Question: Does Single-Project MSIX allow you to package a WinUI3 app as "PartialTrust" rather than "FullTrust"

[karter16]

Does Single-Project MSIX allow you to package a WinUI3 app as "PartialTrust" rather than "FullTrust"?

The default templates for WinUI3 apps are setup to require FullTrust. This is not ideal where the end goal is an app destined for the store, especially if the app does not require FullTrust.

There is an ongoing philosophical discussion (#1900) about whether there should be templates for PartialTrust, or indeed whether the templates should be PartialTrust by default, and can then be changed to FullTrust where needed by devs. Honestly I don't really care too much how that discussion ends up, but I am very interested to understand the following:

Can single-project MSIX be used to package an app as PartialTrust or not? I have been unable to find any definitive documentation confirming one way or another. There are 3rd party guides on the internet around configuring your project to be "Partial Trust" but these examples don't use Single-Project MSIX.

If it doesn't support it then that's fine, but it would be good to know one way or another.

Any advice anyone can offer would be greatly appreciated.

[DarranRowe]

Interestingly, the release notes for 1.2.3 had a fix relating to that.

[DarranRowe]

As steps for doing it, minimally you need to do the following to the Package.appxmanifest file.

1. Add the PhoneIdentity element to the manifest, it being partial trust seems to require this and will produce an error if it is missing.
2. Change the EntryPoint attribute to windows.partialTrustApplication.
3. Remove the Capabilities.

If you are targetting 19041 and newer then you can use the TrustLevel and RuntimeBehavior attributes.

An example of this is:

<?xml version="1.0" encoding="utf-8"?>

<Package
  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
  xmlns:mp="http://schemas.microsoft.com/appx/2014/phone/manifest"
  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
  xmlns:uap10="http://schemas.microsoft.com/appx/manifest/uap/windows10/10"
  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
  IgnorableNamespaces="mp uap uap10 rescap">

  <mp:PhoneIdentity PhoneProductId="898f498c-8994-4609-b281-f4e2ff1b5e09" PhonePublisherId="00000000-0000-0000-0000-000000000000"/>
  <Identity Name="WindowTest" Publisher="CN=Darran" Version="1.0.0.0" />

  <Properties>
    <DisplayName>WindowTest</DisplayName>
    <PublisherDisplayName>Darran</PublisherDisplayName>
    <Logo>Images\StoreLogo.png</Logo>
  </Properties>

  <Dependencies>
    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.22621.0" />
  </Dependencies>

  <Resources>
    <Resource Language="x-generate"/>
  </Resources>

  <Applications>
    <Application Id="App" Executable="$targetnametoken$.exe" EntryPoint="windows.partialTrustApplication" uap10:TrustLevel="appContainer" uap10:RuntimeBehavior="packagedClassicApp">
      <uap:VisualElements DisplayName="WindowTest" Description="WindowTest" BackgroundColor="transparent" Square150x150Logo="Images\Square150x150Logo.png" Square44x44Logo="Images\Square44x44Logo.png">
        <uap:DefaultTile Wide310x150Logo="Images\Wide310x150Logo.png" />
        <uap:SplashScreen Image="Images\SplashScreen.png" />
      </uap:VisualElements>
    </Application>
  </Applications>
</Package>

The PhoneProductId isn't registered to anything, it was just one generated with the uuidgen application. But that is something that you should change to one you generated.

[karter16]

Hi @DarranRowe - thank you so much for taking the time to share this with me. Your instructions and example were super clear and doing exactly as you said I'm now able to build and package my app.

The key things I'd missed was the need to include the PhoneIdentity element and I also didn't realise that I needed remove the Capabilities element.

Thank you again for taking the time to help!

Matt