Desktop publishing activation tracker: Windows signing, winget, Microsoft Store, macOS signing, Homebrew

[jamesarich]

Tracks activation of the desktop publishing channels. The CI wiring is (or will shortly be) merged and skip-safe — every workflow below sits dormant and skips cleanly until its secrets exist, so releases behave exactly as today until each box is checked.

• Windows signing + winget: ci(desktop): sign Windows installers and publish production releases to winget #6217 (merged)
• Homebrew cask + tap automation: feat(desktop): Homebrew cask for macOS + tap automation on production releases #6219
• Microsoft Store: ci(desktop): publish production releases to the Microsoft Store #6243

Recommended order: start the three account verifications first (Azure identity validation, Apple Developer enrollment, Partner Center company verification — each has days of external lead time), then work down each channel.

1. Windows Authenticode signing — Azure Trusted Signing (#6217)

Everything else on Windows (winget moderation, MS Store submission, SmartScreen reputation) depends on this landing first.

• Azure subscription available for the Meshtastic org
• Trusted Signing ("Artifact Signing") resource created
• Identity validation completed for the Meshtastic legal entity (public trust — external lead time, start early)
• Public-trust certificate profile created
• Entra app registration (service principal) granted the Trusted Signing Certificate Profile Signer role on the account
• Secret AZURE_TENANT_ID
• Secret AZURE_CLIENT_ID
• Secret AZURE_CLIENT_SECRET
• Secret AZURE_TRUSTED_SIGNING_ENDPOINT (regional URL, e.g. https://eus.codesigning.azure.net)
• Secret AZURE_TRUSTED_SIGNING_ACCOUNT
• Secret AZURE_TRUSTED_SIGNING_CERT_PROFILE
• First signed release cut: verify Authenticode on the MSI/EXE assets and that build provenance/attestation covers the signed bytes

2. winget (#6217)

• GitHub account with a fork of microsoft/winget-pkgs (machine account or maintainer)
• Secret WINGET_TOKEN — classic PAT, public_repo scope (fine-grained PATs not supported by winget-releaser)
• Manual seed (one-time): submit the first Meshtastic.MeshtasticDesktop manifest by hand (wingetcreate new <signed MSI release-asset URL>) — winget-releaser only updates existing packages; use a signed MSI or moderation may bounce it
• After the next production promotion: verify the automated manifest PR appears in microsoft/winget-pkgs and winget install Meshtastic.MeshtasticDesktop works

3. Microsoft Store (#6243)

• Partner Center developer account (company account — verification lead time); reserve the app name
• Entra tenant linked to Partner Center; app registration added under Account settings → User management → Microsoft Entra applications with the Manager role
• Manual first submission (one-time, after signing is live): create the app + initial submission in Partner Center (listing copy, screenshots, signed-MSI release-asset URL) — the submission API can only update existing products, and Partner Center rejects unsigned Win32 installers
• Secret MSSTORE_TENANT_ID
• Secret MSSTORE_SELLER_ID (Partner Center → Account settings)
• Secret MSSTORE_PRODUCT_ID (app overview page)
• Secret MSSTORE_CLIENT_ID
• Secret MSSTORE_CLIENT_SECRET
• First automated update passes Store certification (1–3 business days, tracked in Partner Center — rejections do not surface in CI)

4. macOS signing + notarization (prereq for Homebrew)

release.yml already gates on SIGN_MACOS, but note the known gap: nothing imports the certificate into the runner keychain, so setting the four APPLE_* secrets alone would break the macOS leg rather than sign it.

• Apple Developer Program membership for the Meshtastic org ($99/yr)
• Developer ID Application certificate created; exported as P12
• Workflow fix: add a keychain import step (e.g. apple-actions/import-codesign-certs) to release.yml before the build, plus P12 secrets (e.g. APPLE_CERT_P12 + APPLE_CERT_PASSWORD)
• Secret APPLE_SIGNING_IDENTITY (Developer ID Application: … (TEAMID))
• Secret APPLE_ID
• Secret APPLE_APP_SPECIFIC_PASSWORD (from appleid.apple.com, for notarytool)
• Secret APPLE_TEAM_ID
• First signed + notarized DMG verified (spctl -a -t open --context context:primary-signature / Gatekeeper clean on a fresh Mac)

5. Homebrew cask (#6219)

Do not seed the cask until a signed + notarized DMG exists — brew quarantines cask installs, so users of the current ad-hoc-signed DMG would hit the Gatekeeper "damaged app" dialog.

• Secret HOMEBREW_TAP_TOKEN — PAT with contents + pull-requests write on meshtastic/homebrew-tap (org owner must authorize; fine-grained PAT or machine account)
• First production promotion after signing: verify the automated cask PR against meshtastic/homebrew-tap passes the tap's brew test-bot CI
• Verify brew install --cask meshtastic/tap/meshtastic-desktop and brew upgrade on arm64

---

🤖 Opened with Claude Code