fix(release): validate VHF pins portably

Normalize both sides of the VHF workflow policy checks so hosted Windows line endings cannot create false missing-gate failures.

Replace unsupported fixed-count CMake regexes with explicit portable validators for release pins and sortable UUIDv7 ProductCodes, backed by focused malformed-input fixtures.

Generated with [Codex](https://openai.com/codex/)

Model: GPT 5.6-Sol High

Orchestrator: GPT 5.6-Sol X-High

Author: Nonary

.github/workflows/ci-windows.yml

@@ -310,6 +310,14 @@ jobs:
         shell: pwsh
         run: .\packaging\windows\virtual_gamepad_driver\tests\test_manifest_channel_contract.ps1
 
+      - name: Test VHF CMake release contract
+        shell: pwsh
+        run: cmake -P .\packaging\windows\virtual_gamepad_driver\tests\test_release_contract.cmake
+
+      - name: Test WiX sortable ProductCode contract
+        shell: pwsh
+        run: cmake -P .\packaging\windows\wix\tests\test_sortable_product_guid_contract.cmake
+
       - name: Download verified VHF producer package
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:

cmake/packaging/windows.cmake

@@ -290,22 +290,37 @@ if(SUNSHINE_BUNDLE_VHF_GAMEPAD_DRIVER)
             endif()
         endforeach()
         unset(_vhf_gamepad_pin)
-        if(NOT SUNSHINE_VHF_GAMEPAD_RELEASE_ASSET_SHA256 MATCHES "^[0-9a-fA-F]{64}$")
+        sunshine_vhf_is_fixed_length_hex(
+            _vhf_gamepad_pin_valid
+            "${SUNSHINE_VHF_GAMEPAD_RELEASE_ASSET_SHA256}"
+            64)
+        if(NOT _vhf_gamepad_pin_valid)
             message(FATAL_ERROR "SUNSHINE_VHF_GAMEPAD_RELEASE_ASSET_SHA256 must be a SHA-256 value.")
         endif()
-        if(NOT SUNSHINE_VHF_GAMEPAD_SOURCE_REVISION MATCHES "^[0-9a-fA-F]{40}$")
+        sunshine_vhf_is_fixed_length_hex(
+            _vhf_gamepad_pin_valid
+            "${SUNSHINE_VHF_GAMEPAD_SOURCE_REVISION}"
+            40)
+        if(NOT _vhf_gamepad_pin_valid)
             message(FATAL_ERROR "SUNSHINE_VHF_GAMEPAD_SOURCE_REVISION must be a full commit SHA.")
         endif()
+        unset(_vhf_gamepad_pin_valid)
         # Still validated when supplied, for the hand-signed package case.
         foreach(_vhf_gamepad_signer IN ITEMS
                 SUNSHINE_VHF_GAMEPAD_CATALOG_SIGNER_THUMBPRINT
                 SUNSHINE_VHF_GAMEPAD_DEVICE_SETUP_SIGNER_THUMBPRINT)
-            if(NOT "${${_vhf_gamepad_signer}}" STREQUAL "" AND
-               NOT "${${_vhf_gamepad_signer}}" MATCHES "^[0-9a-fA-F]{40}$")
-                message(FATAL_ERROR
-                    "${_vhf_gamepad_signer} must be a 40-character SHA-1 thumbprint when set.")
+            if(NOT "${${_vhf_gamepad_signer}}" STREQUAL "")
+                sunshine_vhf_is_fixed_length_hex(
+                    _vhf_gamepad_signer_valid
+                    "${${_vhf_gamepad_signer}}"
+                    40)
+                if(NOT _vhf_gamepad_signer_valid)
+                    message(FATAL_ERROR
+                        "${_vhf_gamepad_signer} must be a 40-character SHA-1 thumbprint when set.")
+                endif()
             endif()
         endforeach()
+        unset(_vhf_gamepad_signer_valid)
         unset(_vhf_gamepad_signer)
     endif()
 

cmake/packaging/windows_virtual_gamepad_contract.cmake

@@ -1,5 +1,18 @@
 include_guard(GLOBAL)
 
+function(sunshine_vhf_is_fixed_length_hex output_variable value expected_length)
+    if(NOT expected_length MATCHES "^[0-9]+$" OR expected_length LESS 1)
+        message(FATAL_ERROR "VHF hexadecimal validation requires a positive expected length.")
+    endif()
+
+    string(LENGTH "${value}" actual_length)
+    if(actual_length EQUAL expected_length AND value MATCHES "^[0-9a-fA-F]+$")
+        set(${output_variable} TRUE PARENT_SCOPE)
+    else()
+        set(${output_variable} FALSE PARENT_SCOPE)
+    endif()
+endfunction()
+
 # The virtual-gamepad package is independently versioned and released from
 # Nonary/libvirtualgamepad. The application consumes its immutable archive; it
 # must never build the UMDF driver while assembling a consumer MSI.

packaging/windows/virtual_gamepad_driver/tests/test_manifest_channel_contract.ps1

@@ -203,13 +203,47 @@ try {
     Remove-Item -LiteralPath $testRoot -Recurse -Force -ErrorAction SilentlyContinue
 }
 
-$workflowText = (Get-Content -LiteralPath $workflowPath -Raw).Replace("`r`n", "`n")
 $expectedGate = @'
       - name: Test VHF manifest channel contract
         shell: pwsh
         run: .\packaging\windows\virtual_gamepad_driver\tests\test_manifest_channel_contract.ps1
 '@
-if ($workflowText.IndexOf($expectedGate.TrimEnd(), [System.StringComparison]::Ordinal) -lt 0) {
+
+function Test-WorkflowContainsManifestContractGate {
+    param(
+        [Parameter(Mandatory = $true)][string] $WorkflowText,
+        [Parameter(Mandatory = $true)][string] $ExpectedGate
+    )
+
+    $normalizedWorkflowText = $WorkflowText.Replace("`r`n", "`n").Replace("`r", "`n")
+    $normalizedExpectedGate = $ExpectedGate.Replace("`r`n", "`n").Replace("`r", "`n").TrimEnd()
+    return $normalizedWorkflowText.IndexOf(
+        $normalizedExpectedGate,
+        [System.StringComparison]::Ordinal) -ge 0
+}
+
+$lfGateFixture = $expectedGate.Replace("`r`n", "`n").Replace("`r", "`n").TrimEnd()
+$crlfGateFixture = $lfGateFixture.Replace("`n", "`r`n")
+foreach ($validGateFixture in @($lfGateFixture, $crlfGateFixture)) {
+    if (-not (Test-WorkflowContainsManifestContractGate `
+            -WorkflowText $validGateFixture `
+            -ExpectedGate $expectedGate)) {
+        throw 'The manifest contract workflow gate rejected a valid newline style.'
+    }
+}
+$missingGateFixture = $lfGateFixture.Replace(
+    '.\packaging\windows\virtual_gamepad_driver\tests\test_manifest_channel_contract.ps1',
+    '.\packaging\windows\virtual_gamepad_driver\tests\missing.ps1')
+if (Test-WorkflowContainsManifestContractGate `
+        -WorkflowText $missingGateFixture `
+        -ExpectedGate $expectedGate) {
+    throw 'The manifest contract workflow gate accepted a missing policy test.'
+}
+
+$workflowText = Get-Content -LiteralPath $workflowPath -Raw
+if (-not (Test-WorkflowContainsManifestContractGate `
+        -WorkflowText $workflowText `
+        -ExpectedGate $expectedGate)) {
     throw 'The ordinary/release Windows build does not run this manifest contract test.'
 }
 $packagingText = Get-Content -LiteralPath $windowsPackagingCmake -Raw

packaging/windows/virtual_gamepad_driver/tests/test_publisher_trust.ps1

@@ -157,13 +157,47 @@ if ($trustOffset -lt 0 -or $pnpOffset -lt 0 -or $trustOffset -ge $pnpOffset) {
     throw 'Production publisher trust is not established before PnPUtil driver staging.'
 }
 
-$workflowText = (Get-Content -LiteralPath $workflowPath -Raw).Replace("`r`n", "`n")
 $expectedGate = @'
       - name: Test VHF publisher trust policy
         shell: pwsh
         run: .\packaging\windows\virtual_gamepad_driver\tests\test_publisher_trust.ps1
 '@
-if ($workflowText.IndexOf($expectedGate.TrimEnd(), [System.StringComparison]::Ordinal) -lt 0) {
+
+function Test-WorkflowContainsPublisherTrustGate {
+    param(
+        [Parameter(Mandatory = $true)][string] $WorkflowText,
+        [Parameter(Mandatory = $true)][string] $ExpectedGate
+    )
+
+    $normalizedWorkflowText = $WorkflowText.Replace("`r`n", "`n").Replace("`r", "`n")
+    $normalizedExpectedGate = $ExpectedGate.Replace("`r`n", "`n").Replace("`r", "`n").TrimEnd()
+    return $normalizedWorkflowText.IndexOf(
+        $normalizedExpectedGate,
+        [System.StringComparison]::Ordinal) -ge 0
+}
+
+$lfGateFixture = $expectedGate.Replace("`r`n", "`n").Replace("`r", "`n").TrimEnd()
+$crlfGateFixture = $lfGateFixture.Replace("`n", "`r`n")
+foreach ($validGateFixture in @($lfGateFixture, $crlfGateFixture)) {
+    if (-not (Test-WorkflowContainsPublisherTrustGate `
+            -WorkflowText $validGateFixture `
+            -ExpectedGate $expectedGate)) {
+        throw 'The publisher trust workflow gate rejected a valid newline style.'
+    }
+}
+$missingGateFixture = $lfGateFixture.Replace(
+    '.\packaging\windows\virtual_gamepad_driver\tests\test_publisher_trust.ps1',
+    '.\packaging\windows\virtual_gamepad_driver\tests\missing.ps1')
+if (Test-WorkflowContainsPublisherTrustGate `
+        -WorkflowText $missingGateFixture `
+        -ExpectedGate $expectedGate) {
+    throw 'The publisher trust workflow gate accepted a missing policy test.'
+}
+
+$workflowText = Get-Content -LiteralPath $workflowPath -Raw
+if (-not (Test-WorkflowContainsPublisherTrustGate `
+        -WorkflowText $workflowText `
+        -ExpectedGate $expectedGate)) {
     throw 'The ordinary/release Windows build does not run this publisher trust policy test.'
 }
 

packaging/windows/virtual_gamepad_driver/tests/test_release_contract.cmake

@@ -0,0 +1,44 @@
+cmake_minimum_required(VERSION 3.25)
+
+get_filename_component(repository_root "${CMAKE_CURRENT_LIST_DIR}/../../../.." ABSOLUTE)
+include("${repository_root}/cmake/packaging/windows_virtual_gamepad_contract.cmake")
+
+function(assert_fixed_hex_accepted case_name value expected_length)
+    sunshine_vhf_is_fixed_length_hex(case_accepted "${value}" "${expected_length}")
+    if(NOT case_accepted)
+        message(FATAL_ERROR "${case_name}: valid fixed-length hexadecimal value was rejected.")
+    endif()
+endfunction()
+
+function(assert_fixed_hex_rejected case_name value expected_length)
+    sunshine_vhf_is_fixed_length_hex(case_accepted "${value}" "${expected_length}")
+    if(case_accepted)
+        message(FATAL_ERROR "${case_name}: invalid fixed-length hexadecimal value was accepted.")
+    endif()
+endfunction()
+
+string(REPEAT "a" 64 sha256_lower)
+string(TOUPPER "${sha256_lower}" sha256_upper)
+assert_fixed_hex_accepted("lowercase SHA-256" "${sha256_lower}" 64)
+assert_fixed_hex_accepted("uppercase SHA-256" "${sha256_upper}" 64)
+
+string(REPEAT "b" 40 sha1_lower)
+string(TOUPPER "${sha1_lower}" sha1_upper)
+assert_fixed_hex_accepted("lowercase SHA-1" "${sha1_lower}" 40)
+assert_fixed_hex_accepted("uppercase SHA-1" "${sha1_upper}" 40)
+
+string(REPEAT "c" 63 sha256_short)
+string(REPEAT "d" 65 sha256_long)
+string(REPEAT "e" 63 sha256_nonhex_prefix)
+assert_fixed_hex_rejected("short SHA-256" "${sha256_short}" 64)
+assert_fixed_hex_rejected("long SHA-256" "${sha256_long}" 64)
+assert_fixed_hex_rejected("nonhex SHA-256" "${sha256_nonhex_prefix}g" 64)
+
+string(REPEAT "1" 39 sha1_short)
+string(REPEAT "2" 41 sha1_long)
+string(REPEAT "3" 39 sha1_nonhex_prefix)
+assert_fixed_hex_rejected("short SHA-1" "${sha1_short}" 40)
+assert_fixed_hex_rejected("long SHA-1" "${sha1_long}" 40)
+assert_fixed_hex_rejected("nonhex SHA-1" "${sha1_nonhex_prefix}z" 40)
+
+message(STATUS "VHF fixed-length hexadecimal release contract checks passed.")

packaging/windows/wix/generate_sortable_product_guid.cmake

@@ -2,6 +2,8 @@
 # Keep the UpgradeCode stable, but generate a new ProductCode for every MSI so
 # same-numeric-version prereleases can be ordered by canonical UUID text.
 
+include("${CMAKE_CURRENT_LIST_DIR}/sortable_product_guid_contract.cmake")
+
 function(_vibeshine_generate_sortable_product_guid _output_variable)
   set(_guid "")
 
@@ -15,7 +17,8 @@ function(_vibeshine_generate_sortable_product_guid _output_variable)
     )
   endif()
 
-  if(NOT _guid MATCHES "^\\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-7[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}\\}$")
+  vibeshine_is_sortable_product_guid(_guid_is_valid "${_guid}")
+  if(NOT _guid_is_valid)
     # Fallback for non-PowerShell hosts.  CMake only exposes seconds here, so
     # random bits keep ProductCodes unique if two packages are produced within
     # the same second; the leading timestamp still preserves sortable ordering.
@@ -49,6 +52,11 @@ function(_vibeshine_generate_sortable_product_guid _output_variable)
     set(_guid "{${_time_a}-${_time_b}-7${_rand_a}-8${_rand_b}-${_rand_c}}")
   endif()
 
+  vibeshine_is_sortable_product_guid(_guid_is_valid "${_guid}")
+  if(NOT _guid_is_valid)
+    message(FATAL_ERROR "Failed to generate a structurally valid sortable UUIDv7 ProductCode.")
+  endif()
+
   string(TOUPPER "${_guid}" _guid)
   set(${_output_variable} "${_guid}" PARENT_SCOPE)
 endfunction()

packaging/windows/wix/sortable_product_guid_contract.cmake

@@ -0,0 +1,43 @@
+include_guard(GLOBAL)
+
+function(vibeshine_is_sortable_product_guid output_variable value)
+  set(is_valid FALSE)
+  string(LENGTH "${value}" value_length)
+  if(value_length EQUAL 38)
+    string(SUBSTRING "${value}" 0 1 opening_brace)
+    string(SUBSTRING "${value}" 37 1 closing_brace)
+    if(opening_brace STREQUAL "{" AND closing_brace STREQUAL "}")
+      string(SUBSTRING "${value}" 1 36 uuid_text)
+      string(REPLACE "-" ";" uuid_groups "${uuid_text}")
+      list(LENGTH uuid_groups group_count)
+      if(group_count EQUAL 5)
+        list(GET uuid_groups 0 group_1)
+        list(GET uuid_groups 1 group_2)
+        list(GET uuid_groups 2 group_3)
+        list(GET uuid_groups 3 group_4)
+        list(GET uuid_groups 4 group_5)
+        string(LENGTH "${group_1}" group_1_length)
+        string(LENGTH "${group_2}" group_2_length)
+        string(LENGTH "${group_3}" group_3_length)
+        string(LENGTH "${group_4}" group_4_length)
+        string(LENGTH "${group_5}" group_5_length)
+        if(group_1_length EQUAL 8 AND
+           group_2_length EQUAL 4 AND
+           group_3_length EQUAL 4 AND
+           group_4_length EQUAL 4 AND
+           group_5_length EQUAL 12)
+          string(CONCAT uuid_hex
+            "${group_1}" "${group_2}" "${group_3}" "${group_4}" "${group_5}")
+          string(SUBSTRING "${group_3}" 0 1 version_nibble)
+          string(SUBSTRING "${group_4}" 0 1 variant_nibble)
+          if(uuid_hex MATCHES "^[0-9A-Fa-f]+$" AND
+             version_nibble STREQUAL "7" AND
+             variant_nibble MATCHES "^[89ABab]$")
+            set(is_valid TRUE)
+          endif()
+        endif()
+      endif()
+    endif()
+  endif()
+  set(${output_variable} "${is_valid}" PARENT_SCOPE)
+endfunction()

packaging/windows/wix/tests/test_sortable_product_guid_contract.cmake

@@ -0,0 +1,43 @@
+cmake_minimum_required(VERSION 3.25)
+
+get_filename_component(wix_root "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
+include("${wix_root}/sortable_product_guid_contract.cmake")
+
+function(assert_guid_accepted case_name value)
+  vibeshine_is_sortable_product_guid(case_accepted "${value}")
+  if(NOT case_accepted)
+    message(FATAL_ERROR "${case_name}: valid sortable UUIDv7 value was rejected.")
+  endif()
+endfunction()
+
+function(assert_guid_rejected case_name value)
+  vibeshine_is_sortable_product_guid(case_accepted "${value}")
+  if(case_accepted)
+    message(FATAL_ERROR "${case_name}: malformed sortable UUIDv7 value was accepted.")
+  endif()
+endfunction()
+
+assert_guid_accepted(
+  "canonical UUIDv7"
+  "{018F0C11-1111-7ABC-8DEF-0123456789AB}")
+assert_guid_accepted(
+  "lowercase UUIDv7"
+  "{018f0c11-1111-7abc-abcd-0123456789ab}")
+
+assert_guid_rejected(
+  "malformed group lengths"
+  "{018F0C1-11111-7ABC-8DEF-0123456789AB}")
+assert_guid_rejected(
+  "short overall value"
+  "{018F0C11-1111-7ABC-8DEF-0123456789A}")
+assert_guid_rejected(
+  "nonhex value"
+  "{018F0C1G-1111-7ABC-8DEF-0123456789AB}")
+assert_guid_rejected(
+  "non-v7 version"
+  "{018F0C11-1111-6ABC-8DEF-0123456789AB}")
+assert_guid_rejected(
+  "invalid UUID variant"
+  "{018F0C11-1111-7ABC-7DEF-0123456789AB}")
+
+message(STATUS "Sortable UUIDv7 ProductCode contract checks passed.")