Sign the Windows Installer #894

Activity

1. GyulyVGC

   added a parent issue on Jul 23, 2025

   • App Packaging 📦 #252
2. GyulyVGC

   added

   packagingApplication packagingApplication packaging

   enhancementNew feature, request, or improvementNew feature, request, or improvement

   WindowsSomething related to Windows operating systemSomething related to Windows operating system

   on Jul 23, 2025
3. GyulyVGC

   self-assigned this

   on Jul 23, 2025
4. GyulyVGC

   added this to the v1.4.1 milestone on Jul 23, 2025
5. GyulyVGC commented on Jul 23, 2025

   

   GyulyVGC

   on Jul 23, 2025

   OwnerAuthor

   More actions

   @all-contributors please add @celtic-coder for ideas.

   👍React with 👍1Reacted by Liam OBrien
6. allcontributors commented on Jul 23, 2025

   

   allcontributorsBot

   on Jul 23, 2025 – with AllContributors

   Contributor

   More actions

   @GyulyVGC

   I've put up a pull request to add @celtic-coder! 🎉
7. GyulyVGC

   closed this as completedin #897on Jul 29, 2025
8. GyulyVGC commented on Jul 29, 2025

   

   GyulyVGC

   on Jul 29, 2025

   Last edited by GyulyVGC

   OwnerAuthor

   More actions

   This finally happened thanks to the @SignPath foundation 🎉

   ---

   For future reference I'll leave here a message I received from a member of their team concerning that installation warnings still may appear for a period of time, even if the Installers will be now signed starting from version 1.4.1:

   About the Smartscreen Warning:

   Yes, even after signing with our OSS certificate, it's still possible that Microsoft SmartScreen will display a warning, especially for new or rarely downloaded applications. This is not a reflection of the signature's validity, but rather how SmartScreen reputation works.
   To clarify:

   • SmartScreen uses a reputation-based system that takes into account things like the number of downloads, file history, and publisher reputation.
   • Signing the application is the first and most important step toward building that reputation.
   • Over time, as more users download and run your application, SmartScreen warnings typically disappear over time.

   Unfortunately, there’s no way to immediately “pre-clear” or bypass SmartScreen via code signing alone, not even with a commercial EV certificate. Since newly issued certificates (including for OSS projects) start with zero reputation, SmartScreen may still flag them at first. But a valid digital signature does help users verify authenticity and should eventually allow SmartScreen to recognize the application as trustworthy.

   That said, Microsoft also allows developers to manually submit their signed files for review. This can help accelerate the process:

   • You can go to the Windows Defender Security Intelligence portal:
     • https://www.microsoft.com/en-us/wdsi/filesubmission
   • Submit your signed installer or executable for analysis.
   • There is also a feedback option for SmartScreen alerts, which can be helpful for reputation building.

   👍React with 👍1Reacted by Liam OBrien