AppX package, resource, and signature analysis #1995

New issue

Closed

opened 2026-10-16 21:13:12 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:12 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/450
Author: @morluto
Created: 7/28/2026
Status: ✅ Merged
Merged: 7/28/2026
Merged by: @morluto

Base: main ← Head: codex/msix-msi-appx-363

📝 Commits (1)

6c03f83 feat(package): add MSIX/MSI/AppX package, resource, and signature analysis

📊 Changes

2 files changed (+251 additions, -0 deletions)

View changed files

➕ src/domain/packageAnalysis.ts (+144 -0)
➕ tests/packageAnalysis.test.ts (+107 -0)

📄 Description

Summary

Add static analysis for MSIX, MSI, AppX packages, their resources, and digital signatures.

Closes #363.

Changes

Package formats: MSIX, MSI, AppX with detection from file extensions
Resource types: manifest, icon, configuration, certificate, executable, library, data, other
Resource classification: Identifies resource type from path (manifest XML, icons, configs, executables, libraries, certificates)
Digital signatures: Tracks signed state, signer subject, certificate thumbprint, validity, timestamping
Package metadata: Name, publisher, version, architecture, framework flag, dependencies, capabilities

Verification

npm run typecheck   # passes
npx vitest run tests/packageAnalysis.test.ts  # 8 tests pass

Acceptance criteria

✅ Package and resource contents are inventoried without execution
✅ Signature and container metadata are evidence-backed

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/450 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/28/2026 **Status:** ✅ Merged **Merged:** 7/28/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/msix-msi-appx-363` --- ### 📝 Commits (1) - [`6c03f83`](https://github.com/morluto/rea/commit/6c03f83b1bd55095d136aeb3700733383365ecc4) feat(package): add MSIX/MSI/AppX package, resource, and signature analysis ### 📊 Changes **2 files changed** (+251 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `src/domain/packageAnalysis.ts` (+144 -0) ➕ `tests/packageAnalysis.test.ts` (+107 -0) </details> ### 📄 Description ## Summary Add static analysis for MSIX, MSI, AppX packages, their resources, and digital signatures. Closes #363. ## Changes - **Package formats**: MSIX, MSI, AppX with detection from file extensions - **Resource types**: manifest, icon, configuration, certificate, executable, library, data, other - **Resource classification**: Identifies resource type from path (manifest XML, icons, configs, executables, libraries, certificates) - **Digital signatures**: Tracks signed state, signer subject, certificate thumbprint, validity, timestamping - **Package metadata**: Name, publisher, version, architecture, framework flag, dependencies, capabilities ## Verification ```bash npm run typecheck # passes npx vitest run tests/packageAnalysis.test.ts # 8 tests pass ``` ## Acceptance criteria - ✅ Package and resource contents are inventoried without execution - ✅ Signature and container metadata are evidence-backed --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:12 +00:00