microsoft / microsoft/msix-packaging
[BUG] Package cannot automatically update when the signing certificate has changed
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 193
- Avg merge
- 2h 16m
- Merged PRs (30d)
- 2
Description
Project
MSIX SDK (Package created using VS Community 2019 16.6.4)
Describe the bug
Package cannot automatically update when the signing certificate has changed.
To Reproduce
- Sign and deploy your application using a certificate. You keep on using it and updating your app, and your user base grows.
- Later on (two years in our case) the certificate is near expiration and we ask for another one. Due to changes in the Certificate Authority, or even ourselves if we move from one location to another, or whatever the reason, the new certificate is slightly different (maybe now it is all uppercase letters in the CN field).
- Sign (with the new certificate) and deploy again your application, but in this case none of your users can update because of the following EventLog error (channel: Microsoft-Windows-AppXDeploymentServer/Operational):
Error 04/08/2020 12:44:09 AppXDeployment-Server 651 (3)
Error en la operación AppInstaller con el código de error 0x80070490. Detalle: No se ha encontrado el elemento.
If users manually force the installation of the package browsing to the webpage where it is published (by clicking in the "ms-appinstaller:?source=https://the.web.site.com/AppPackages/PackageProject.appinstaller" hyperlink) they receive the following error message:

The translation goes like:
Ask the developer for a new app package. This package may conflict with a package already installed, or it depends on things not installed here (package dependencies), or is made for a different architecture (0x80073CF3)
And in the EventLog (same channel as before):
Error 04/08/2020 12:58:35 AppXDeployment-Server 429 (4)
Windows cannot install package 967439b3-5b2b-4167-839c-0ba174a6c946_3.2.17.0_neutral_~_cb1zszxp1a70a because a different package 967439b3-5b2b-4167-839c-0ba174a6c946_3.2.16.0_neutral_~_wytc7bwvwy2aa with the same name is already installed. Remove package 967439b3-5b2b-4167-839c-0ba174a6c946_3.2.16.0_neutral_~_wytc7bwvwy2aa before installing.
Summing up, a conflict with a package with the same name that already exists, because the update is detected as a different package.
Expected behavior
There should be a way to keep on updating our applications despite changes in the signing certificate. Because of a company moving from one city to another, or a Certifcate Autority changing its policies (now enforces everything in upper cases). That shoudn't mean that our whole user base must do a manual uninstall and reinstallation of the application.
Screenshots
If applicable, add screenshots to help explain your problem.
Platform
x64 and x86 at least. Not tested in any other.
Additional context
This thread Updating existing app with new certificate UWP deals with the same problem. I suppose it does not matter what kind of target application you are making since the issue comes at the core of the distribution process. It is not so much what you are publishing but more the way to do it.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file, test, or entry point is named. Start by tracing how the MSIX SDK handles package identity and signing certificates during updates, using the reported 0x80070490 and 0x80073CF3 failures as reproduction signals. Done means an app signed with a changed certificate can update without manual uninstall and reinstall.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100