App Release LabTested release paths for Windows desktop apps

Windows 11 x64 release guide

Windows release routes for Python desktop apps

Evidence-backed Windows release routes for mapped Python desktop applications.

Reviewed August 14, 2026

Scope

This route map covers the locally evidenced route from a frozen Python app to a portable ZIP, direct installer, and optional WinGet discovery on Windows 11 x64. It does not reproduce Store or MSIX distribution, Authenticode signing, self-updating applications, or external acceptance.

In the mapped estate, --onedir is used for PolyForm Noncommercial/Internal Use distributions because bundled LGPL Qt and other LGPL libraries must remain replaceable by end users. It is not evidence that --onedir is generally better.

Route map

  1. Freeze the application: when the distribution has the estate’s LGPL replaceability requirement, use the reproduced pywebview and PySide6 Qt backend --onedir folder.
  2. Preserve the folder: package the complete folder as a portable ZIP. See one-file versus one-folder.
  3. Offer a direct installer: build the shared Inno Setup installer from the same complete folder. See PyInstaller Windows installer.
  4. Attach release evidence: publish a SHA-256 file for each artifact and GitHub build provenance for the ZIP and installer. See Windows code-signing facts.
  5. Publish the release: the reproduced workflow attaches artifacts to a GitHub Release after its human release gate.
  6. Optional WinGet discovery: submit a manifest that points to the released installer only after the release facts are available. WinGet does not replace the installer or its ownership responsibilities.

Route responsibilities

Concern Reproduced route Not reproduced or external
Artifact evidence SHA-256 and GitHub build provenance Neither is Authenticode signing.
Signing None in the reproduced artifacts Authenticode signer, certificate or signing service.
Hosting GitHub Release artifacts Stable versioned HTTPS installer hosting needed by an external Store installer route.
Updates The apps notify about GitHub releases Replacing installed files automatically.
Installer Shared Inno Setup artifact from --onedir folder One-file installer inputs.
Discovery Direct Release download; limited WinGet lifecycle evidence General WinGet catalog acceptance.
External review None inside the release workflow Store, MSIX, and WinGet review outcomes.

Production evidence

The reusable Build-Tools release workflow builds a --onedir folder into a ZIP, creates an Inno Setup installer, writes SHA-256 files, and attests both artifacts. Simple UNA Log Viewer’s caller provides the stable installer identity. Its build script shows the frozen application inputs.

Simple UNA Log Viewer’s initial package submission and later update document only that application’s accepted WinGet lifecycle. They do not establish general catalog acceptance.

Unsupported or external outcomes

  • Store or MSIX is deferred and not reproduced.
  • Authenticode-signed artifacts are not reproduced.
  • A standalone native PySide6 application and PyInstaller --onefile are not reproduced for this mapped PolyForm route. This does not say --onefile universally violates LGPL; other license and distribution models need their own analysis and testing.
  • A SHA-256 file verifies matching bytes, provenance identifies the recorded build origin, and Authenticode identifies a signer and signing-time integrity. None establishes malware safety or SmartScreen reputation.
  • Store, MSIX, and general WinGet outcomes are external review decisions.
  • This is not legal advice. Layout alone does not fulfill all license obligations; notices, source or offer requirements, and the actual dependency and license versions still matter.

Source ledger

Source owner Primary URL Review class Last reviewed Exact claim or evidence mapped
Microsoft https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/choose-distribution-path Release-critical August 14, 2026 Distribution path determines signing, update, hosting, and discovery responsibilities.
Microsoft https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/code-signing-options Release-critical August 14, 2026 Authenticode and signing-service outcomes are external to the reproduced estate.
Microsoft https://learn.microsoft.com/en-us/windows/package-manager/package/repository Release-critical August 14, 2026 WinGet manifests are submitted to an external repository.
GitHub https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations Release-critical August 14, 2026 Provenance is separate from a file hash and signing identity.
JDE-Projects Build-Tools https://github.com/JDE-Projects/Build-Tools/blob/ab90ba3459fe0e7cadab8d23d7e920d0bacabdaa/.github/workflows/release.yml Production evidence August 14, 2026 Reproduced artifact chain and human release gate.
JDE-Projects Simple UNA Log Viewer https://github.com/JDE-Projects/Simple-UNA-Log-Viewer/blob/df2ce2118a0d8c2ffa3ec0ea0189dc6a6eefc1e3/.github/workflows/release.yml Production evidence August 14, 2026 Stable installer identity supplied to the shared workflow.
JDE-Projects Simple UNA Log Viewer https://github.com/JDE-Projects/Simple-UNA-Log-Viewer/blob/df2ce2118a0d8c2ffa3ec0ea0189dc6a6eefc1e3/Build_Simple_UNA_Log_Viewer.bat Production evidence August 14, 2026 Reproduced --onedir, PySide6, and qtpy build inputs.
JDE-Projects Simple UNA Log Viewer https://github.com/JDE-Projects/Simple-UNA-Log-Viewer/blob/df2ce2118a0d8c2ffa3ec0ea0189dc6a6eefc1e3/THIRD-PARTY-LICENSES.txt Production evidence August 14, 2026 Estate notice states the --onedir replaceability goal.
Qt https://www.qt.io/development/open-source-lgpl-obligations Framework-critical August 14, 2026 Qt LGPL obligations boundary.
Qt https://www.qt.io/faq/qt-open-source-licensing Framework-critical August 14, 2026 Qt open-source licensing context.
Free Software Foundation https://www.gnu.org/licenses/lgpl-3.0.en.html Framework-critical August 14, 2026 LGPLv3 primary license text.
Microsoft WinGet Community Repository https://github.com/microsoft/winget-pkgs/pull/403412 Production evidence August 14, 2026 Initial WinGet lifecycle for Simple UNA Log Viewer only.
Microsoft WinGet Community Repository https://github.com/microsoft/winget-pkgs/pull/416401 Production evidence August 14, 2026 WinGet update lifecycle for Simple UNA Log Viewer only.