Validating Installer Artifacts in CI/CD with pkgprobe's Python API

01 The Blind Spot in Your Pipeline

In most organizations, the build-to-deploy flow looks like this: Build → Package → Upload to artifact repo → Deploy. At no point does anyone systematically inspect what's actually inside the installer before it ships.

The fields that go unchecked every release cycle:

• Silent install behavior and exit code validity
• Embedded custom actions executing arbitrary code
• Signature integrity and certificate chain state
• CVE matches on bundled components
• Suspicious network indicators baked in at packaging time
• Framework detection confidence (do you know what packaged this?)

Which means the first real security test of your installer happens in production — or worse, post-incident. That's backwards.

02 Shift Left: Treat Installers Like Code

If you can unit test source files, you can validate installers. The principle is identical — define what "good" looks like, run the check automatically, fail the build if it doesn't pass.

pkgprobe exposes a Python API specifically for this. You can drop it directly into GitHub Actions, Azure DevOps, GitLab CI, Jenkins, or any self-hosted runner environment.

from pkgprobe import analyze_exe

plan = analyze_exe("dist/MyAppSetup.exe")

# Fail if detection confidence is too low
if plan.confidence < 0.70:
    raise Exception("Installer detection confidence too low")

# Fail on any high-severity CVE
for cve in plan.cve_matches:
    if cve.severity == "HIGH":
        raise Exception(f"High severity CVE: {cve.cve_id}")

# Fail if unsigned
if plan.signature_state != "SIGNED":
    raise Exception("Installer is not signed")

print("Installer validation passed.")

That's it. Now your installer has a security gate — the same way pytest gates your code. Simple, deterministic, automatable.

03 GitHub Actions Integration

Dropping pkgprobe into a GitHub Actions workflow is a single job addition. It runs on a Windows runner, installs the package, analyzes the artifact, and pipes results into your validation script.

name: Validate Installer

on: [push, pull_request]

jobs:
  validate:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install pkgprobe
        run: pip install pkgprobe

      - name: Analyze Installer
        run: |
          pkgprobe analyze dist/MyAppSetup.exe --json > result.json

      - name: Validate Results
        run: python scripts/validate_installer.py

04 What You Can Enforce

You're not limited to CVE checks. pkgprobe lets you build policy around any dimension of installer analysis — and enforce it consistently across every build.

05 Advanced: Risk Scoring as a Gate

Beyond individual checks, pkgprobe produces a composite risk score across all analysis dimensions. This lets you set a single quantitative threshold — and automatically block any installer that exceeds it.

from pkgprobe import analyze_exe
import json, sys

plan = analyze_exe("dist/MyAppSetup.exe")

# Composite risk score gate
if plan.risk_score > 0.65:
    print(f"✗ Risk score {plan.risk_score:.2f} exceeds threshold 0.65")
    sys.exit(1)

# Dump full report as build artifact
with open("installer-report.json", "w") as f:
    json.dump(plan.to_dict(), f, indent=2)

print(f"✓ Risk score {plan.risk_score:.2f} — installer approved")

Security becomes measurable and auditable. Every build produces a JSON report you can attach as a build artifact — giving you a full audit trail of every installer that shipped.

06 The New Deployment Flow

Here's what the shift looks like end to end — from the old manual process to a fully gated automated pipeline:

07 Why This Matters in Regulated Environments

In healthcare, finance, government, and critical infrastructure, installer integrity isn't just a security concern — it's an audit requirement. If an auditor asks "how do you validate third-party deployment packages before release?", you want a better answer than "manually."

Automated installer validation also directly addresses requirements that appear in frameworks like NIST SP 800-161 (supply chain risk management) and the CISA Secure by Design guidance — areas where most orgs currently have no tooling at all.