From 5fab7710a4cc672599343c89760ae42f568ae330 Mon Sep 17 00:00:00 2001
From: Andy Jordan <2226434+andyleejordan@users.noreply.github.com>
Date: Thu, 26 Feb 2026 17:41:32 -0800
Subject: [PATCH 1/2] Fix MSIX build logic and make the debug package be
 self-signed

---
 helpers.build.psm1 | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/helpers.build.psm1 b/helpers.build.psm1
index aac96e182..46d6f63d1 100644
--- a/helpers.build.psm1
+++ b/helpers.build.psm1
@@ -1812,7 +1812,7 @@ function Build-DscMsixPackage {
     )
 
     begin {
-        if ($IsWindows) {
+        if (-not $IsWindows) {
             throw "MSIX packaging is only supported on Windows"
         }
         if ($null -eq $BuildData) {
@@ -1884,12 +1884,18 @@ function Build-DscMsixPackage {
         $arch = ($architecture -eq 'aarch64-pc-windows-msvc') ? 'arm64' : 'x64'
 
         # Appx manifest needs to be in root of source path, but the embedded version needs to be updated
-        # cp-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
-        # authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
-        $releasePublisher = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
         # Retrieve manifest and set version correctly
         $appxManifest = Get-Content "$PSScriptRoot\packaging\msix\AppxManifest.xml" -Raw
-        $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Arch).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $releasePublisher)
+        if ($Release) {
+            # CP-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
+            # authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
+            $publisher = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
+        } else {
+            # For debug builds, use a self-signed developer identity per
+            # https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
+            $publisher = 'CN=AppModelSamples, OID.2.25.311729368913984317654407730594956997722=1'
+        }
+        $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Arch).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $publisher)
         # Remove the output directory if it already exists, then recreate it.
         $msixTarget = $artifactDirectory.MsixTarget
         if (Test-Path $msixTarget) {
@@ -1970,7 +1976,12 @@ function Build-DscMsixPackage {
         if ($LASTEXITCODE -ne 0) {
             throw "Failed to create msix package"
         }
-        Write-Host -ForegroundColor Green "`nMSIX package is created at $packageName"
+
+        if ($Release) {
+            Write-Host -ForegroundColor Green "`nMSIX package is created at $packageName"
+        } else {
+            Write-Host -ForegroundColor Green "`nInstall the debug MSIX package with:`nAdd-AppxPackage -AllowUnsigned -Path $packageName"
+        }
     }
 }
 

From e5f6b00d61ab39a04727a092b01643130d16792c Mon Sep 17 00:00:00 2001
From: Andy Jordan <2226434+andyleejordan@users.noreply.github.com>
Date: Thu, 26 Feb 2026 18:38:40 -0800
Subject: [PATCH 2/2] Add dsc-bicep-ext.exe to APPX and update manifest to put
 it in PATH

So we can setup a facade in Bicep to call out to the installed gRPC server.
---
 data.build.json                 | 11 +++++++++++
 packaging/msix/AppxManifest.xml | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/data.build.json b/data.build.json
index 74d8242c2..359d3392a 100644
--- a/data.build.json
+++ b/data.build.json
@@ -54,6 +54,7 @@
       "appx.dsc.extension.json",
       "appx-discover.ps1",
       "dsc.exe",
+      "dsc-bicep-ext.exe",
       "dsc_default.settings.json",
       "dsc.settings.json",
       "dscecho.exe",
@@ -429,6 +430,16 @@
       "Binaries": [
         "y2j"
       ]
+    },
+    {
+      "Name": "dsc-bicep-ext",
+      "Kind": "Extension",
+      "RelativePath": "dsc-bicep-ext",
+      "SupportedPlatformOS": "Windows",
+      "IsRust": true,
+      "Binaries": [
+        "dsc-bicep-ext"
+      ]
     }
   ]
 }
diff --git a/packaging/msix/AppxManifest.xml b/packaging/msix/AppxManifest.xml
index 3cbee4de7..cc6e0a1f2 100644
--- a/packaging/msix/AppxManifest.xml
+++ b/packaging/msix/AppxManifest.xml
@@ -39,6 +39,17 @@
       <uap:VisualElements DisplayName="$DISPLAYNAME$" Description="DesiredStateConfiguration (DSC) enables a declarative model for configuration, also known as configuration as code." BackgroundColor="transparent" Square150x150Logo="assets\Square150x150Logo.png" Square44x44Logo="assets\Square44x44Logo.png">
       </uap:VisualElements>
     </Application>
+    <Application Id="BicepExt" Executable="dsc-bicep-ext.exe" EntryPoint="Windows.FullTrustApplication">
+      <Extensions>
+        <uap3:Extension Category="windows.appExecutionAlias" EntryPoint="Windows.FullTrustApplication" Executable="dsc-bicep-ext.exe">
+          <uap3:AppExecutionAlias>
+            <desktop:ExecutionAlias Alias="dsc-bicep-ext.exe" />
+          </uap3:AppExecutionAlias>
+        </uap3:Extension>
+      </Extensions>
+      <uap:VisualElements DisplayName="DSC Bicep Extension" Description="gRPC server for Bicep extensibility with DSC." BackgroundColor="transparent" Square150x150Logo="assets\Square150x150Logo.png" Square44x44Logo="assets\Square44x44Logo.png">
+      </uap:VisualElements>
+    </Application>
   </Applications>
 
   <Capabilities>