From 681887bf229959cabaa8be3d332402dad14e9354 Mon Sep 17 00:00:00 2001
From: Dallin Romney <dallinromney@gmail.com>
Date: Sat, 12 Sep 2026 01:18:41 -0700
Subject: [PATCH] fix(ci): authorize MakeAppx zero-version bundles

---
 README.md                               |  6 ++++++
 scripts/Build-MSIXBundle.ps1            |  9 ++++++++-
 scripts/Test-Build-MSIXBundle.Tests.ps1 | 15 +++++++++++++++
 scripts/Test-SigningInputs.Tests.ps1    |  6 ++++--
 scripts/Test-SigningInputs.ps1          | 24 ++++++++++++++++++++++--
 5 files changed, 55 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 20205914..d5645c23 100644
--- a/README.md
+++ b/README.md
@@ -186,6 +186,12 @@ contains a signed, multi-architecture
 deployment. The duplicate GitHub Actions artifacts remain short-lived transport
 and diagnostic copies.
 
+For the all-zero proof only, MakeAppx assigns the outer bundle identity its
+date/time-based version because it does not preserve `0.0.0.0` as a bundle
+version. The two embedded architecture packages retain identity version
+`0.0.0.0`; signing authorization verifies those versions and byte-compares both
+embedded packages with the approved standalone inputs.
+
 An `.msixbundle` is a single installable container for the x64 and ARM64 MSIX
 packages; Windows selects the package appropriate for the device. An
 `.appinstaller` file is separate update-channel metadata rather than an
diff --git a/scripts/Build-MSIXBundle.ps1 b/scripts/Build-MSIXBundle.ps1
index a1a9727a..96d06f76 100644
--- a/scripts/Build-MSIXBundle.ps1
+++ b/scripts/Build-MSIXBundle.ps1
@@ -105,9 +105,16 @@ try {
         -Destination (Join-Path $bundleInput 'OpenClawGateway-arm64.msix')
 
     $resolvedMakeAppx = Resolve-MakeAppx
+    $bundleVersionArguments = @('/bv', $PackageVersion)
+    if ($PackageVersion -eq '0.0.0.0') {
+        # MakeAppx does not preserve an all-zero bundle identity version. Let
+        # it assign its date/time-based version while the embedded
+        # architecture packages retain the requested 0.0.0.0 identity.
+        $bundleVersionArguments = @()
+    }
     & $resolvedMakeAppx bundle `
         /v `
-        /bv $PackageVersion `
+        @bundleVersionArguments `
         /d $bundleInput `
         /p $resolvedOutputPath
     if ($LASTEXITCODE -ne 0) {
diff --git a/scripts/Test-Build-MSIXBundle.Tests.ps1 b/scripts/Test-Build-MSIXBundle.Tests.ps1
index 4cc51698..70c390ee 100644
--- a/scripts/Test-Build-MSIXBundle.Tests.ps1
+++ b/scripts/Test-Build-MSIXBundle.Tests.ps1
@@ -75,6 +75,21 @@ type nul > "%output%"
         throw "MakeAppx did not receive the expected bundle version: $arguments"
     }
 
+    $zeroBundle = Join-Path $testRoot 'OpenClawGateway-zero.msixbundle'
+    & $scriptPath `
+        -X64Package $x64Package `
+        -Arm64Package $arm64Package `
+        -PackageVersion '0.0.0.0' `
+        -OutputPath $zeroBundle `
+        -MakeAppxPath $fakeMakeAppx
+    $arguments = Get-Content -LiteralPath $makeAppxArguments -Raw
+    if ($arguments -match '/bv') {
+        throw "MakeAppx received an invalid all-zero bundle version: $arguments"
+    }
+    if (-not (Test-Path -LiteralPath $zeroBundle -PathType Leaf)) {
+        throw 'The zero-version bundle builder did not preserve MakeAppx output.'
+    }
+
     Assert-Fails -MessagePattern 'must be different' -Action {
         & $scriptPath `
             -X64Package $x64Package `
diff --git a/scripts/Test-SigningInputs.Tests.ps1 b/scripts/Test-SigningInputs.Tests.ps1
index 4a8f09f2..15d58e50 100644
--- a/scripts/Test-SigningInputs.Tests.ps1
+++ b/scripts/Test-SigningInputs.Tests.ps1
@@ -195,7 +195,9 @@ function New-TestBundle {
 
         [string]$X64Package = (Join-Path `
             $Root `
-            'x64\OpenClawGateway-x64.msix')
+            'x64\OpenClawGateway-x64.msix'),
+
+        [string]$BundleVersion = '2026.912.815.0'
     )
 
     $bundleDirectory = Join-Path $Root 'bundle'
@@ -226,7 +228,7 @@ function New-TestBundle {
 <Bundle xmlns="http://schemas.microsoft.com/appx/2013/bundle">
   <Identity Name="OpenClaw.Gateway"
             Publisher="$($policy.publisher)"
-            Version="$approvedPackageVersion" />
+            Version="$BundleVersion" />
   <Packages>
     <Package Type="application"
              Version="$approvedPackageVersion"
diff --git a/scripts/Test-SigningInputs.ps1 b/scripts/Test-SigningInputs.ps1
index 3ca2f047..0a2359e3 100644
--- a/scripts/Test-SigningInputs.ps1
+++ b/scripts/Test-SigningInputs.ps1
@@ -357,11 +357,30 @@ try {
     $bundleIdentity = $bundleManifest.SelectSingleNode(
         "/*[local-name()='Bundle']/*[local-name()='Identity']"
     )
+    $bundleVersion = if ($null -eq $bundleIdentity) {
+        ''
+    }
+    else {
+        [string]$bundleIdentity.Version
+    }
+    $bundleVersionMatch = [regex]::Match(
+        $bundleVersion,
+        '^(?<major>\d+)\.(?<minor>\d+)\.(?<build>\d+)\.(?<revision>\d+)$'
+    )
+    $bundleVersionIsValid = $bundleVersionMatch.Success
+    if ($bundleVersionIsValid) {
+        foreach ($groupName in @('major', 'minor', 'build', 'revision')) {
+            if ([long]::Parse($bundleVersionMatch.Groups[$groupName].Value) -gt 65534) {
+                $bundleVersionIsValid = $false
+                break
+            }
+        }
+    }
     if (
         $null -eq $bundleIdentity -or
         $bundleIdentity.Name -ne 'OpenClaw.Gateway' -or
         $bundleIdentity.Publisher -ne $policy.publisher -or
-        $bundleIdentity.Version -ne $expectedPackageVersion
+        -not $bundleVersionIsValid
     ) {
         throw 'The MSIX bundle manifest identity is unexpected.'
     }
@@ -422,5 +441,6 @@ finally {
 
 Write-Host (
     "Authorized official signing for OpenClaw commit $approvedCommit " +
-    "and Gateway MSIX version $expectedPackageVersion."
+    "and Gateway MSIX version $expectedPackageVersion " +
+    "(bundle version $bundleVersion)."
 )