Initial MSI implementation, based on Briefcase

.github/workflows/main.yml

@@ -135,6 +135,18 @@ jobs:
         run: conda list
       - name: conda config
         run: conda config --show-sources
+
+      - name: Checkout Briefcase (pinned)
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          repository: beeware/briefcase
+          ref: efb0e08c2a9ce72dcebd0a62c12f5662fd5eb0e0 # this is a commit with latest necessary changes on the main branch
+          path: briefcase
+          fetch-depth: 1
+
+      - name: Install Briefcase (editable)
+        run: |
+          pip install -e briefcase
       - name: Run unit tests
         run: |
           pytest -vv --cov=constructor --cov-branch tests/ -m "not examples"
@@ -153,6 +165,7 @@ jobs:
           AZURE_SIGNTOOL_KEY_VAULT_URL: ${{ secrets.AZURE_SIGNTOOL_KEY_VAULT_URL }}
           CONSTRUCTOR_EXAMPLES_KEEP_ARTIFACTS: "${{ runner.temp }}/examples_artifacts"
           CONSTRUCTOR_SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
+          CONSTRUCTOR_VERBOSE: 1
         run: |
           rm -rf coverage.json
           pytest -vv --cov=constructor --cov-branch tests/test_examples.py

.gitignore

@@ -150,8 +150,13 @@ cython_debug/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
+
+# VS Code
 .vscode/
 
+# macOS
+.DS_Store
+
 # Rever
 rever/
 

CONSTRUCT.md

@@ -235,6 +235,7 @@ The type of the installer being created. Possible values are:
 - `sh`: shell-based installer for Linux or macOS
 - `pkg`: macOS GUI installer built with Apple's `pkgbuild`
 - `exe`: Windows GUI installer built with NSIS
+- `msi`: Windows GUI installer built with Briefcase and WiX
 
 The default type is `sh` on Linux and macOS, and `exe` on Windows. A special
 value of `all` builds _both_ `sh` and `pkg` installers on macOS, as well
@@ -317,8 +318,11 @@ Name of the company/entity responsible for the installer.
 ### `reverse_domain_identifier`
 
 Unique identifier for this package, formatted with reverse domain notation. This is
-used internally in the PKG installers to handle future updates and others. If not
-provided, it will default to `io.continuum`. (MacOS only)
+used internally in the MSI and PKG installers to handle future updates and others.
+If not provided, it will default to:
+
+* In MSI installers: `io.continuum` followed by an ID derived from the `name`.
+* In PKG installers: `io.continuum`.
 
 ### `uninstall_name`
 

constructor/_schema.py

@@ -40,6 +40,7 @@ class WinSignTools(StrEnum):
 class InstallerTypes(StrEnum):
     ALL = "all"
     EXE = "exe"
+    MSI = "msi"
     PKG = "pkg"
     SH = "sh"
 
@@ -401,6 +402,7 @@ class ConstructorConfiguration(BaseModel):
     - `sh`: shell-based installer for Linux or macOS
     - `pkg`: macOS GUI installer built with Apple's `pkgbuild`
     - `exe`: Windows GUI installer built with NSIS
+    - `msi`: Windows GUI installer built with Briefcase and WiX
 
     The default type is `sh` on Linux and macOS, and `exe` on Windows. A special
     value of `all` builds _both_ `sh` and `pkg` installers on macOS, as well
@@ -484,8 +486,11 @@ class ConstructorConfiguration(BaseModel):
     reverse_domain_identifier: NonEmptyStr | None = None
     """
     Unique identifier for this package, formatted with reverse domain notation. This is
-    used internally in the PKG installers to handle future updates and others. If not
-    provided, it will default to `io.continuum`. (MacOS only)
+    used internally in the MSI and PKG installers to handle future updates and others.
+    If not provided, it will default to:
+
+    * In MSI installers: `io.continuum` followed by an ID derived from the `name`.
+    * In PKG installers: `io.continuum`.
     """
     uninstall_name: NonEmptyStr | None = None
     """

constructor/briefcase.py

@@ -0,0 +1,168 @@
+"""
+Logic to build installers using Briefcase.
+"""
+
+import logging
+import re
+import sys
+import shutil
+import sysconfig
+import tempfile
+from pathlib import Path
+from subprocess import run
+
+import tomli_w
+
+from . import preconda
+from .utils import DEFAULT_REVERSE_DOMAIN_ID, copy_conda_exe, filename_dist
+
+BRIEFCASE_DIR = Path(__file__).parent / "briefcase"
+EXTERNAL_PACKAGE_PATH = "external"
+
+logger = logging.getLogger(__name__)
+
+
+def get_name_version(info):
+    if not (name := info.get("name")):
+        raise ValueError("Name is empty")
+
+    # Briefcase requires version numbers to be in the canonical Python format, and some
+    # installer types use the version to distinguish between upgrades, downgrades and
+    # reinstalls. So try to produce a consistent ordering by extracting the last valid
+    # version from the Constructor version string.
+    #
+    # Hyphens aren't allowed in this format, but for compatibility with Miniconda's
+    # version format, we treat them as dots.
+    matches = list(
+        re.finditer(
+            r"(\d+!)?\d+(\.\d+)*((a|b|rc)\d+)?(\.post\d+)?(\.dev\d+)?",
+            info["version"].lower().replace("-", "."),
+        )
+    )
+    if not matches:
+        raise ValueError(
+            f"Version {info['version']!r} contains no valid version numbers: see "
+            f"https://packaging.python.org/en/latest/specifications/version-specifiers/"
+        )
+    match = matches[-1]
+    version = match.group()
+
+    # Treat anything else in the version string as part of the name.
+    start, end = match.span()
+    strip_chars = " .-_"
+    before = info["version"][:start].strip(strip_chars)
+    after = info["version"][end:].strip(strip_chars)
+    name = " ".join(s for s in [name, before, after] if s)
+
+    return name, version
+
+
+# Some installer types use the reverse domain ID to detect when the product is already
+# installed, so it should be both unique between different products, and stable between
+# different versions of a product.
+def get_bundle_app_name(info, name):
+    # If reverse_domain_identifier is provided, use it as-is, but verify that the last
+    # component is a valid Python package name, as Briefcase requires.
+    if (rdi := info.get("reverse_domain_identifier")) is not None:
+        if "." not in rdi:
+            raise ValueError(f"reverse_domain_identifier {rdi!r} contains no dots")
+        bundle, app_name = rdi.rsplit(".", 1)
+
+        if not re.fullmatch(
+            r"[A-Z0-9]|[A-Z0-9][A-Z0-9._-]*[A-Z0-9]", app_name, flags=re.IGNORECASE
+        ):
+            raise ValueError(
+                f"reverse_domain_identifier {rdi!r} doesn't end with a valid package "
+                f"name: see "
+                f"https://packaging.python.org/en/latest/specifications/name-normalization/"
+            )
+
+    # If reverse_domain_identifier isn't provided, generate it from the name.
+    else:
+        bundle = DEFAULT_REVERSE_DOMAIN_ID
+        app_name = re.sub(r"[^a-z0-9]+", "-", name.lower()).strip("-")
+        if not app_name:
+            raise ValueError(f"Name {name!r} contains no alphanumeric characters")
+
+    return bundle, app_name
+
+def get_license(info):
+    """ Retrieve the specified license as a dict or return a placeholder if not set. """
+
+    if "license_file" in info:
+        return {"file": info["license_file"]}
+    # We cannot return an empty string because that results in an exception on the briefcase side.
+    return {"text": "TODO"}
+
+# Create a Briefcase configuration file. Using a full TOML writer rather than a Jinja
+# template allows us to avoid escaping strings everywhere.
+def write_pyproject_toml(tmp_dir, info):
+    name, version = get_name_version(info)
+    bundle, app_name = get_bundle_app_name(info, name)
+
+    config = {
+        "project_name": name,
+        "bundle": bundle,
+        "version": version,
+        "license": get_license(info),
+        "app": {
+            app_name: {
+                "formal_name": f"{info['name']} {info['version']}",
+                "description": "",  # Required, but not used in the installer.
+                "external_package_path": EXTERNAL_PACKAGE_PATH,
+                "use_full_install_path": False,
+                "install_launcher": False,
+                "post_install_script": str(BRIEFCASE_DIR / "run_installation.bat"),
+            }
+        },
+    }
+
+    if "company" in info:
+        config["author"] = info["company"]
+
+    (tmp_dir / "pyproject.toml").write_text(tomli_w.dumps({"tool": {"briefcase": config}}))
+
+
+def create(info, verbose=False):
+    if sys.platform != 'win32':
+        raise Exception(f"Invalid platform '{sys.platform}'. Only Windows is supported.")
+
+    tmp_dir = Path(tempfile.mkdtemp())
+    write_pyproject_toml(tmp_dir, info)
+
+    external_dir = tmp_dir / EXTERNAL_PACKAGE_PATH
+    external_dir.mkdir()
+    preconda.write_files(info, external_dir)
+    preconda.copy_extra_files(info.get("extra_files", []), external_dir)
+
+    download_dir = Path(info["_download_dir"])
+    pkgs_dir = external_dir / "pkgs"
+    for dist in info["_dists"]:
+        shutil.copy(download_dir / filename_dist(dist), pkgs_dir)
+
+    copy_conda_exe(external_dir, "_conda.exe", info["_conda_exe"])
+
+    briefcase = Path(sysconfig.get_path("scripts")) / "briefcase.exe"
+    if not briefcase.exists():
+        raise FileNotFoundError(
+            f"Dependency 'briefcase' does not seem to be installed.\n"
+            f"Tried: {briefcase}"
+        )
+    logger.info("Building installer")
+    run(
+        [briefcase, "package"] + (["-v"] if verbose else []),
+        cwd=tmp_dir,
+        check=True,
+    )
+
+    dist_dir = tmp_dir / "dist"
+    msi_paths = list(dist_dir.glob("*.msi"))
+    if len(msi_paths) != 1:
+        raise RuntimeError(f"Found {len(msi_paths)} MSI files in {dist_dir}")
+
+    outpath = Path(info["_outpath"])
+    outpath.unlink(missing_ok=True)
+    shutil.move(msi_paths[0], outpath)
+
+    if not info.get("_debug"):
+        shutil.rmtree(tmp_dir)

constructor/briefcase/run_installation.bat

@@ -0,0 +1,9 @@
+_conda constructor --prefix . --extract-conda-pkgs
+
+set CONDA_PROTECT_FROZEN_ENVS=0
+set CONDA_ROOT_PREFIX=%cd%
+set CONDA_SAFETY_CHECKS=disabled
+set CONDA_EXTRA_SAFETY_CHECKS=no
+set CONDA_PKGS_DIRS=%cd%\pkgs
+
+_conda install --offline --file conda-meta\initial-state.explicit.txt -yp .

constructor/data/construct.schema.json

@@ -224,6 +224,7 @@
       "enum": [
         "all",
         "exe",
+        "msi",
         "pkg",
         "sh"
       ],
@@ -824,7 +825,7 @@
         }
       ],
       "default": null,
-      "description": "The type of the installer being created. Possible values are:\n- `sh`: shell-based installer for Linux or macOS\n- `pkg`: macOS GUI installer built with Apple's `pkgbuild`\n- `exe`: Windows GUI installer built with NSIS\nThe default type is `sh` on Linux and macOS, and `exe` on Windows. A special value of `all` builds _both_ `sh` and `pkg` installers on macOS, as well as `sh` on Linux and `exe` on Windows.",
+      "description": "The type of the installer being created. Possible values are:\n- `sh`: shell-based installer for Linux or macOS\n- `pkg`: macOS GUI installer built with Apple's `pkgbuild`\n- `exe`: Windows GUI installer built with NSIS\n- `msi`: Windows GUI installer built with Briefcase and WiX\nThe default type is `sh` on Linux and macOS, and `exe` on Windows. A special value of `all` builds _both_ `sh` and `pkg` installers on macOS, as well as `sh` on Linux and `exe` on Windows.",
       "title": "Installer Type"
     },
     "keep_pkgs": {
@@ -1104,7 +1105,7 @@
         }
       ],
       "default": null,
-      "description": "Unique identifier for this package, formatted with reverse domain notation. This is used internally in the PKG installers to handle future updates and others. If not provided, it will default to `io.continuum`. (MacOS only)",
+      "description": "Unique identifier for this package, formatted with reverse domain notation. This is used internally in the MSI and PKG installers to handle future updates and others. If not provided, it will default to:\n* In MSI installers: `io.continuum` followed by an ID derived from the `name`. * In PKG installers: `io.continuum`.",
       "title": "Reverse Domain Identifier"
     },
     "script_env_variables": {

constructor/main.py

@@ -38,7 +38,7 @@
 def get_installer_type(info):
     osname, unused_arch = info["_platform"].split("-")
 
-    os_allowed = {"linux": ("sh",), "osx": ("sh", "pkg"), "win": ("exe",)}
+    os_allowed = {"linux": ("sh",), "osx": ("sh", "pkg"), "win": ("exe", "msi")}
     all_allowed = set(sum(os_allowed.values(), ("all",)))
 
     itype = info.get("installer_type")
@@ -317,6 +317,10 @@ def is_conda_meta_frozen(path_str: str) -> bool:
             from .winexe import create as winexe_create
 
             create = winexe_create
+        elif itype == "msi":
+            from .briefcase import create as briefcase_create
+
+            create = briefcase_create
         info["installer_type"] = itype
         info["_outpath"] = abspath(join(output_dir, get_output_filename(info)))
         create(info, verbose=verbose)

constructor/osxpkg.py

@@ -21,6 +21,7 @@
 from .jinja import render_template
 from .signing import CodeSign
 from .utils import (
+    DEFAULT_REVERSE_DOMAIN_ID,
     add_condarc,
     approx_size_kb,
     copy_conda_exe,
@@ -390,7 +391,7 @@ def fresh_dir(dir_path):
 def pkgbuild(name, identifier=None, version=None, install_location=None):
     "see `man pkgbuild` for the meaning of optional arguments"
     if identifier is None:
-        identifier = "io.continuum"
+        identifier = DEFAULT_REVERSE_DOMAIN_ID
     args = [
         "pkgbuild",
         "--root",

constructor/utils.py

@@ -26,6 +26,8 @@
 from conda.models.version import VersionOrder
 from ruamel.yaml import YAML
 
+DEFAULT_REVERSE_DOMAIN_ID = "io.continuum"
+
 logger = logging.getLogger(__name__)
 yaml = YAML(typ="rt")
 yaml.default_flow_style = False

dev/environment.yml

@@ -10,3 +10,4 @@ dependencies:
   - jinja2
   - jsonschema >=4
   - pydantic 2.11.*
+  - tomli-w >=1.2.0

docs/source/construct-yaml.md

@@ -235,6 +235,7 @@ The type of the installer being created. Possible values are:
 - `sh`: shell-based installer for Linux or macOS
 - `pkg`: macOS GUI installer built with Apple's `pkgbuild`
 - `exe`: Windows GUI installer built with NSIS
+- `msi`: Windows GUI installer built with Briefcase and WiX
 
 The default type is `sh` on Linux and macOS, and `exe` on Windows. A special
 value of `all` builds _both_ `sh` and `pkg` installers on macOS, as well
@@ -317,8 +318,11 @@ Name of the company/entity responsible for the installer.
 ### `reverse_domain_identifier`
 
 Unique identifier for this package, formatted with reverse domain notation. This is
-used internally in the PKG installers to handle future updates and others. If not
-provided, it will default to `io.continuum`. (MacOS only)
+used internally in the MSI and PKG installers to handle future updates and others.
+If not provided, it will default to:
+
+* In MSI installers: `io.continuum` followed by an ID derived from the `name`.
+* In PKG installers: `io.continuum`.
 
 ### `uninstall_name`
 

docs/source/howto.md

@@ -7,10 +7,12 @@ which it is running. In other words, if you run constructor on a Windows
 computer, you can only generate Windows installers. This is largely because
 OS-native tools are needed to generate the Windows `.exe` files and macOS `.pkg`
 files. There is a key in `construct.yaml`, `installer_type`, which dictates
-the type of installer that gets generated. This is primarily only useful for
-macOS, where you can generate either `.pkg` or `.sh` installers. When not set in
-`construct.yaml`, this value defaults to `.sh` on Unix platforms, and `.exe` on
-Windows. Using this key is generally done with selectors.  For example, to
+the type of installer that gets generated. This is useful for macOS, where you can
+generate either `.pkg` or `.sh` installers, and Windows, where you can generate
+either `.exe` or `.msi` installers.
+
+When not set in`construct.yaml`, this value defaults to `.sh` on Unix platforms, and
+`.exe` on Windows. Using this key is generally done with selectors.  For example, to
 build a `.pkg` installer on MacOS, but fall back to default behavior on other
 platforms:
 

examples/azure_signtool/construct.yaml

@@ -2,7 +2,7 @@
 "$schema": "../../constructor/data/construct.schema.json"
 
 name: Signed_AzureSignTool
-version: X
+version: 1.0.0
 installer_type: exe
 channels:
   - http://repo.anaconda.com/pkgs/main/