Treat MSI files as containers

[bricelam]

Fixes #673

[bricelam]

Note, there's still an embedded CAB file inside the MSI that doesn't get signed. But AFAICT, it never gets laid out on disk, and its container--the MSI--gets signed anyway, so integrity is still guaranteed.

[dlemstra]

This should be resolved before this PR is merged.

[bricelam]

Here are the instructions for mirroring a package. Also be sure to revert this file.

[bricelam]

I wasn't sure what to do about testing here. I've tested it manually, of course. But generating an MSI in the tests felt like overkill and would require significant new dependencies. I also considered checking in a test MSI, but wasn't sure you guys would go for that. Let me know if (and how) you want me to add more tests.

[bricelam]

Fixing this will probably make #647 and #775 more urgent for some users.

[Foda]

@bricelam I was able to verify this manually, but this only works if the .cab your .msi uses is embedded. It causes a regression with .msi installers with non-embedded .cab files (ie: #875). It throws in the wixtoolset code and appears as a "file not found" error in a temp folder.

[Foda]

@bricelam I was able to verify this manually, but this only works if the .cab your .msi uses is embedded. It causes a regression with .msi installers with non-embedded .cab files (ie: #875). It throws in the wixtoolset code and appears as a "file not found" error in a temp folder.

Just a follow-up: it's probably OK for this regression as long as it doesn't roll out in a release. We'd like to add a new flag that doesn't recurse into file containers to go along with this.