mirror of
https://github.com/jamesstringer90/appsandbox.git
synced 2026-10-19 01:31:28 -05:00
James Stringer
717c5b5148
Build, EV-sign, Microsoft attestation-sign, and package AppSandbox for Windows on ARM with feature parity to x64 except the vTPM and guest-state isolation (neither is supported by ARM Windows HCS). Target architecture is resolved at compile time (ASB_IS_ARM64 in disk_util.h); the supported pairing is x64 build/host/guest and ARM64 build/host/guest, so one flag drives every architecture decision. x64 behavior is unchanged throughout. Runtime: - hcs_vm.c: omit SecuritySettings (vTPM + GuestStateOnly isolation) on ARM; Secure Boot is retained. - disk_util.c: emit the arch token in every autounattend/unattend processorArchitecture attribute; on ARM, bypass the Win11 Setup hardware checks via the HKLM\SYSTEM\Setup\LabConfig keys across all VM-creation paths; select the arch-correct OpenSSH Server MSI. - d3dlayers.c / agent.c: resolve, download, and stage the arm64 D3D mapping layers for GPU-PV; stage the Vulkan ICD manifest under the arch-neutral name dzn_icd.json. Build and release pipeline: - AppSandbox.sln: add the missing AppSandboxPackage Release|ARM64 Build.0 so the VS GUI actually runs sign+package for the ARM64 config. - AppSandboxPackage.vcxproj: run make-release.ps1 for Release on x64 or ARM64, passing -Platform $(Platform). - make-release.ps1 / sign-drivers.ps1: -Platform ARM64 selects bin\Release-ARM64, the ARM64 attestation profile, and the AppSandbox-<ver>-win-arm64.zip name. Sanitize LIB before Add-Type so the .NET Framework C# compiler does not fail (CS1668) on the non-existent atlmfc\lib\ARM64 path the VS ARM64 build adds to LIB. - Directory.Build.props: disable ApiValidator only when cross-building ARM64 on a non-ARM64 host (the x86 ApiExtractor cannot read ARM64 PEs); Microsoft re-runs full API validation on every attestation submission. - Package.vcxproj: stage the vendored ARM64 devcon.exe into the ARM64 drivers output, mirroring the x64 devcon copy. - vendor/devcon/arm64/devcon.exe: add the vendored ARM64 devcon.exe, un-ignored in .gitignore mirroring the existing vendor/webview2/arm64 precedent.