Add package policy editor

.github/workflows/build-release.yml

@@ -219,6 +219,13 @@ jobs:
             throw "Windows app host was not produced at unigetui_bin/UniGetUI.exe"
           }
 
+          # The elevated policy-write helper is authenticated by exact path at runtime, and it must
+          # be present here so the code-signing step below signs it and the integrity tree that is
+          # generated afterwards covers it.
+          if (-not (Test-Path "unigetui_bin/Assets/Utilities/UniGetUI.PolicyElevator.exe")) {
+            throw "Elevated policy helper was not staged at unigetui_bin/Assets/Utilities/UniGetUI.PolicyElevator.exe"
+          }
+
           $MaxShippedPdbSizeBytes = 1MB
           $PdbsToRemove = Get-ChildItem "unigetui_bin" -Filter "*.pdb" -File -Recurse | Where-Object {
             $_.Length -gt $MaxShippedPdbSizeBytes
@@ -250,6 +257,14 @@ jobs:
             -CertificateName '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}' `
             -TimestampServer '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}'
 
+          # The helper is the one binary whose signature is checked at runtime by the host before
+          # it is elevated, so an unsigned helper must fail the release rather than ship.
+          $HelperPath = Join-Path $PWD "unigetui_bin/Assets/Utilities/UniGetUI.PolicyElevator.exe"
+          $HelperSignature = Get-AuthenticodeSignature $HelperPath
+          if ($HelperSignature.Status -ne "Valid") {
+            throw "Elevated policy helper is not validly signed (status: $($HelperSignature.Status))."
+          }
+
       - name: Build installer
         shell: pwsh
         run: |

UniGetUI.iss

@@ -130,6 +130,8 @@ begin
     // Elevator (gsudo cache) and pinget live in {app} and lock their own files.
     TaskKillWait('UniGetUI Elevator.exe');
     TaskKillWait('pinget.exe');
+    // The elevated policy helper is short-lived, but it lives in {app} and can hold a file lock.
+    TaskKillWait('UniGetUI.PolicyElevator.exe');
     Sleep(1000); // let the OS release file handles before copying
 
 end;
@@ -346,3 +348,9 @@ Filename: "{app}\{#MyAppExeName}"; Parameters: "--migrate-wingetui-to-unigetui";
 Filename: {sys}\taskkill.exe; Parameters: "/f /im WingetUI.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillWingetUI"
 Filename: {sys}\taskkill.exe; Parameters: "/f /im UniGetUI.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillUniGetUI"
 Filename: {sys}\taskkill.exe; Parameters: "/f /im UniGetUI.Avalonia.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillUniGetUIAvalonia"
+Filename: {sys}\taskkill.exe; Parameters: "/f /im UniGetUI.PolicyElevator.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillUniGetUIPolicyElevator"
+
+[UninstallDelete]
+; The elevated policy helper is authenticated by exact path, so a leftover copy must never
+; survive an uninstall.
+Type: files; Name: "{app}\Assets\Utilities\UniGetUI.PolicyElevator.exe"

scripts/build.ps1

@@ -96,6 +96,13 @@ if (-not (Test-Path $WindowsAppHostPath)) {
     throw "Windows app host was not produced at $WindowsAppHostPath"
 }
 
+# The elevated policy-write helper is authenticated by exact path at runtime, so a missing or
+# misplaced helper must fail the build rather than silently ship an install that cannot elevate.
+$PolicyElevatorPath = Join-Path $BinDir "Assets\Utilities\UniGetUI.PolicyElevator.exe"
+if (-not (Test-Path $PolicyElevatorPath)) {
+    throw "Elevated policy helper was not staged at $PolicyElevatorPath"
+}
+
 # Keep smaller symbols for useful local crash source information, and prune oversized ones.
 $MaxShippedPdbSizeBytes = 1MB