From 9047ebd0e41cb0f9ecb63d0912d6e880c47c7a1e Mon Sep 17 00:00:00 2001
From: abrichr <richard.abrich@mldsai.com>
Date: Tue, 3 Nov 2026 00:31:30 -0500
Subject: [PATCH] SignPath: match the MSI's program files under its install
 directory

The test-signing request 7fa928cb (run 41576282781) failed. Inside the MSI,
openadapt-desktop.exe and openadapt-engine.exe sit under
PFiles/OpenAdapt Desktop/, and the pe-file-set included "*.exe", which does
not cross a directory separator and so matched nothing (min-matches defaults
to 1). Use "**/*.exe" and "**/*.dll", and test that every include is recursive.
---
 .../openadapt-desktop-installers.xml                     | 9 +++++++--
 packages/desktop/tests/test_native_signing.py            | 5 +++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.signpath/artifact-configurations/openadapt-desktop-installers.xml b/.signpath/artifact-configurations/openadapt-desktop-installers.xml
index 9975ac5a9..144ec3ab5 100644
--- a/.signpath/artifact-configurations/openadapt-desktop-installers.xml
+++ b/.signpath/artifact-configurations/openadapt-desktop-installers.xml
@@ -12,13 +12,18 @@
     the openadapt-engine sidecar) and then the MSI itself;
   * the NSIS setup executable is signed. SignPath cannot open an NSIS archive,
     so the program files it installs and its uninstaller stay unsigned.
+
+  Inside the MSI the program files sit under its install directory
+  (PFiles/OpenAdapt Desktop/), not at its root, and a bare "*" does not cross
+  a directory separator, so the includes use "**/". With "*.exe" the set
+  matched nothing and SignPath failed the request.
 -->
 <artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
   <zip-file>
     <msi-file path="*.msi">
       <pe-file-set>
-        <include path="*.exe" max-matches="unbounded" />
-        <include path="*.dll" min-matches="0" max-matches="unbounded" />
+        <include path="**/*.exe" max-matches="unbounded" />
+        <include path="**/*.dll" min-matches="0" max-matches="unbounded" />
         <for-each>
           <authenticode-sign />
         </for-each>
diff --git a/packages/desktop/tests/test_native_signing.py b/packages/desktop/tests/test_native_signing.py
index 489a0f95f..6875cbe18 100644
--- a/packages/desktop/tests/test_native_signing.py
+++ b/packages/desktop/tests/test_native_signing.py
@@ -239,6 +239,11 @@ def test_one_signpath_request_deep_signs_the_msi_and_signs_the_nsis_setup() -> N
     assert msi is not None and msi.get("path") == "*.msi"
     nested = msi.find("sp:pe-file-set/sp:for-each/sp:authenticode-sign", namespace)
     assert nested is not None, "the MSI's program files must be signed too"
+    # The program files sit under the MSI's install directory, and SignPath's
+    # "*" does not cross a directory separator: a root-only "*.exe" matches
+    # nothing and fails the signing request.
+    includes = msi.findall("sp:pe-file-set/sp:include", namespace)
+    assert includes and all(i.get("path", "").startswith("**/") for i in includes)
     assert msi.find("sp:authenticode-sign", namespace) is not None
     nsis = root.find("sp:zip-file/sp:pe-file", namespace)
     assert nsis is not None and nsis.get("path") == "*-setup.exe"