From a8e41461c23806106addecec161d1006141c0404 Mon Sep 17 00:00:00 2001
From: Jonson Petard <41122242+greenhat616@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:58:33 +0800
Subject: [PATCH] Publish the Windows App SDK bootstrapper with each release

Builds before Windows 11 24H1 need Microsoft.WindowsAppRuntime.Bootstrap.dll
beside the executable. The release job takes it from the pinned
Microsoft.WindowsAppSDK.Foundation package, checks its SHA-256 and Microsoft
signature, and uploads it with a checksum in the executable's format.
---
 .github/workflows/release.yml | 36 ++++++++++++++++++++++++++++++++++-
 README.md                     |  6 ++++--
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d45461..54be37e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,13 +9,22 @@ permissions:
 
 env:
   CARGO_INCREMENTAL: "0"
+  # The Foundation package that Windows App SDK 2.5.1 pins. Update it and the bootstrapper
+  # hashes below together with the reactor runtime version.
+  BOOTSTRAP_FOUNDATION_VERSION: "2.3.12"
 
 jobs:
   build:
     name: Build ${{ matrix.target }}
     strategy:
       matrix:
-        target: [x86_64-pc-windows-msvc, aarch64-pc-windows-msvc]
+        include:
+          - target: x86_64-pc-windows-msvc
+            bootstrap-arch: x64
+            bootstrap-sha256: e4acd665ff39f8a0d591459bd5901482e71b4ffbe644f421ffad9431b5fed438
+          - target: aarch64-pc-windows-msvc
+            bootstrap-arch: arm64
+            bootstrap-sha256: 23f923b26fe622de4f460d60d69e41599de892e63fdcaf204caedb2a6f1af0ff
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v6
@@ -41,6 +50,29 @@ jobs:
           # Git Bash on Windows prints "<hash> *<file>"; write the text-mode form the app verifies.
           printf '%s  %s\n' "$(sha256sum "$asset" | cut -d ' ' -f 1)" "$asset" > "$asset.sha256"
           cat "$asset.sha256"
+      # Builds before Windows 11 24H1 load the bootstrapper beside the executable.
+      - name: Stage the Windows App SDK bootstrapper
+        shell: pwsh
+        run: |
+          $asset = "Microsoft.WindowsAppRuntime.Bootstrap-${{ matrix.target }}.dll"
+          $version = $env:BOOTSTRAP_FOUNDATION_VERSION
+          $package = "microsoft.windowsappsdk.foundation.$version.nupkg"
+          Invoke-WebRequest "https://api.nuget.org/v3-flatcontainer/microsoft.windowsappsdk.foundation/$version/$package" -OutFile $package
+          Add-Type -AssemblyName System.IO.Compression.FileSystem
+          $zip = [IO.Compression.ZipFile]::OpenRead((Resolve-Path $package))
+          try {
+            $entry = $zip.GetEntry("runtimes/win-${{ matrix.bootstrap-arch }}/native/Microsoft.WindowsAppRuntime.Bootstrap.dll")
+            if (!$entry) { throw "$package has no ${{ matrix.bootstrap-arch }} bootstrapper" }
+            [IO.Compression.ZipFileExtensions]::ExtractToFile($entry, (Join-Path $PWD $asset))
+          } finally { $zip.Dispose() }
+          $hash = (Get-FileHash $asset -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($hash -ne "${{ matrix.bootstrap-sha256 }}") { throw "$asset SHA-256 $hash does not match the pinned hash" }
+          $signature = Get-AuthenticodeSignature $asset
+          if ($signature.Status -ne "Valid" -or $signature.SignerCertificate.Subject -notlike "CN=Microsoft Corporation,*") {
+            throw "$asset is not signed by Microsoft: $($signature.Status) $($signature.SignerCertificate.Subject)"
+          }
+          [IO.File]::WriteAllText("$asset.sha256", "$hash  $asset`n")
+          Get-Content "$asset.sha256"
       - name: Write the release notes
         uses: orhun/git-cliff-action@v4
         with:
@@ -53,3 +85,5 @@ jobs:
           files: |
             enableLoopback-${{ matrix.target }}.exe
             enableLoopback-${{ matrix.target }}.exe.sha256
+            Microsoft.WindowsAppRuntime.Bootstrap-${{ matrix.target }}.dll
+            Microsoft.WindowsAppRuntime.Bootstrap-${{ matrix.target }}.dll.sha256
diff --git a/README.md b/README.md
index 27ca75f..be14363 100644
--- a/README.md
+++ b/README.md
@@ -16,8 +16,10 @@ When the runtime is missing, the GUI offers to install it from the Microsoft Sto
 On Windows builds before Windows 11 24H1, including Windows 10, the GUI also needs
 `Microsoft.WindowsAppRuntime.Bootstrap.dll` for the process architecture beside
 `enableLoopback.exe`. It ships in the `Microsoft.WindowsAppSDK.Foundation` 2.3.12
-NuGet package under `runtimes/win-<arch>/native/`; release packaging does not include
-it yet (#8).
+NuGet package under `runtimes/win-<arch>/native/`. Each release also publishes it, with
+its pinned SHA-256 and Microsoft signature checked, as
+`Microsoft.WindowsAppRuntime.Bootstrap-<target>.dll`; rename it when placing it beside
+the executable.
 
 Build and run in Git Bash: