update wix installer template with capabilities entries

Sparrow/Sparrow Wallet

b0591d7a View source ↗

Public commit record

What the developer wrote

Authored by Craig Raw

50/100 · Thin

update wix installer template with capabilities entries

✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

The short version

What changed, and why it matters

This commit updates the Windows installer for Sparrow Wallet so that the app properly advertises itself to Windows as a handler for 'bitcoin:', 'lightning:', and 'auth47:' web-style links. It also fixes the icon path for those link handlers to use the install folder. This is a normal installer improvement, not a security fix for a vulnerability.

Recommended action

No security action required. Review as part of normal release process; verify installer behavior on Windows for URI handling and uninstall cleanup.

Security signals we found

URI scheme registration for auth47, bitcoin, lightning

Windows registry modifications in installer

DefaultIcon path now qualified with INSTALLDIR

Technical analysis

Evidence from the diff

The WiX installer template (main.wxs) is modified to add a new CapabilitiesEntries component that writes Windows ‘Capabilities’ registry entries under Software\\Capabilities and registers the application under Software\RegisteredApplications. This lets Windows know Sparrow handles auth47, bitcoin, and lightning URI schemes. Additionally, DefaultIcon registry values are changed from a bare executable name to ‘[INSTALLDIR].exe’, ensuring the icon is resolved from the installation directory. The new component is referenced in the DefaultFeature.

Changed components

src/main/deploy/package/windows/main.wxsWindows MSI installerURI protocol handler registration

Inspect captured patch +18 / −5

diff --git a/src/main/deploy/package/windows/main.wxs b/src/main/deploy/package/windows/main.wxs
index fa63f6f..dcdd572 100644
--- a/src/main/deploy/package/windows/main.wxs
+++ b/src/main/deploy/package/windows/main.wxs
@@ -2,8 +2,8 @@
 
 <!--
   This file is a copy of the jpackage WiX template (src/jdk.jpackage/windows/classes/jdk/jpackage/internal/resources/main.wxs in the JDK sources),
-  customized only to add the RegistryEntries component registering the auth47, bitcoin and lightning URI schemes, and its ComponentRef in the Feature.
-  When upgrading the build JDK, re-diff this file against that JDK's template and re-apply the RegistryEntries block, keeping the component GUID unchanged.
+  customized only to add the RegistryEntries and CapabilitiesEntries components registering the auth47, bitcoin and lightning URI schemes, and their ComponentRefs in the Feature.
+  When upgrading the build JDK, re-diff this file against that JDK's template and re-apply those blocks, keeping the component GUIDs unchanged.
 -->
 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
      xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
@@ -84,7 +84,7 @@
                 <RegistryValue Type="string" Name="URL Protocol" Value=""/>
                 <RegistryValue Type="string" Value="URL:Auth47 Authentication URI"/>
                 <RegistryKey Key="DefaultIcon">
-                    <RegistryValue Type="string" Value="$(var.JpAppName).exe" />
+                    <RegistryValue Type="string" Value="[INSTALLDIR]$(var.JpAppName).exe" />
                 </RegistryKey>
                 <RegistryKey Key="shell\open\command">
                     <RegistryValue Type="string" Value="&quot;[INSTALLDIR]$(var.JpAppName).exe&quot; &quot;%1&quot;" />
@@ -94,7 +94,7 @@
                 <RegistryValue Type="string" Name="URL Protocol" Value=""/>
                 <RegistryValue Type="string" Value="URL:Bitcoin Payment URL"/>
                 <RegistryKey Key="DefaultIcon">
-                    <RegistryValue Type="string" Value="$(var.JpAppName).exe" />
+                    <RegistryValue Type="string" Value="[INSTALLDIR]$(var.JpAppName).exe" />
                 </RegistryKey>
                 <RegistryKey Key="shell\open\command">
                     <RegistryValue Type="string" Value="&quot;[INSTALLDIR]$(var.JpAppName).exe&quot; &quot;%1&quot;" />
@@ -104,13 +104,25 @@
                 <RegistryValue Type="string" Name="URL Protocol" Value=""/>
                 <RegistryValue Type="string" Value="URL:LNURL URI"/>
                 <RegistryKey Key="DefaultIcon">
-                    <RegistryValue Type="string" Value="$(var.JpAppName).exe" />
+                    <RegistryValue Type="string" Value="[INSTALLDIR]$(var.JpAppName).exe" />
                 </RegistryKey>
                 <RegistryKey Key="shell\open\command">
                     <RegistryValue Type="string" Value="&quot;[INSTALLDIR]$(var.JpAppName).exe&quot; &quot;%1&quot;" />
                 </RegistryKey>
             </RegistryKey>
         </Component>
+        <Component Id="CapabilitiesEntries" Guid="{BE92DD88-F799-47CC-A256-4165F9183A46}">
+            <RegistryKey Root="HKMU" Key="Software\$(var.JpAppName)\Capabilities" Action="createAndRemoveOnUninstall">
+                <RegistryValue Type="string" Name="ApplicationName" Value="$(var.JpAppName)"/>
+                <RegistryValue Type="string" Name="ApplicationDescription" Value="$(var.JpAppDescription)"/>
+                <RegistryKey Key="URLAssociations">
+                    <RegistryValue Type="string" Name="auth47" Value="auth47"/>
+                    <RegistryValue Type="string" Name="bitcoin" Value="bitcoin"/>
+                    <RegistryValue Type="string" Name="lightning" Value="lightning"/>
+                </RegistryKey>
+            </RegistryKey>
+            <RegistryValue Root="HKMU" Key="Software\RegisteredApplications" Name="$(var.JpAppName)" Type="string" Value="Software\$(var.JpAppName)\Capabilities"/>
+        </Component>
     </DirectoryRef>
 
     <Feature Id="DefaultFeature" Title="!(loc.MainFeatureTitle)" Level="1">
@@ -119,6 +131,7 @@
       <ComponentGroupRef Id="FileAssociations"/>
       <ComponentGroupRef Id="FragmentOsCondition"/>
       <ComponentRef Id="RegistryEntries"/>
+      <ComponentRef Id="CapabilitiesEntries"/>
     </Feature>
 
     <CustomAction Id="JpSetARPINSTALLLOCATION" Property="ARPINSTALLLOCATION" Value="[INSTALLDIR]" />

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 3/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

close remaining local dns resolution gaps when classifying hostnames and connecting via tor

avoid deleting the backups of same-prefixed wallets

verify proof of work on chain tips and warn when a tip goes stale