FYI / Public Project Thread: Windows Identity (AppX), Chromium, PWAs

[Daniel Murphy]

Hello everyone,

The purpose of this thread is to kick off communications between MSFT and Chromium folks (in particular Chromium Windows folks) about Windows Identity ("appx") and Chromium.

It seems like:

• Chromium is unable to use new windows features because it is not an "appx". For example, bundled notifications, and others.
• Chromium PWAs are unable to use new / advanced windows features because they are not "appx"'s. Example: ShareTarget, Contact Picker API, and others.

Edge seems to already ships a version of this and can support things like bundled notifications by Edge itself. Plus Edge's installed PWA have the ShareTarget shipped using this too (and Notification Attribution, Contacts API in the future, etc). The divide continues to grow - Chromium cannot do these things! It is a really high priority from us on the PWA team to get this done, as this unlocks a number of features Chrome cannot ship on Windows.

The really good news here is that Hoch from Microsoft is planning to upstream "appx" support to Chromium and PWAs in 2025, and is currently in the "making a PRD about why this matters" stage (Hoch correct me if I'm wrong here). Earlier I created https://bit.ly/windows-identity-chromium-pwas, which has some info here, and will either turn into the PRD or link to Hoch's proposal.

So - since we're all starting 2025 planning, I wanted to spread the word that this is going on so if there is any synergy from the Chrome Windows side of projects or goals, then perhaps folks can work together! And if not, then at least this is a heads up to expect this proposal / changes coming along. 

Thanks!

Dan

[Hoch Hochkeppel (HE/HIM)]

Thanks for kicking this off Dan.

 

To set timeline expectations – we are just starting our planning for next semester and hope to make this work part of it. Ideally this will mean having a PRD ready this calendar year, with enough open discussion that it’s ready to start moving forward by the end of the calendar year.

 

To set scope expectations – though a natural goal of this work is PWA adoption, we aim to start with targeting a (to be determined) API the browser would benefit from leveraging directly, along with an architecture designed to grow to all the functionality that may be desired. We haven’t formed a proposal yet of which API would be best to start with, but if there are any “modern” APIs you’ve been particularly wishing you could call that would be great to know. (e.g. pinning, push, notifications/toasts, background tasks)

 

-Hoch

[Daniel Murphy]

Thanks Hoch! 

Some initial thoughts from internal folks:

• Folks want to confirm that this doesn't add a dependency on the Microsoft Store / require Chromium integration / listing in the Microsoft Store.
• There is a general desire to make sure we don't add more dependencies / infrastructure than what is strictly necessary for the features we need.

[Hoch Hochkeppel (HE/HIM)]

To our current understanding this should *not* require Microsoft Store integration, as an appx package may be signed with a certificate by any trusted root authority.

 

The desire to avoid unneeded dependencies / infrastructure is shared. We’ll be aiming for a proposal with minimal dependencies and right-size infrastructure.

[Hoch Hochkeppel (HE/HIM)]

Hi Robert,

 

The list of default trusted root authorities is extensive, and available in multiple formats here: https://learn.microsoft.com/en-us/security/trusted-root/participants-list

 

-Hoch

 

From: Robert Liao <rob...@chromium.org>
Sent: Wednesday, October 9, 2024 12:26 PM
To: Hoch Hochkeppel (HE/HIM) <mho...@microsoft.com>
Cc: Daniel Murphy <dmu...@chromium.org>; pwa-dev <pwa...@chromium.org>; David Bienvenu <davidb...@chromium.org>; jessem...@google.com; Vincent Scheib <sch...@chromium.org>; Reilly Grant <rei...@chromium.org>; Rob Kochman <ro...@chromium.org>; Stanley Hon <sta...@microsoft.com>; Howard Wolosky <Howard....@microsoft.com>; Natasha Gaitonde <naga...@microsoft.com>
Subject: Re: [EXTERNAL] FYI / Public Project Thread: Windows Identity (AppX), Chromium, PWAs

 

Hi Hoch,

 

Thanks for the details. Do you happen to know what trusted root authorities can sign in Windows?

 

Robert

[Hoch Hochkeppel (HE/HIM)]

Hi Robert,

 

This is starting to dive into details we will certainly flush out in the proposal, so my answers at the moment may seem a little high-level/fuzzy.

 

The package ID is effectively decided by the app, but is a little more restricted than the App User Model ID you linked.

https://learn.microsoft.com/en-us/windows/apps/desktop/modernize/package-identity-overview

 

As far as modern APIs that rely on this ID, they will “just work”, but only when called from within the packaged app context. This article walks through how a normal Win32 app could be updated to run in this app context, simply by installing a small appx package alongside the app:

https://learn.microsoft.com/en-us/windows/apps/desktop/modernize/grant-identity-to-nonpackaged-apps

 

The gotcha for Chromium is that even in “Win32App” mode, packaged app containers have some limitations that are expected to be deal breakers for adopting the minimal solution in the article above. Instead, the proposal is to roughly:

• Add a (mostly empty) appx package that gets installed alongside the browser. (like in the article)
• Create a small binary that the package can point to and load at runtime. This binary will be running in the app context, while the main browser’s binary will not.
• The browser and this binary then talk back-and-forth anytime they want to use an API that requires a package ID to work.
• (e.g. my_broker.exe is loaded in the app context. The browser.exe sends a message to my_broker.exe, asking it to invoke a Toast API. My_broker.exe calls the API and receives a response from Windows. My_broker.exe sends a message with the result to browser.exe)

 

There are at least a couple APIs that require an ICoreWindow, but can be satisfied by temporarily creating a hidden instance for the duration of the call.

 

-Hoch

 

From: Robert Liao <rob...@chromium.org>
Sent: Thursday, October 10, 2024 9:49 AM
To: Hoch Hochkeppel (HE/HIM) <mho...@microsoft.com>
Cc: Daniel Murphy <dmu...@chromium.org>; pwa-dev <pwa...@chromium.org>; David Bienvenu <davidb...@chromium.org>; jessem...@google.com; Vincent Scheib <sch...@chromium.org>; Reilly Grant <rei...@chromium.org>; Rob Kochman <ro...@chromium.org>; Stanley Hon <sta...@microsoft.com>; Howard Wolosky <Howard....@microsoft.com>; Natasha Gaitonde <naga...@microsoft.com>
Subject: Re: [EXTERNAL] FYI / Public Project Thread: Windows Identity (AppX), Chromium, PWAs

 

Hi Hoch,

 

To make sure I understand, in this new world, Apps will decide their own IDs (presumably through App User Model IDs?), sign their app via a trusted root authority (where Google Trust Services LLC is a trusted authority and so we can continue signing), and then these APIs will just work?

 

Are there any APIs that require an ICoreWindow that may not work?

 

Thanks!

 

Robert

[Stanley Hon]

Hi all,

I want to share that we’re refocusing efforts on the Microsoft side to contribute Windows Identity support to Chromium. We’ve begun some technical investigations and we’re working towards a formal project proposal.

The first step in this system is introducing identity for Chromium itself – which will allow Chromium to utilize new and advanced windows features. This opens the door for Chromium itself to implement features it previously could not without Identity. This will be a significant undertaking, but I believe leveraging our experience implementing this in Microsoft Edge will give us an advantage when building it in Chromium.

While this work is an essential step for PWAs with identity – Our plan is to create a proposal for the initial Identity infrastructure and a non-PWA API/feature that utilizes it first. Given the PWA audience in this thread so far; there is further work required to allow Chromium PWAs to utilize advanced windows APIs/features beyond the work I am proposing here.

While we keep working towards documents to share, we’ve got a few questions for the you all right now:

• Who are right folks to discuss our plans for chromium identity?

Significant parts of this work would be in deployment (setup.exe / installer) and updating Chromium (or even Google Chrome’s) release pipelines to correctly sign required components for windows to recognize the browser’s identity.

Secondly, we plan to ship a feature/API utilizing the new infrastructure. We’d like to know:

• What is the top windows identity-gated browser feature you would like to see first?”

We’re completely open to discussion here but our suggestion would be:

1.       Notification grouping / attribution; ability for notifications to be grouped and attributed to websites.

Some other ideas, but not an exhaustive list:

2.       Better site pinning with deeper integration with Windows (such as enabling numerical “badges” on pinned sites)

3.       “real” Push Notifications (Push notifications FAQ  |  Articles  |  web.dev)

As always, please feel free to ask us any questions you may have.

Thanks!

Stanley

[Dan Murphy]

Hi Stanley, were you able to get info you needed here? I'm not sure if anyone responded to you directly.

Do you have a bug / place for us to attach things that are blocked by windows identity? I just found one: crbug.com/40874069

[Stanley Hon]

Hey Dan,

 

I’m still looking for anyone who may be particularly invested in features that would rely on the identity system or may want to weigh in on what we want to do first feature wise. That said, neither of these are blocking. I’m still working towards a proposal and documentation to share.

 

I made this crbug to track the whole system / project all up: Implement Windows Identity for Chromium [398904320] - Chromium

Please feel free to use it as you see fit.

[Dan Murphy]

Following up to add:

• https://issues.chromium.org/398904320 Implement Windows Identity for Chromium
• https://issues.chromium.org/356684623 Windows installed PWAs should install using Windows Identity framework

[Stanley Hon]

Thanks Dan, Just a quick update here; we are still looking into this but it's on a little bit of a pause so we can figure out what the best proposal for Identity in Chromium would be.

Please still feel free to reach out to me for any questions related to the space.