From 5fab7710a4cc672599343c89760ae42f568ae330 Mon Sep 17 00:00:00 2001
From: Andy Jordan <2226434+andyleejordan@users.noreply.github.com>
Date: Thu, 26 Feb 2026 17:41:32 -0800
Subject: [PATCH] Fix MSIX build logic and make the debug package be
 self-signed

---
 helpers.build.psm1 | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/helpers.build.psm1 b/helpers.build.psm1
index aac96e182..46d6f63d1 100644
--- a/helpers.build.psm1
+++ b/helpers.build.psm1
@@ -1812,7 +1812,7 @@ function Build-DscMsixPackage {
     )
 
     begin {
-        if ($IsWindows) {
+        if (-not $IsWindows) {
             throw "MSIX packaging is only supported on Windows"
         }
         if ($null -eq $BuildData) {
@@ -1884,12 +1884,18 @@ function Build-DscMsixPackage {
         $arch = ($architecture -eq 'aarch64-pc-windows-msvc') ? 'arm64' : 'x64'
 
         # Appx manifest needs to be in root of source path, but the embedded version needs to be updated
-        # cp-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
-        # authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
-        $releasePublisher = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
         # Retrieve manifest and set version correctly
         $appxManifest = Get-Content "$PSScriptRoot\packaging\msix\AppxManifest.xml" -Raw
-        $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Arch).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $releasePublisher)
+        if ($Release) {
+            # CP-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
+            # authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
+            $publisher = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
+        } else {
+            # For debug builds, use a self-signed developer identity per
+            # https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
+            $publisher = 'CN=AppModelSamples, OID.2.25.311729368913984317654407730594956997722=1'
+        }
+        $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Arch).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $publisher)
         # Remove the output directory if it already exists, then recreate it.
         $msixTarget = $artifactDirectory.MsixTarget
         if (Test-Path $msixTarget) {
@@ -1970,7 +1976,12 @@ function Build-DscMsixPackage {
         if ($LASTEXITCODE -ne 0) {
             throw "Failed to create msix package"
         }
-        Write-Host -ForegroundColor Green "`nMSIX package is created at $packageName"
+
+        if ($Release) {
+            Write-Host -ForegroundColor Green "`nMSIX package is created at $packageName"
+        } else {
+            Write-Host -ForegroundColor Green "`nInstall the debug MSIX package with:`nAdd-AppxPackage -AllowUnsigned -Path $packageName"
+        }
     }
 }