Handling signing

So far, we have succeeded in creating an MSIX package, but we still can't use it. In Chapter 11, Publishing Your Application, we learned that an MSIX package should be as follows:

• It must be signed with a certificate.
• The certificate must be trusted by the machine.
• The Publisher defined in the manifest must match the subject of the certificate.

As such, we can't really use the package created by our CD pipeline since it isn't signed. If we try to install it, Windows will show the following error:

Figure 12.6 – The error displayed by Windows when we try to install an unsigned MSIX package

To solve this problem, we must sign the package as part of our workflow. Signing is a very delicate task as we must find a way to sign the package without exposing our certificate. If we don't protect it, a malicious developer could steal it and use it to sign other applications using our identity.

Visual...