Support Windows package identity to ensure device permissions

[joaomoreno]

In order to retain microphone permissions necessary for VS Code Speech, we should enforce the use of package identity on Windows installations.

cc @bpasero

[deepak1556]

After some investigation on the devbox @joaomoreno had issues from the appx package, we narrowed the problem at install time is from the RemoveAppxPackage being always called even when the package was not previously installed resulting in the powershell command to throw an error and trigger the WER dialog.

[deepak1556]

We currently ship AppxPackage with manifest needed for the file explorer context menu action https://github.com/microsoft/vscode-explorer-command/blob/main/template/AppxManifest.xml, this is optional at install time and also only available to insiders.

Whereas we want this identity for privacy controls to be always available,

1. Is it possible to condition the file explorer manifest items in the same manifest ?
2. If not, can we have multiple appx manifest for the same application. Like one main and the other like addons.

[shmuelie]

We currently ship AppxPackage with manifest needed for the file explorer context menu action https://github.com/microsoft/vscode-explorer-command/blob/main/template/AppxManifest.xml, this is optional at install time and also only available to insiders.

Whereas we want this identity for privacy controls to be always available,

1. Is it possible to condition the file explorer manifest items in the same manifest ?
2. If not, can we have multiple appx manifest for the same application. Like one main and the other like addons.

You cannot condition the manifest item. You can either have multiple manifests (PowerToys does this) or you can specify ECS_HIDDEN for the command to hide them when not enabled

[joaomoreno]

Relevant docs: https://learn.microsoft.com/en-us/windows/apps/desktop/modernize/grant-identity-to-nonpackaged-apps#powershell

[deepak1556]

Thanks @shmuelie , for the main package identity does everything we have today in the current package manifest (minus the extension block https://github.com/microsoft/vscode-explorer-command/blob/3ee1d2ccc598b09932c7583b6ed9e47d8560a9fb/template/AppxManifest.xml#L62) be sufficient or anything else we need to add ?

[shmuelie]

1. You'll need to add the DeviceCapability for microphone.
2. The app that actually uses the microphone needs to have the package identity too. Easiest way would be for the package to have an Application element for that app, and that app also have the fusion manifest updated to include the MSIX element

[deepak1556]

1. Great, thanks!
2. Microphone gets used from an extension that runs in a child process of the VSCode application, so in this case a single package identity for VSCode application should be sufficient IIUC ?

[shmuelie]

That will work then :)

[deepak1556]

@shmuelie whats the best way to test that the package identity and the declared permissions are respected by the OS. Thanks!