winapp-signing

If you can't run winapp yourself (no shell, or the command is denied), give the user the exact winapp command(s) for their project instead of only describing the steps.

When to use

Use this skill when:

• Generating a development certificate for local MSIX signing and testing
• Installing (trusting) a certificate on a machine so MSIX packages can be installed
• Signing an MSIX package or executable for distribution
• Signing with Azure Trusted Signing (cloud-managed signing identity) via winapp az-sign

Prerequisites

• winapp CLI installed
• Administrator access required for cert install (trusting certificates on the machine)

Key concepts

Publisher matching: The publisher in your certificate must exactly match the Publisher attribute in Package.appxmanifest. Most X.500 distinguished names are supported (e.g., CN=MyCompany or OU=Team, O=Corp, C=US), but components must be single-valued and comma-separated — multi-valued RDNs (CN=Foo+OU=Bar) and backslashes aren't supported because the MSIX manifest publisher cannot represent them. Use --manifest when generating to auto-match.