Sign with SignPath

Fixes #1732

.github/workflows/build.yml

@@ -53,19 +53,125 @@ jobs:
           "NEW_VERSION=$finalVersion" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
           Write-Host "Building version: $finalVersion"
 
-      - name: Build
+      - name: Build binaries
         shell: cmd
         env:
-          APPVEYOR_BUILD_VERSION: ${{ steps.versioning.outputs.NEW_VERSION }}
+          CS_VERSION: ${{ steps.versioning.outputs.NEW_VERSION }}
-        run: Src\Setup\__MakeFinal.bat
+        run: Src\Setup\BuildBinaries.bat
 
-      - name: Upload artifacts
+      - name: Upload binaries
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        id: upload-binaries
         uses: actions/upload-artifact@v7
         with:
-          name: OpenShell
+          name: Binaries
           path: |
-            Src/Setup/Final/
+            Src/Setup/Output/
-            !Src/Setup/Final/OpenShellLoc.zip
+            !Src/Setup/Output/*.skin
+            !Src/Setup/Output/*.skin7
+            !Src/Setup/Output/*.zip
+          retention-days: 1
+
+      - name: Sign binaries with SignPath
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
+          project-slug: 'Open-Shell-Menu'
+          signing-policy-slug: 'release-signing'
+          artifact-configuration-slug: 'Binaries'
+          github-artifact-id: '${{ steps.upload-binaries.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'Src/Setup/Output/'
+
+      - name: Build installers
+        shell: cmd
+        env:
+          CS_VERSION: ${{ steps.versioning.outputs.NEW_VERSION }}
+        run: Src\Setup\_BuildEnglish.bat
+
+      - name: Upload installers
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        id: upload-installers
+        uses: actions/upload-artifact@v7
+        with:
+          name: MSI
+          path: |
+            Src/Setup/Temp/*.msi
+          retention-days: 1
+
+      - name: Sign installers with SignPath
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
+          project-slug: 'Open-Shell-Menu'
+          signing-policy-slug: 'release-signing'
+          artifact-configuration-slug: 'Installers'
+          github-artifact-id: '${{ steps.upload-installers.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'Src/Setup/Temp/'
+
+      - name: Build setup and symbols
+        shell: cmd
+        env:
+          CS_VERSION: ${{ steps.versioning.outputs.NEW_VERSION }}
+        run: Src\Setup\BuildArchives.bat
+
+      - name: Upload symbols
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            Src/Setup/Final/OpenShellSymbols*.7z
+          archive: false
+
+      - name: Upload utility
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            Src/Setup/Final/Utility.exe
+          archive: false
+
+      - name: Upload setup
+        id: upload-setup
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            Src/Setup/Final/OpenShellSetup*.exe
+          archive: false
+
+      - name: Sign setup with SignPath
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
+          project-slug: 'Open-Shell-Menu'
+          signing-policy-slug: 'release-signing'
+          github-artifact-id: '${{ steps.upload-setup.outputs.artifact-id }}'
+          wait-for-completion: true
+          skip-decompress: true
+          output-artifact-directory: 'Src/Setup/Final/'
+
+      # `overwrite: true` doesn't work with `archive: false`, so we have to delete the original first
+      # https://github.com/actions/upload-artifact/issues/769
+      # https://github.com/actions/upload-artifact/issues/785
+      - name: Delete setup
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        uses: geekyeggo/delete-artifact@v6
+        with:
+            name: OpenShellSetup*.exe
+
+      - name: Upload setup (signed)
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            Src/Setup/Final/OpenShellSetup*.exe
+          archive: false
+          overwrite: true
 
   release:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
@@ -74,10 +180,18 @@ jobs:
     permissions:
       contents: write # Elevate permissions ONLY for this job
     steps:
-      - name: Download artifacts
+      - name: Download setup
         uses: actions/download-artifact@v8
         with:
-          name: OpenShell
+          pattern: OpenShellSetup*.exe
+      - name: Download symbols
+        uses: actions/download-artifact@v8
+        with:
+          pattern: OpenShellSymbols*.7z
+      - name: Download utility
+        uses: actions/download-artifact@v8
+        with:
+          pattern: Utility.exe
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3

README.md

@@ -23,6 +23,9 @@ You can find the latest stable version here:
 
 [![GitHub All Releases](https://img.shields.io/github/downloads/Open-Shell/Open-Shell-Menu/total?style=for-the-badge&color=4bc2ee&logo=github)](https://github.com/Open-Shell/Open-Shell-Menu/releases/latest)
 
+> [!NOTE]
+> Free code signing provided by [SignPath.io](https://about.signpath.io/), certificate by [SignPath Foundation](https://signpath.org/)
+
 > [!IMPORTANT]
 > #### Windows for ARM compatibility
 > Open-Shell is compatible with Windows for ARM since version [4.4.196](https://github.com/Open-Shell/Open-Shell-Menu/releases/tag/v4.4.196).

Src/Setup/BuildArchives.bat

@@ -1,5 +1,145 @@
+@echo off
+set PATH=C:\Program Files\7-Zip\;%PATH%
+cd %~dp0
+
+call _Version.bat
+
+REM ********* Build MSI Checksums
+echo --- MSI Checksums
+..\..\build\bin\Release\Utility.exe crcmsi Temp
+@if ERRORLEVEL 1 exit /b 1
+
+REM ********* Build bootstrapper
+echo --- Bootstrapper
+for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.Component.MSBuild -property installationPath`) do set MSBuildDir=%%i\MSBuild\Current\Bin\
+
+"%MSBuildDir%MSBuild.exe" Setup.sln /m /t:Rebuild /p:Configuration="Release" /p:Platform="Win32" /verbosity:quiet /nologo
+@if ERRORLEVEL 1 exit /b 1
+
+
+if exist Final rd /Q /S Final
+md Final
+
+copy /B ..\..\build\bin\Release\Setup.exe Final\OpenShellSetup_%CS_VERSION_STR%.exe > nul
+
+if defined APPVEYOR (
+	appveyor PushArtifact Final\OpenShellSetup_%CS_VERSION_STR%.exe
+)
+
 REM ***** Collect PDBs
 
+REM ********* Collect debug info
+md Output\PDB32
+md Output\PDB64
+md Output\PDBARM64
+
+REM Explorer 32
+copy /B ..\..\build\bin\Setup\ClassicExplorer32.pdb Output\PDB32 > nul
+copy /B Output\ClassicExplorer32.dll Output\PDB32 > nul
+copy /B ..\..\build\bin\Setup\ClassicExplorerSettings.pdb Output\PDB32 > nul
+copy /B Output\ClassicExplorerSettings.exe Output\PDB32 > nul
+
+REM Explorer 64
+copy /B ..\..\build\bin\Setup64\ClassicExplorer64.pdb Output\PDB64 > nul
+copy /B Output\x64\ClassicExplorer64.dll Output\PDB64 > nul
+
+REM Explorer ARM64
+copy /B ..\..\build\bin\SetupARM64\ClassicExplorer64.pdb Output\PDBARM64 > nul
+copy /B Output\ARM64\ClassicExplorer64.dll Output\PDBARM64 > nul
+
+REM IE 32
+copy /B ..\..\build\bin\Setup\ClassicIEDLL_32.pdb Output\PDB32 > nul
+copy /B Output\ClassicIEDLL_32.dll Output\PDB32 > nul
+copy /B ..\..\build\bin\Setup\ClassicIE_32.pdb Output\PDB32 > nul
+copy /B Output\ClassicIE_32.exe Output\PDB32 > nul
+
+REM IE 64
+copy /B ..\..\build\bin\Setup64\ClassicIEDLL_64.pdb Output\PDB64 > nul
+copy /B Output\x64\ClassicIEDLL_64.dll Output\PDB64 > nul
+copy /B ..\..\build\bin\Setup64\ClassicIE_64.pdb Output\PDB64 > nul
+copy /B Output\x64\ClassicIE_64.exe Output\PDB64 > nul
+
+REM IE ARM64
+copy /B ..\..\build\bin\SetupARM64\ClassicIEDLL_64.pdb Output\PDBARM64 > nul
+copy /B Output\ARM64\ClassicIEDLL_64.dll Output\PDBARM64 > nul
+copy /B ..\..\build\bin\SetupARM64\ClassicIE_64.pdb Output\PDBARM64 > nul
+copy /B Output\ARM64\ClassicIE_64.exe Output\PDBARM64 > nul
+
+REM Menu 32
+copy /B ..\..\build\bin\Setup\StartMenu.pdb Output\PDB32 > nul
+copy /B Output\StartMenu.exe Output\PDB32 > nul
+copy /B ..\..\build\bin\Setup\StartMenuDLL.pdb Output\PDB32 > nul
+copy /B Output\StartMenuDLL.dll Output\PDB32 > nul
+copy /B ..\..\build\bin\Setup\StartMenuHelper32.pdb Output\PDB32 > nul
+copy /B Output\StartMenuHelper32.dll Output\PDB32 > nul
+copy /B ..\..\build\bin\Release\Update.pdb Output\PDB32 > nul
+copy /B Output\Update.exe Output\PDB32 > nul
+copy /B ..\..\build\bin\Release\DesktopToasts.pdb Output\PDB32 > nul
+copy /B Output\DesktopToasts.dll Output\PDB32 > nul
+
+REM Menu 64
+copy /B ..\..\build\bin\Setup64\StartMenu.pdb Output\PDB64 > nul
+copy /B Output\x64\StartMenu.exe Output\PDB64 > nul
+copy /B ..\..\build\bin\Setup64\StartMenuDLL.pdb Output\PDB64 > nul
+copy /B Output\x64\StartMenuDLL.dll Output\PDB64 > nul
+copy /B ..\..\build\bin\Setup64\StartMenuHelper64.pdb Output\PDB64 > nul
+copy /B Output\x64\StartMenuHelper64.dll Output\PDB64 > nul
+
+REM Menu ARM64
+copy /B ..\..\build\bin\SetupARM64\StartMenu.pdb Output\PDBARM64 > nul
+copy /B Output\ARM64\StartMenu.exe Output\PDBARM64 > nul
+copy /B ..\..\build\bin\SetupARM64\StartMenuDLL.pdb Output\PDBARM64 > nul
+copy /B Output\ARM64\StartMenuDLL.dll Output\PDBARM64 > nul
+copy /B ..\..\build\bin\SetupARM64\StartMenuHelper64.pdb Output\PDBARM64 > nul
+copy /B Output\ARM64\StartMenuHelper64.dll Output\PDBARM64 > nul
+
+REM ********* Source Index PDBs
+
+set PDBSTR_PATH="C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\srcsrv\pdbstr.exe"
+
+if exist %PDBSTR_PATH% (
+	echo --- Adding source index to PDBs
+	call CreateSourceIndex.bat ..\.. > Output\pdbstr.txt
+
+	for %%f in (Output\PDB32\*.pdb) do (
+		%PDBSTR_PATH% -w -p:%%f -s:srcsrv -i:Output\pdbstr.txt
+		if not ERRORLEVEL 0 (
+			echo Error adding source index to PDB
+			exit /b 1
+		)
+	)
+
+	for %%f in (Output\PDB64\*.pdb) do (
+		%PDBSTR_PATH% -w -p:%%f -s:srcsrv -i:Output\pdbstr.txt
+		if not ERRORLEVEL 0 (
+			echo Error adding source index to PDB
+			exit /b 1
+		)
+	)
+
+	for %%f in (Output\PDBARM64\*.pdb) do (
+		%PDBSTR_PATH% -w -p:%%f -s:srcsrv -i:Output\pdbstr.txt
+		if not ERRORLEVEL 0 (
+			echo Error adding source index to PDB
+			exit /b 1
+		)
+	)
+)
+
+REM ********* Prepare symbols
+
+set SYMSTORE_PATH="C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symstore.exe"
+
+%SYMSTORE_PATH% add /r /f Output\PDB32 /s Output\symbols /t OpenShell -:NOREFS > nul
+%SYMSTORE_PATH% add /r /f Output\PDB64 /s Output\symbols /t OpenShell -:NOREFS > nul
+%SYMSTORE_PATH% add /r /f Output\PDBARM64 /s Output\symbols /t OpenShell -:NOREFS > nul
+rd /Q /S Output\symbols\000Admin > nul
+del Output\symbols\pingme.txt > nul
+
+rd /Q /S Output\PDB32
+rd /Q /S Output\PDB64
+rd /Q /S Output\PDBARM64
+
 echo -- Creating symbols package
 set CS_SYMBOLS_NAME=OpenShellSymbols_%CS_VERSION_STR%.7z
 
@@ -20,10 +160,10 @@ cd ..
 
 cd Setup
 
-copy /B ..\..\build\bin\Release\Utility.exe .\Final > nul
+copy /B Output\Utility.exe .\Final > nul
 
 if defined APPVEYOR (
-	appveyor PushArtifact ..\..\build\bin\Release\Utility.exe
+	appveyor PushArtifact Output\Utility.exe
 )
 
 exit /b 0

Src/Setup/BuildBinaries.bat

@@ -1,3 +1,8 @@
+@echo off
+cd %~dp0
+
+call _Version.bat
+
 if exist Output rd /Q /S Output
 md Output
 md Output\x64
@@ -50,6 +55,7 @@ copy /B ..\..\build\bin\Setup\StartMenuHelper32.dll Output > nul
 copy /B ..\..\build\bin\Release\Update.exe Output > nul
 copy /B ..\..\build\bin\Release\DesktopToasts.dll Output > nul
 copy /B ..\..\build\bin\Release\SetupHelper.exe Output > nul
+copy /B ..\..\build\bin\Release\Utility.exe Output > nul
 
 copy /B ..\..\build\bin\SetupARM64\ClassicExplorer64.dll Output\ARM64 > nul
 copy /B ..\..\build\bin\SetupARM64\ClassicIEDLL_64.dll Output\ARM64 > nul
@@ -82,119 +88,6 @@ copy /B "..\..\build\bin\Skins\Metallic.skin7" Output > nul
 copy /B "..\..\build\bin\Skins\Immersive.skin" Output > nul
 copy /B "..\..\build\bin\Skins\Immersive.skin7" Output > nul
 
-
-REM ********* Collect debug info
-md Output\PDB32
-md Output\PDB64
-md Output\PDBARM64
-
-REM Explorer 32
-copy /B ..\..\build\bin\Setup\ClassicExplorer32.pdb Output\PDB32 > nul
-copy /B Output\ClassicExplorer32.dll Output\PDB32 > nul
-copy /B ..\..\build\bin\Setup\ClassicExplorerSettings.pdb Output\PDB32 > nul
-copy /B Output\ClassicExplorerSettings.exe Output\PDB32 > nul
-
-REM Explorer 64
-copy /B ..\..\build\bin\Setup64\ClassicExplorer64.pdb Output\PDB64 > nul
-copy /B Output\x64\ClassicExplorer64.dll Output\PDB64 > nul
-
-REM Explorer ARM64
-copy /B ..\..\build\bin\SetupARM64\ClassicExplorer64.pdb Output\PDBARM64 > nul
-copy /B Output\ARM64\ClassicExplorer64.dll Output\PDBARM64 > nul
-
-REM IE 32
-copy /B ..\..\build\bin\Setup\ClassicIEDLL_32.pdb Output\PDB32 > nul
-copy /B Output\ClassicIEDLL_32.dll Output\PDB32 > nul
-copy /B ..\..\build\bin\Setup\ClassicIE_32.pdb Output\PDB32 > nul
-copy /B Output\ClassicIE_32.exe Output\PDB32 > nul
-
-REM IE 64
-copy /B ..\..\build\bin\Setup64\ClassicIEDLL_64.pdb Output\PDB64 > nul
-copy /B Output\x64\ClassicIEDLL_64.dll Output\PDB64 > nul
-copy /B ..\..\build\bin\Setup64\ClassicIE_64.pdb Output\PDB64 > nul
-copy /B Output\x64\ClassicIE_64.exe Output\PDB64 > nul
-
-REM IE ARM64
-copy /B ..\..\build\bin\SetupARM64\ClassicIEDLL_64.pdb Output\PDBARM64 > nul
-copy /B Output\ARM64\ClassicIEDLL_64.dll Output\PDBARM64 > nul
-copy /B ..\..\build\bin\SetupARM64\ClassicIE_64.pdb Output\PDBARM64 > nul
-copy /B Output\ARM64\ClassicIE_64.exe Output\PDBARM64 > nul
-
-REM Menu 32
-copy /B ..\..\build\bin\Setup\StartMenu.pdb Output\PDB32 > nul
-copy /B Output\StartMenu.exe Output\PDB32 > nul
-copy /B ..\..\build\bin\Setup\StartMenuDLL.pdb Output\PDB32 > nul
-copy /B Output\StartMenuDLL.dll Output\PDB32 > nul
-copy /B ..\..\build\bin\Setup\StartMenuHelper32.pdb Output\PDB32 > nul
-copy /B Output\StartMenuHelper32.dll Output\PDB32 > nul
-copy /B ..\..\build\bin\Release\Update.pdb Output\PDB32 > nul
-copy /B Output\Update.exe Output\PDB32 > nul
-copy /B ..\..\build\bin\Release\DesktopToasts.pdb Output\PDB32 > nul
-copy /B Output\DesktopToasts.dll Output\PDB32 > nul
-
-REM Menu 64
-copy /B ..\..\build\bin\Setup64\StartMenu.pdb Output\PDB64 > nul
-copy /B Output\x64\StartMenu.exe Output\PDB64 > nul
-copy /B ..\..\build\bin\Setup64\StartMenuDLL.pdb Output\PDB64 > nul
-copy /B Output\x64\StartMenuDLL.dll Output\PDB64 > nul
-copy /B ..\..\build\bin\Setup64\StartMenuHelper64.pdb Output\PDB64 > nul
-copy /B Output\x64\StartMenuHelper64.dll Output\PDB64 > nul
-
-REM Menu ARM64
-copy /B ..\..\build\bin\SetupARM64\StartMenu.pdb Output\PDBARM64 > nul
-copy /B Output\ARM64\StartMenu.exe Output\PDBARM64 > nul
-copy /B ..\..\build\bin\SetupARM64\StartMenuDLL.pdb Output\PDBARM64 > nul
-copy /B Output\ARM64\StartMenuDLL.dll Output\PDBARM64 > nul
-copy /B ..\..\build\bin\SetupARM64\StartMenuHelper64.pdb Output\PDBARM64 > nul
-copy /B Output\ARM64\StartMenuHelper64.dll Output\PDBARM64 > nul
-
-REM ********* Source Index PDBs
-
-set PDBSTR_PATH="C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\srcsrv\pdbstr.exe"
-
-if exist %PDBSTR_PATH% (
-	echo --- Adding source index to PDBs
-	call CreateSourceIndex.bat ..\.. > Output\pdbstr.txt
-
-	for %%f in (Output\PDB32\*.pdb) do (
-		%PDBSTR_PATH% -w -p:%%f -s:srcsrv -i:Output\pdbstr.txt
-		if not ERRORLEVEL 0 (
-			echo Error adding source index to PDB
-			exit /b 1
-		)
-	)
-
-	for %%f in (Output\PDB64\*.pdb) do (
-		%PDBSTR_PATH% -w -p:%%f -s:srcsrv -i:Output\pdbstr.txt
-		if not ERRORLEVEL 0 (
-			echo Error adding source index to PDB
-			exit /b 1
-		)
-	)
-
-	for %%f in (Output\PDBARM64\*.pdb) do (
-		%PDBSTR_PATH% -w -p:%%f -s:srcsrv -i:Output\pdbstr.txt
-		if not ERRORLEVEL 0 (
-			echo Error adding source index to PDB
-			exit /b 1
-		)
-	)
-)
-
-REM ********* Prepare symbols
-
-set SYMSTORE_PATH="C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symstore.exe"
-
-%SYMSTORE_PATH% add /r /f Output\PDB32 /s Output\symbols /t OpenShell -:NOREFS > nul
-%SYMSTORE_PATH% add /r /f Output\PDB64 /s Output\symbols /t OpenShell -:NOREFS > nul
-%SYMSTORE_PATH% add /r /f Output\PDBARM64 /s Output\symbols /t OpenShell -:NOREFS > nul
-rd /Q /S Output\symbols\000Admin > nul
-del Output\symbols\pingme.txt > nul
-
-rd /Q /S Output\PDB32
-rd /Q /S Output\PDB64
-rd /Q /S Output\PDBARM64
-
 REM ********* Build ADMX
 echo --- ADMX
 if exist Output\PolicyDefinitions.zip (
@@ -209,7 +102,7 @@ cd ..\Localization\English
 @if ERRORLEVEL 1 exit /b 1
 md en-US
 copy /B *.adml en-US > nul
-7z a ..\..\Setup\Output\PolicyDefinitions.zip *.admx en-US\*.adml PolicyDefinitions.rtf > nul
+tar -a -c -f ..\..\Setup\Output\PolicyDefinitions.zip *.admx en-US\*.adml PolicyDefinitions.rtf
 rd /Q /S en-US
 cd ..\..\Setup
 

Src/Setup/BuildInstaller.bat

@@ -1,3 +1,9 @@
+@echo off
+set PATH=C:\Program Files (x86)\HTML Help Workshop;C:\Program Files (x86)\WiX Toolset v3.14\bin\;%PATH%
+cd %~dp0
+
+call _Version.bat
+
 REM ********* Build Help
 echo -- Building Installer (%CS_LANG_NAME_SHORT%)
 @setlocal EnableDelayedExpansion
@@ -22,9 +28,6 @@ echo -- Building Installer (%CS_LANG_NAME_SHORT%)
 @if _%CS_LANG_NAME%==_ echo Unrecognized language '%CS_LANG_FOLDER%'
 @if _%CS_LANG_NAME%==_ exit /b 1
 
-SET CS_INSTALLER_NAME=OpenShellSetup_%CS_VERSION_STR%-%CS_LANG_NAME_SHORT%
-if %CS_LANG_NAME_SHORT%==en SET CS_INSTALLER_NAME=OpenShellSetup_%CS_VERSION_STR%
-
 if exist Temp rd /Q /S Temp
 md Temp
 
@@ -66,27 +69,6 @@ candle Setup.wxs -nologo -out Temp\SetupARM64.wixobj -ext WixUIExtension -ext Wi
 light Temp\SetupARM64.wixobj -nologo -out Temp\SetupARM64.msi -ext WixUIExtension -ext WixUtilExtension -loc ..\Localization\%CS_LANG_FOLDER%\OpenShellText-%CS_LANG_NAME%.wxl -loc ..\Localization\%CS_LANG_FOLDER%\WixUI_%CS_LANG_NAME%.wxl -sice:ICE38 -sice:ICE43 -sice:ICE09
 @if ERRORLEVEL 1 exit /b 1
 
-REM ********* Build MSI Checksums
-echo --- MSI Checksums
-..\..\build\bin\Release\Utility.exe crcmsi Temp
-@if ERRORLEVEL 1 exit /b 1
-
-REM ********* Build bootstrapper
-echo --- Bootstrapper
-for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.Component.MSBuild -property installationPath`) do set MSBuildDir=%%i\MSBuild\Current\Bin\
-
-"%MSBuildDir%MSBuild.exe" Setup.sln /m /t:Rebuild /p:Configuration="Release" /p:Platform="Win32" /verbosity:quiet /nologo
-@if ERRORLEVEL 1 exit /b 1
-
-if exist Final rd /Q /S Final
-md Final
-
-copy /B ..\..\build\bin\Release\Setup.exe Final\%CS_INSTALLER_NAME%.exe > nul
-
-if defined APPVEYOR (
-	appveyor PushArtifact Final\%CS_INSTALLER_NAME%.exe
-)
-
 SET CS_LANG_FOLDER=
 SET CS_LANG_NAME=
 SET CS_LANG_NAME_SHORT=

Src/Setup/Utility/ManualUninstall.cpp

@@ -30,17 +30,17 @@
 #ifdef SAFE_MODE
 #define RegDeleteTree2(x,y) 5
 #define RegDeleteValue2(x,y) 5
-#define DeleteFile2(x) (SetLastError(3), FALSE)
+#define DeleteFile3(x) (SetLastError(3), FALSE)
 #define MoveFileEx2(x,y,z) (SetLastError(5), FALSE)
 #define SHFileOperation2(x) 0x78
-#define RemoveDirectory2(x) FALSE
+#define RemoveDirectory3(x) FALSE
 #else
 #define RegDeleteTree2(x,y) RegDeleteTree(x,y)
 #define RegDeleteValue2(x,y) RegDeleteValue(x,y)
-#define DeleteFile2(x) DeleteFile(x)
+#define DeleteFile3(x) DeleteFile(x)
 #define MoveFileEx2(x,y,z) MoveFileEx(x,y,z)
 #define SHFileOperation2(x) SHFileOperation(x)
-#define RemoveDirectory2(x) RemoveDirectory(x)
+#define RemoveDirectory3(x) RemoveDirectory(x)
 #endif
 
 // files to delete from the Open-Shell folder
@@ -777,7 +777,7 @@ static bool DeleteFileEx( const wchar_t *fname, bool bAllowDelay )
 		if (attribs&FILE_ATTRIBUTE_READONLY)
 			SetFileAttributes(fname,attribs&~FILE_ATTRIBUTE_READONLY);
 		LogMessage(-1,L"Deleting file %s",fname);
-		if (!DeleteFile2(fname))
+		if (!DeleteFile3(fname))
 		{
 			int error=GetLastError();
 			if (error==ERROR_ACCESS_DENIED && bAllowDelay)
@@ -826,7 +826,7 @@ static void DeleteDirectoryEx( const wchar_t *path, bool bDelay )
 	else
 	{
 		LogMessage(-1,L"Deleting directory %s",path);
-		if (!RemoveDirectory2(path))
+		if (!RemoveDirectory3(path))
 		{
 			int error=GetLastError();
 			bool bOldHasErrors=g_bHasErrors;

Src/Setup/_BuildEnglish.bat

@@ -1,3 +1,6 @@
+@echo off
+cd %~dp0
+
 SET CS_LANG_FOLDER=English
 SET CS_LANG_NAME=en-US
 SET CS_LANG_NAME_SHORT=en

Src/Setup/_Version.bat

@@ -0,0 +1,9 @@
+@echo off
+
+rem Convert . to _
+set CS_VERSION_STR=%CS_VERSION:.=_%
+
+set CS_VERSION_ORIG=%CS_VERSION%
+
+rem Strip optional "-xyz" suffix from version
+for /f "delims=- tokens=1,1" %%i in ("%CS_VERSION%") do set CS_VERSION=%%i

Src/StartMenu/StartMenuDLL/MenuCommands.cpp

@@ -24,6 +24,60 @@
 #include <propvarutil.h>
 #include <algorithm>
 #include <propkey.h>
+#include <thread>
+
+// Execute function on a separate STA thread while pumping messages on caller thread.
+template <typename TFunc>
+static auto ExecuteOnSTAThread(TFunc&& func) -> decltype(func())
+{
+	using ReturnType = decltype(func());
+	ReturnType result{};
+
+	std::thread worker([&func, &result]() mutable {
+		CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
+		result = func();
+		CoUninitialize();
+	});
+
+	// Pump messages while waiting for the worker (dialog) to finish
+	while (true)
+	{
+		HANDLE hWorker = worker.native_handle();
+		if (MsgWaitForMultipleObjects(1, &hWorker, FALSE, INFINITE, QS_ALLINPUT) == WAIT_OBJECT_0)
+			break;
+
+		MSG msg;
+		while (PeekMessage(&msg, NULL, 0, 0, PM_REMOVE))
+		{
+			if (msg.message == WM_QUIT)
+			{
+				PostQuitMessage((int)msg.wParam);
+				break;
+			}
+			TranslateMessage(&msg);
+			DispatchMessage(&msg);
+		}
+	}
+	worker.join();
+
+	return result;
+}
+
+// Wrapper for IContextMenu::InvokeCommand that runs on separate STA thread and pumps messages
+static HRESULT InvokeCommandSafe(IContextMenu* pMenu, LPCMINVOKECOMMANDINFO pInfo)
+{
+	return ExecuteOnSTAThread([&]() {
+		return pMenu->InvokeCommand(pInfo);
+	});
+}
+
+// Wrapper for SHOpenFolderAndSelectItems that runs on separate STA thread and pumps messages
+static HRESULT SHOpenFolderAndSelectItemsSafe(PCIDLIST_ABSOLUTE pidlFolder, UINT cidl, PCUITEMID_CHILD_ARRAY apidl, DWORD dwFlags)
+{
+	return ExecuteOnSTAThread([=]() {
+		return SHOpenFolderAndSelectItems(pidlFolder, cidl, apidl, dwFlags);
+	});
+}
 
 static CString g_RenameText;
 static POINT g_RenamePos;
@@ -2871,7 +2925,7 @@ void CMenuContainer::ActivateItem( int index, TActivateType type, const POINT *p
 		}
 		else
 		{
-			SHOpenFolderAndSelectItems(pItemPidl1,0,NULL,0);
+			SHOpenFolderAndSelectItemsSafe(pItemPidl1,0,NULL,0);
 		}
 		res=0;
 	}
@@ -3113,7 +3167,7 @@ void CMenuContainer::ActivateItem( int index, TActivateType type, const POINT *p
 			}
 			else
 			{
-				HRESULT hr=pInvokeMenu->InvokeCommand((LPCMINVOKECOMMANDINFO)&info);
+				HRESULT hr=InvokeCommandSafe(pInvokeMenu,(LPCMINVOKECOMMANDINFO)&info);
 				LOG_MENU(LOG_EXECUTE,L"Invoke command, ptr=%p, res=%d",this,hr);
 				executeSuccess=SUCCEEDED(hr);
 			}

Src/StartMenu/StartMenuDLL/StartMenuDLL.cpp

@@ -22,6 +22,7 @@
 #include <dbghelp.h>
 #include <set>
 #include <Thumbcache.h>
+#include <tlhelp32.h>
 
 #define HOOK_DROPTARGET // define this to replace the IDropTarget of the start button
 #define START_TOUCH // touch support for the start button
@@ -2936,6 +2937,35 @@ static void OpenCortana( void )
 		ShellExecute(NULL,NULL,L"shell:::{2559a1f8-21d7-11d4-bdaf-00c04f60b9f0}",NULL,NULL,SW_SHOWNORMAL);
 }
 
+HMODULE GetModuleHandleByPrefix(const WCHAR* prefix)
+{
+	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
+	if (snapshot == INVALID_HANDLE_VALUE)
+		return nullptr;
+
+	size_t prefixLength = wcslen(prefix);
+
+	MODULEENTRY32 me{};
+	me.dwSize = sizeof(me);
+
+	HMODULE result = nullptr;
+
+	if (Module32First(snapshot, &me))
+	{
+		do
+		{
+			if (_wcsnicmp(me.szModule, prefix, prefixLength) == 0)
+			{
+				result = reinterpret_cast<HMODULE>(me.modBaseAddr);
+				break;
+			}
+		} while (Module32Next(snapshot, &me));
+	}
+
+	CloseHandle(snapshot);
+	return result;
+}
+
 static void InitStartMenuDLL( void )
 {
 	static bool initCalled = false;
@@ -2979,10 +3009,7 @@ static void InitStartMenuDLL( void )
 		auto module=GetModuleHandle(L"taskbar.dll");
 		if (!module)
 		{
-			module = GetModuleHandle(L"ep_taskbar.5.dll");
+			module = GetModuleHandleByPrefix(L"ep_taskbar");
-			if (!module)
-				module = GetModuleHandle(L"ep_taskbar.2.dll");
-
 			if (module)
 				g_epTaskbar = true;
 		}