JOSM from the Microsoft Store is not the latest version

[t-matsuu]

Steps to reproduce:

1. Access ​https://apps.microsoft.com/store/detail/XPFCG1GV0WWGZX
2. Click "Install" button

Actual result:
Older version (18822 (23.08)) is installed.

Expected result:
The latest stable version (18969 (24.01) at this time) is installed.

[taylor.smock]

Did we ever get the script working for automatically updating the MS Store version?

[stoecker]

Yes. Thought I can't access the store admin pages anymore because of their bloody two-factor authentication and probably since the cert switch you need to click something like "that's ok".

Vincent didn't reply to my last inquiry about that.

[taylor.smock]

That isn't good. I assume he set up the two-factor authentication?

[stoecker]

No. I think they enforce this. You can add an additional account and then it works for a few days until the 2-factor kicks in. If you want to have a look I'll give you the access details. You only need to add your mobile phone number to get access... Probably...

[taylor.smock]

I'm open to that, especially since we have had it on the front page for awhile.

[taylor.smock]

Well, we have an update in review. I don't know if it was something I did or something stoecker did. Either way, this should be (temporarily) fixed until the next release.

[stoecker]

Well, that's probably the problem. If it's still in review, then it hangs. The server script uploads and approves the review. If it is still, then surely there is somewhere else a button to click. Last time I did this I clicked through all the menus until I found one place where I had to manually click.

[stoecker]

... Which then was automated... So there's another one now...

[taylor.smock]

The text I'm seeing under Review status is "SLA is 3 business days for the review process."

So I think it is something we just have to wait for. I'll just have to remember to check in a few days. I did the release 2 days ago, and I think I may have updated the URL for the app today, so it should be updated by EOD Friday (or maybe Monday, depends upon what their definition of "business day" starts at).

[taylor.smock]

OK.
They have reviewed and rejected the update.

Reasons:

• HWConsole: "Your product must have a united central purpose. An additional installed component visible in the Start Menu does not relate sufficiently to the main product."
  • Maybe they would be OK with JOSM HWConsole?
• The reviewer didn't like the security prompt from Microsoft Defender Smartscreen. It looks like it may be "fixable". They gave instructions anyway. Timeframe for that fix (on a per release basis?) is ~1 day. Might get better as the signing key gains reputation.

[stoecker]

Replying to taylor.smock:

OK.
They have reviewed and rejected the update.

Reasons:

• HWConsole: "Your product must have a united central purpose. An additional installed component visible in the Start Menu does not relate sufficiently to the main product."
  • Maybe they would be OK with JOSM HWConsole?

Try it :-)

• The reviewer didn't like the security prompt from Microsoft Defender Smartscreen. It looks like it may be "fixable". They gave instructions anyway. Timeframe for that fix (on a per release basis?) is ~1 day. Might get better as the signing key gains reputation.

Which instructions?

[taylor.smock]

Replying to stoecker:

Replying to taylor.smock:

• Maybe they would be OK with JOSM HWConsole

Try it :-)

I've got a GH ​branch that I'm working on. I need to fiddle with the github actions to get it to build the installers on a branch though. And I'm trying to fix #22053 at the same time.

• The reviewer didn't like the security prompt from Microsoft Defender Smartscreen. It looks like it may be "fixable". They gave instructions anyway. Timeframe for that fix (on a per release basis?) is ~1 day. Might get better as the signing key gains reputation.

Which instructions?

Here is the exact wording from Microsoft:

---

A security prompt with the message, "Windows Protected Your PC. Microsoft Defender Smartscreen prevented an unrecognized app from starting. Running this app may put your PC at risk" was displayed during installation of the x64 package (separate from any UAC prompt). Your product must not compromise the security of users, the Store, or a related system, nor cause that security to be called into question.

If you believe the Smartscreen warning is a false positive then please perform the following actions to expedite resolution of the issue.

1. Download the file using Microsoft Edge browser.
2. When informed that the download was blocked by Smartscreen select the blocked file and click "Report this file as safe | I am the owner or representative of this website and I want to report an incorrect warning about it "
3. Fill out and submit the form. You will receive an email confirming receipt of your report.
4. 24 hours after sending the report confirm that the file no longer displays a Smartscreen warning before resubmitting the product for certification.

For more information about SmartScreen see ​https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx
Tested devices: Microsoft Surface Laptop

---

Fixing that is going to need to wait until the next release due to the HWConsole issue, but I think this is workable. Especially since Edge is cross platform now. At least there are downloads for ​macOS and ​linux.

[stoecker]

Fixing that is going to need to wait until the next release due to the HWConsole issue, but I think this is workable.

It probably does no harm when done with the current version ;-)

P.S. Did so now. We'll see if it helps.

[taylor.smock]

I assume that means you rebuilt https://josm.openstreetmap.de/download/windows/josm-setup-19017-java21.msi ? I just redownloaded it on a test machine and it still installed HWConsole.

[taylor.smock]

In 19023/josm:

See #23552: Update version in MS Store

The reviewer didn't like the HWConsole program. This changes it to be
JOSM HWConsole, which they will hopefully be OK with.

[stoecker]

Replying to taylor.smock:

I assume that means you rebuilt

No. I filled the 'reputation' report for our current release. That mechanism should in principle be independent from the Microsoft shop rules.

[taylor.smock]

My bad. I thought you were talking about the HWConsole issue, not the reputation issue.

I didn't think it was worth trying to fix the reputation issue until we had a release that had fixed the HWConsole issue. Especially since I ought to be going through the release process right now. Although I was a bit late on last month's release.

[stoecker]

Replying to taylor.smock:

I didn't think it was worth trying to fix the reputation issue until we had a release that had fixed the HWConsole issue. Especially since I ought to be going through the release process right now. Although I was a bit late on last month's release.

Finally today I got a mail:

---

We appreciate your cooperation and patience as we work to resolve this issue. We have received the information you provided and are currently reviewing it. If it is determined that the current designation is incorrect or no longer accurate the warning will be removed.

We typically expect to take two business days for our investigation. During this time, you may not see any changes to the status of your website. Please do not re-submit your request or make any changes to your website until we complete the investigation. Please note that while we review your feedback, we may not be able to respond to each submission individually. Thank you for your understanding.

---

Seems Microsoft believes they are the center of the world: "Please do not ... make any changes to your website until we complete the investigation". I think I must decline this request ;-)

[taylor.smock]

I just did a release. Hopefully they don't get too irked over it...

Especially since I did wait two business days.

[GerdP]

Possible regression: #23618
I wonder if win-jpackage.cmd has to be changed as well as it contains the string HWConsole?

[GerdP]

BTW: When I compare the content of the josm-custom.jar that comes with the *.msi installer and https://josm.openstreetmap.de/josm-tested.jar I see big differences. Is that intended? For example the josm-custom.jar doesn't contain gpl-3.0.txt, also the META-INF directories are very different.
The text files are converted to have 0x0d0a (windows) line endings, but more importantly
images\addmarkers.svg is 9385 bytes instead of 2894 because the one in josm-tested.jar is a one-liner (no lf)

[stoecker]

In 19040/josm:

add gpl to ant build, see #23552

[stoecker]

Mac and Windows are using the ant build stage on GitHub missing some optimizations. Sadly that's the result of using external service for building.

[taylor.smock]

We could split up the GH pipeline to build Java 11, 17, 21, 22+ on Linux, then build with Java 21 on Mac/Windows (solely to ensure that the build works on Mac/Windows), then take the built jars from the Linux build and package them with jpackage on the respective platforms.

Or we could switch to something like ​jdeploy. I think we could self-host using nexus/, although I think it would have to be a new npm repository (I have no clue why standard maven repos aren't supported...).

[GerdP]

Can someone explain why we have to build the *.jar on different platforms? I would expect that we have only one josm-tested.jar that is packaged in different installer packages, maybe even on different machines.

[taylor.smock]

I think Stereo wrote the original GH actions, and it looks like we haven't changed the overall flow since then.

Anyway, my best guess is that it was just easier (at the time) to build -> package -> upload all on the same platform.

Today, I think I would do build -> upload artifact (minimum Java version on Linux), then on each separate platform download artifact -> package -> upload artifact to release or job.

We would still want to have a build stage for each Java LTS we support + latest Java, and then a single build stage for the last Java LTS on macOS/Windows.

We would want to build on each Java LTS + latest Java to find breaking changes earlier. And then a single build on macOS/Windows just so that we know that contributors can keep using macOS/Windows.

[taylor.smock]

Replying to taylor.smock:

OK.
They have reviewed and rejected the update.

Reasons:

• HWConsole: "Your product must have a united central purpose. An additional installed component visible in the Start Menu does not relate sufficiently to the main product."
  • Maybe they would be OK with JOSM HWConsole?

Apparently not. This time, the message was "Your product must have a united central purpose. Please make sure the name of additional installed components visible in the Start Menu clearly identify which item is the main product."

Side note: it looks like we'll have to read and agree to an updated license from Microsoft.

Microsoft has updated the App Developer Agreement. The App Developer Agreement contains the terms of the relationship between you and Microsoft. You must review and accept the updated App Developer Agreement by 4/17/24 otherwise publishing will be blocked.

[stoecker]

Call it 'JOSM (Debug)'?

Accept whatever needs to be accepted as long as no money is involved.

[taylor.smock]

In 19051/josm:

See #23552: Update JOSM version in MS store

Change JOSM HWConsole to JOSM (Debug) in order to attempt to indicate to app
reviewer that the HWConsole application is no the "main" app.

[anonymous]

Any update here?

[taylor.smock]

@anonymous: This is mostly a case of back and forth with MS. Hopefully I've got some steps down that will fix this going forward.

Side note: @stoecker: The email we have for support contact info is josm-dev@openstreetmap.org. We should probably remove that. Or reactivate the mailing list.

[stoecker]

Remove it. If an address is needed add contact at josm dot openstreetmap de.

[taylor.smock]

Done.

[skyper]

Ticket #23900 has been marked as a duplicate of this ticket.

[taylor.smock]

It looks like the update went through. I'm closing this ticket. I've added WIP instructions to wiki:DevelopersGuide/Releasing so I don't forget what I did this month.

As a bonus, this should fix the microsoft smartscreen warnings for users who directly consume the msi. But only after the first day or so.

[stoecker]

Anything we can add to the automated process? I don't like manual work for releases.

[taylor.smock]

Neither do I. Unfortunately at least one of the methods requires a CAPTCHA. The other, I don't recall if it does or not. I'll check and see if there is an "official" API that we can use. I didn't see one last week when I was looking for one though.