
      "desktop2:Extension": {
        $: {
          Category: "windows.firewallRules",
        },
        "desktop2:FirewallRules": {
          $: {
            Executable: "app\\bin\\container-desktop-ssh-relay.exe",
          },
          "desktop2:Rule": {
            $: {
              Direction: "in",
              Profile: "private",
              IPProtocol: "TCP",
              LocalPortMin: "22022",
              LocalPortMax: "24044",
            },
          },
        },
      },
    });
    const builder = new xml2js.Builder();
    const manifestDocument = builder.buildObject(manifest);
    fs.writeFileSync(appxPath, manifestDocument);
  }

Because of the use of xml2js it generates totally safe XML - now I don't know what to say, your recommendation worked perfectly but is hard for the brain, no existing examples, hard to even find documentation on Microsoft, best thing for me was to lookup in all the apps I installed from Microsoft Store and inspire from them, for example, the firewall rules are from Skype's manifest.

You can close the ticket and not do anything if we can somehow improve just the documentation on how to use the custom hook with good examples as above as it touches all points. Basically Custom anything inside the Appx template - and also XML safe!

[mmaietta]

Thanks! Alrighty, I can take it from here if you'd like (unless you have commits to still push 🙂 )

Thoughts on having the manifest default to reading from the Resources dir unless it's an absolute path?

[iongion]

Nothing more to add, go for it, thank you so much!

[mmaietta]

@iongion PR is ready but I need the snapshots regenerated for it as I can't build the AppX on my mac M2.
Can you please run this from cmd line after pulling in the latest changes in this PR?

pnpm compile && UPDATE_SNAPSHOT=true TEST_FILES=appxTest pnpm ci:test

[iongion]

Just did, it needs some changes

1. I had to modify the command you share so that it works in powershell, just needed to prefix the env part with cross-env (from https://www.npmjs.com/package/cross-env)

pnpm compile && cross-env UPDATE_SNAPSHOT=true TEST_FILES=appxTest pnpm ci:test

2. Needed to use "${executable}" as the firewall rules need to find one that exists, so let's just use the default one

    <desktop2:FirewallRules Executable="${executable}">
      <desktop2:Rule Direction="in" Profile="private" IPProtocol="TCP" LocalPortMin="22022" LocalPortMax="24044"/>
    </desktop2:FirewallRules>

3. Modified the snapshot too

    <desktop2:FirewallRules Executable="app\\Test App ßW.exe">
      <desktop2:Rule Direction="in" Profile="private" IPProtocol="TCP" LocalPortMin="22022" LocalPortMax="24044"/>
    </desktop2:FirewallRules>

4. Had to provide a custom path to a more recent signtool

$env:SIGNTOOL_PATH="C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe"

5. Finally ran the tests

pnpm compile && cross-env UPDATE_SNAPSHOT=true TEST_FILES=appxTest pnpm ci:test

Now all tests pass

> @electron-builder/monorepo@ compile C:\Workspace\is\electron-builder
> tsc --build


> @electron-builder/monorepo@ ci:test C:\Workspace\is\electron-builder
> node ./test/out/helpers/runTests.js

Test files: appxTest
electron-builder  version=26.0.0-alpha.3 os=10.0.22631
loaded configuration  file=package.json ("build" field)
writing effective config  file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\builder-effective-config.yaml
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=x64 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\win-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\win-unpacked\Test App ßW.exe
executing @electron/fuses  electronPath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\win-unpacked\Test App ßW.exe
empty password will be used for code signing  reason=CSC_KEY_PASSWORD is not defined
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\win-unpacked\Test App ßW.exe
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\win-unpacked\Test App ßW.exe certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\3.p12
building        target=AppX arch=x64 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\Test App ßW 1.1.0.appx
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\Test App ßW 1.1.0.appx
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\test-project-0\dist\Test App ßW 1.1.0.appx certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-GuJIGO\3.p12
electron-builder  version=26.0.0-alpha.3 os=10.0.22631
loaded configuration  file=package.json ("build" field)
writing effective config  file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-JmjHlr\test-project-4\dist\builder-effective-config.yaml
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=x64 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-JmjHlr\test-project-4\dist\win-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-JmjHlr\test-project-4\dist\win-unpacked\Test App ßW.exe
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-JmjHlr\test-project-4\dist\win-unpacked\Test App ßW.exe
building        target=AppX arch=x64 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-JmjHlr\test-project-4\dist\Test App ßW 1.1.0.appx
AppX is not signed  reason=Windows Store only build
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-JmjHlr\test-project-4\dist\Test App ßW 1.1.0.appx
electron-builder  version=26.0.0-alpha.3 os=10.0.22631
loaded configuration  file=package.json ("build" field)
writing effective config  file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\builder-effective-config.yaml
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=x64 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\win-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\win-unpacked\Test App ßW.exe
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\win-unpacked\Test App ßW.exe
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\win-unpacked\Test App ßW.exe certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\a.p12
building        target=AppX arch=x64 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\Test App ßW 1.1.0.appx
Remove the 01234
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\Test App ßW 1.1.0.appx
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\test-project-7\dist\Test App ßW 1.1.0.appx certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-KqLY3P\a.p12
electron-builder  version=26.0.0-alpha.3 os=10.0.22631
loaded configuration  file=package.json ("build" field)
writing effective config  file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\builder-effective-config.yaml
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=ia32 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-ia32-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-ia32-unpacked\Test App ßW.exe
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-ia32-unpacked\Test App ßW.exe
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-ia32-unpacked\Test App ßW.exe certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\e.p12
building        target=AppX arch=ia32 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\Test App ßW 1.1.0 ia32.appx
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=x64 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-unpacked\Test App ßW.exe
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\Test App ßW 1.1.0 ia32.appx
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\Test App ßW 1.1.0 ia32.appx certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\e.p12
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-unpacked\Test App ßW.exe
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\win-unpacked\Test App ßW.exe certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\e.p12
building        target=AppX arch=x64 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\Test App ßW 1.1.0.appx
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\Test App ßW 1.1.0.appx
signing         file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\test-project-b\dist\Test App ßW 1.1.0.appx certificateFile=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-DINy5G\e.p12
electron-builder  version=26.0.0-alpha.3 os=10.0.22631
loaded configuration  file=package.json ("build" field)
writing effective config  file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\dist\builder-effective-config.yaml
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=x64 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\dist\win-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\dist\win-unpacked\Test App ßW.exe
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\dist\win-unpacked\Test App ßW.exe
building        target=AppX arch=x64 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\dist\Test App ßW 1.1.0.appx
AppX is not signed  reason=Windows Store only build
custom appx manifest found  manifestPath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\build\custom-template-manifest.xml
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-YsLC9W\test-project-h\dist\Test App ßW 1.1.0.appx
electron-builder  version=26.0.0-alpha.3 os=10.0.22631
loaded configuration  file=package.json ("build" field)
writing effective config  file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\dist\builder-effective-config.yaml
skipped dependencies rebuild  reason=npmRebuild is set to false
packaging       platform=win32 arch=x64 electron=23.3.10 appOutDir=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\dist\win-unpacked
updating asar integrity executable resource  executablePath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\dist\win-unpacked\Test App ßW.exe
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\dist\win-unpacked\Test App ßW.exe
building        target=AppX arch=x64 file=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\dist\Test App ßW 1.1.0.appx
AppX is not signed  reason=Windows Store only build
custom appx manifest found  manifestPath=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\build\custom-manifest.xml
signing with signtool.exe  path=C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-dlLGB9\test-project-k\dist\Test App ßW 1.1.0.appx
 PASS  src/windows/appxTest.ts (25.392 s)
  √ AppX (5693 ms)
  √ auto launch (2434 ms)
  √ application id (4579 ms)
  √ languages and not signed (windows store only) (6909 ms)
  √ custom template appmanifest.xml (2416 ms)
  √ custom raw appmanifest.xml (2532 ms)
  ○ skipped certificateSubjectName

Test Suites: 1 passed, 1 total
Tests:       1 skipped, 6 passed, 7 total
Snapshots:   8 passed, 8 total
Time:        25.455 s
Ran all test suites matching /appxTest\.ts$/i.

NOTE - If using the bundled signtool, then the tests will fail because of this

    Exit code: 1. Command failed: C:\Users\istoica\AppData\Local\electron-builder\Cache\winCodeSign\winCodeSign-2.6.0\windows-10\x64\signtool.exe sign /tr http://timestamp.digicert.com /f C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-LaNxCo\e.p12 /fd sha256 /td sha256 /d Test App ßW /du http://foo.example.com /p 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 (sha256 hash) /debug C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-LaNxCo\test-project-b\dist\Test App ßW 1.1.0 ia32.appx
    SignTool Error: Multiple signature support is not implemented for this filetype.
    SignTool Error: An error occurred while attempting to sign: C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-LaNxCo\test-project-b\dist\Test App W 1.1.0 ia32.appx


    The following certificates were considered:
        Issued to: Foo, Inc
        Issued by: Foo, Inc
        Expires:   Sun Jan 01 01:59:59 2040
        SHA1 hash: 2AE9AFEB4382EE1085381999355560BE5E70A610

    After EKU filter, 1 certs were left.
    After expiry filter, 1 certs were left.
    After Private Key filter, 1 certs were left.
    The following certificate was selected:
        Issued to: Foo, Inc
        Issued by: Foo, Inc
        Expires:   Sun Jan 01 01:59:59 2040
        SHA1 hash: 2AE9AFEB4382EE1085381999355560BE5E70A610


    The following additional certificates will be attached:
    Done Adding Additional Store

    Number of files successfully Signed: 0
    Number of warnings: 0
    Number of errors: 1

    SignTool Error: Multiple signature support is not implemented for this filetype.
    SignTool Error: An error occurred while attempting to sign: C:\Users\istoica\AppData\Local\Temp\et-5b4743cbbddfe15ab0632284ed5747fe\t-LaNxCo\test-project-b\dist\Test App W 1.1.0 ia32.appx

Just a FYI, there is another tool to sign windows executables, which works on all operating systems - https://ebourg.github.io/jsign/ but it is java based

[mmaietta]

So I don't seem to be running into any issue with signtool, rather it's something wrong with the template manifest (probably why allowing a custom one was never previously implemented since the error messages are so obscure.

- custom template appmanifest.xml
   ...more logs

    MakeAppx : error: 0x80080204 - The specified package format is not valid: The package manifest is not valid.

Can you take a look at custom-template-manifest.xml and see what's wrong with it?

[mmaietta]

@iongion are you willing to try this out in an alpha release of electron-builder or do you need the electron-builder version be in GA (non-alpha)?