[Bug]: Windows auto-update to 0.0.17 fails: "New version 0.0.17 is not signed by the application owner"

[yozkan]

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

T3 Code detects update 0.0.17, downloads it, but the install fails during signature validation with:

New version 0.0.17 is not signed by the application owner

The same log payload also says Signature verified., so this looks like the binary is signed, but the updater rejects it during the application owner / publisher name check.

Steps to reproduce

1. Open T3 Code on Windows.
2. Let the app download/apply the update to 0.0.17.
3. The updater fails before install completes.

Expected behavior

The update to 0.0.17 should install successfully.

Actual behavior

The updater rejects the downloaded installer with a publisher/application-owner validation error.

Note

The signer certificate subject contains CN=T3 Tools Inc, and the verifier reports Signature verified, but the updater still says the new version is not signed by the application owner. This may indicate a mismatch in updater publisher-name validation rather than a missing signature.

Impact

Does not block work on the previous install.

Environment

Windows

Logs or stack traces

## Environment

- OS: Windows
- Target version: `0.0.17`

## Error details

{
  "SignerCertificate": {
    "Issuer": "CN=Microsoft ID Verified CS AOC CA 04, O=Microsoft Corporation, C=US",
    "SerialNumber": "33000006DAD75B07C82831D6720000000006DA",
    "SignatureAlgorithm": {
      "Value": "1.2.840.113549.1.1.12",
      "FriendlyName": "sha384RSA"
    },
    "Thumbprint": "979DCFC5382EE980434A3C189645AC420DF9414F",
    "Subject": "CN=T3 Tools Inc, O=T3 Tools Inc, L=San Fransisco, S=California, C=US"
  },
  "TimeStamperCertificate": {
    "Issuer": "CN=Microsoft Public RSA Timestamping CA 2020, O=Microsoft Corporation, C=US",
    "SerialNumber": "330000005724D395E0A2E9C931000000000057",
    "Thumbprint": "FD2F31399C42510141364ACDF168A28F5C79CBC3",
    "Subject": "CN=Microsoft Public RSA Time Stamping Authority, OU=nShield TSS ESN:7800-05E0-D947, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
  },
  "Status": 0,
  "StatusMessage": "Signature verified.",
  "Path": "C:\\Users\\XXXXX\\AppData\\Local\\t3-code-desktop-updater\\pending\\temp-T3-Code-0.0.17-x64.exe"
}

[aaronilyas]

I was able to reproduce this on Windows, and I found a likely cause on my machine.

In my installed resources/app-update.yml, publisherName was:

publisherName:
  - 'T3 Tools Inc '

There was a trailing space after Inc. I changed it to:

publisherName:
  - 'T3 Tools Inc'

After that, the update worked for me.

So this looks like the installer signature is valid, but the generated updater config may contain a publisher name with a trailing space, which causes the owner/publisher check to fail.