MSIX: Always include PackageIntegrity/Content[Enforcement=on]

[DrusTheAxe]

All appxmanifest.xml should include

<uap10:PackageIntegrity><uap10:Content Enforcement="on"/>

uap10:Content - Windows UWP applications | Microsoft Learn

Store-signed packages received a degree of additional protection since Win8 -- pkgdir lockdown (TrustLevel ACE, etc), some pkgdir / blockmap verifications at activation, etc.

This was later (20H1 aka 10.0.19041.0) extended to other signed packages, if they opt-in via <uap10:PackageIntegrity>.

This manifest option is ignored if not relevant (e.g. the package isn't signed).

NOTE: Enforcement options are on, off, and default (ie Windows decides, currently equivalent to off). While Windows could change the default behavior to on, that wouldn't help for existing downlevel Windows systems. So always specifying it in the manifest is the right answer, until if/when Windows treats default equivalent to on, and is ubiquitous across the ecosystem (IOW, a loooong way into the future, at best).

[DrusTheAxe]

/azp run

[Copilot]

Pull request overview

Adds package content-integrity enforcement to shipped, generated, sample, and test MSIX manifests.

Changes:

• Enables uap10:Content Enforcement="on".
• Adds required uap10 namespace declarations.
• Updates manifest fixtures and samples consistently.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/winapp-VSC/src/test/fixtures/winui-gallery.appxmanifest	Enables integrity enforcement.
src/winapp-VSC/src/test/fixtures/widgets-sample.appxmanifest	Enables enforcement; duplicates a namespace declaration.
src/winapp-VSC/src/test/fixtures/push-notifications-sample.appxmanifest	Enables integrity enforcement.
src/winapp-VSC/src/test/fixtures/edge-cases.appxmanifest	Enables integrity enforcement.
src/winapp-VSC/src/test/fixtures/background-task-sample.appxmanifest	Enables enforcement; duplicates a namespace declaration.
src/winapp-CLI/WinApp.Cli/Templates/appxmanifest.sparse.xml	Secures generated sparse manifests.
src/winapp-CLI/WinApp.Cli/Templates/appxmanifest.packaged.xml	Secures generated packaged manifests.
src/winapp-CLI/WinApp.Cli.Tests/TestApps/winui-crash-app/Package.appxmanifest	Updates test-app manifest.
src/winapp-CLI/WinApp.Cli.Tests/TestApps/cpp-winui-crash-app/appxmanifest.xml	Updates test-app manifest.
samples/wpf-app/appxmanifest.xml	Updates WPF sample manifest.
samples/winui-app/Package.appxmanifest	Adds enforcement but omits downlevel namespace handling.
samples/tauri-app/appxmanifest.xml	Updates Tauri sample manifest.
samples/rust-app/appxmanifest.xml	Updates Rust sample manifest.
samples/flutter-app/appxmanifest.xml	Updates Flutter sample manifest.
samples/electron/appxmanifest.xml	Updates Electron sample manifest.
samples/electron-winml/appxmanifest.xml	Updates Electron WinML manifest.
samples/dotnet-app/appxmanifest.xml	Updates .NET sample manifest.
samples/cpp-app/appxmanifest.xml	Updates C++ sample manifest.
samples/cpp-app-winui/appxmanifest.xml	Updates C++ WinUI manifest.
msix/appxmanifest.xml	Secures the CLI’s MSIX manifest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Build Metrics Report

Binary Sizes

Artifact	Baseline	Current	Delta
CLI (ARM64)	31.87 MB	31.87 MB	📈 +0.5 KB (+0.00%)
CLI (x64)	32.19 MB	32.19 MB	📈 +0.5 KB (+0.00%)
MSIX (ARM64)	13.39 MB	13.39 MB	📈 +0.3 KB (+0.00%)
MSIX (x64)	14.22 MB	14.22 MB	📉 -0.1 KB (-0.00%)
NPM Package	27.91 MB	27.91 MB	📈 +0.7 KB (+0.00%)
NuGet Package	27.94 MB	27.94 MB	📈 +0.7 KB (+0.00%)

Test Results

✅ 1611 passed, 1 skipped out of 1612 tests in 361.5s (-61.0s vs. baseline)

Test Coverage

❌ 18.3% line coverage, 37.4% branch coverage · ✅ no change vs. baseline

CLI Startup Time

35ms median (x64, winapp --version) · ✅ -9ms vs. baseline

---

Updated 2026-07-11 04:59:02 UTC · commit 03017bc · workflow run

[nmetulev]

🤖 AI-generated review — not a human sign-off

Generated by GitHub Copilot CLI (Claude Opus 4.8) using this repo's pr-review skill: an 8-dimension parallel review (security, correctness, CLI UX, alternative-solution, test-coverage, docs, packaging), a GPT-5.5 cross-check, and real tool testing with the Windows SDK makeappx.exe 10.0.26100 and the VS Code extension's pinned @xmldom/xmldom 0.9.x. Please verify each item before acting — this is automated analysis, not an approval.

Summary: 0 critical · 4 high · 3 medium · 1 low

Must-fix (high)

• Duplicate xmlns:uap10 → malformed XML in background-task-sample.appxmanifest and widgets-sample.appxmanifest. Line 3 of each already declares xmlns:uap10 (on the long single-line <Package …> the diff doesn't show), and this PR adds a second one. Verified for real: @xmldom/xmldom 0.9.x (the extension's parser) throws Attribute xmlns:uap10 redefined, and .NET rejects it too — breaking manifest-parser.test.ts (parses every fixture) and background-task-fixture.spec.ts. See inline comments. (A scan of all 20 changed manifests found only these two affected.)
• samples/winui-app/Package.appxmanifest adds uap10:PackageIntegrity but leaves IgnorableNamespaces="uap rescap" while MinVersion="10.0.17763.0". See inline comment.
• E2E breakage — src/winapp-VSC/src/test/e2e/properties-tab.spec.ts:169-182 (not in this diff, noted here): the test can add Package Integrity Content Enforcement expects the add-button visible and value default, but its fixture winui-gallery.appxmanifest (via shared-context.ts) now already contains <uap10:Content Enforcement="on"/>. Update the test, or reset to a PackageIntegrity-free fixture.

Medium / low (not on changed lines)

• Packaging (medium): cpp-app, cpp-app-winui, electron, electron-winml, wpf-app, tauri-app use non-ignorable uap10 (needed for TrustLevel) with MinVersion="10.0.18362.0"; the new 19041-only PackageIntegrity element is then unknown and non-ignorable on builds 18362–19040. Decide a min-OS policy or confirm downlevel tolerance. (Not tested on a downlevel image — medium confidence.) See inline comment on cpp-app.
• Test coverage (medium): nothing locks the new guarantee. Add assertions that the generated packaged/sparse templates and the updated fixtures contain PackageIntegrity / Enforcement="on" (ManifestCommandTests.cs, manifest-parser.test.ts).
• Alternative solution (medium): the PR title says "all new MSIX packages," but only static templates/samples are edited — user-supplied manifests passed to winapp package won't get it. Consider a central AppxManifestDocument.EnsurePackageIntegrityContentEnforcement("on") invoked from MsixService.UpdateAppxManifestContentAsync (mirrors the existing VSC applyPackageIntegrityEnforcement).
• Docs (low): the always-on default is undocumented — add a note to docs/fragments/skills/winapp-cli/manifest.md explaining what PackageIntegrity does and how to disable it.

Checked and cleared (via real testing)

• Element ordering is not a problem. makeappx packed both templates cleanly, packed a negative control with PackageIntegrity deliberately placed before <DisplayName> (exit 0), and rejected Enforcement="bogusValue" (violates enumeration constraint of 'default on off'). So Properties is order-insensitive and Enforcement="on" is valid.
• The shipped packaged/sparse templates are fine — they correctly mark uap10 ignorable, so MinVersion=18362 is not a blocker there.

[DrusTheAxe]

/azp run

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.