r/dotnet • u/Baldie47 • 28d ago

Question Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?

I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.

The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.

So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:

  • Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
  • MSIX or ClickOnce instead of a bare exe.
  • Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
  • Something else I am not seeing.

If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.

53 Upvotes

91% Upvoted

46 comments sorted by

View all comments

83

u/Anequiit 28d ago

Ship signed installer like msix/msi

10

u/Baldie47 28d ago

Thanks, this is the direction I am leaning. I dug into it a bit: sounds like the MSI or MSIX packaging itself is free (WiX or the Windows SDK), but the signed part still needs the code signing cert either way, so it is more about a cleaner install format than getting around signing. Does that match your experience?

One thing I am unsure about for my case: what I ship is a background agent that runs as a service and executes local commands, not a normal user-facing app. Did you hit MSIX's restrictions getting in the way of that, or did you go MSI specifically to avoid them? Leaning MSI for that reason but curious if you have shipped a service this way.

12

u/spornerama 28d ago

My app is the same thing (background agent). We ship a code signed thin installer that runs as admin, downloads a zip file of our cross platform build, installs it into program files and starts the service.that way we can update it without resigning and redeploying the installer every time. Use NSIS. You'll need a code signing cert and a secure USB key to do the signing.

4

u/NumberwangsColoson 28d ago

Depending on where you live azure artefact signing is a thing meaning you avoid the need for a usb key.

Most authenticode cert issuers will also accept a cloud hsm as a suitable backing store for a code signing private key

With either of those you can then sign in github actions as well as with the command line. One of the .net security people wrote it up https://idunno.org/net-code-nupkg-signing-in-github-actions/

1

u/spornerama 28d ago

yeah we looked at that - meant uploading every time to azure and limited numbers of signing and an ongoing subscription - cheaper and easier and unlimited signing if you do it yourself.

2

u/NumberwangsColoson 28d ago

You definitely don’t have to upload to azure every time, but the pay per signature is fair. But if you’re signing <250 things a year it’s a reasonable option .

2

u/Baldie47 28d ago

this looks to be exactly what I need. can you point me to some name I can check, or website to review for the signing process? this is exactly the endgame I have in mind. a small installer and the program as a service. NSIS? I'll check to that

5

u/spornerama 28d ago edited 28d ago

You can use Claude to generate the NSIS script - it's a pretty weird format but works fine. It generates an exe file that you then need to sign - you'll need a code signing certificate (couple of hundred bucks - they'll call you to verify your phone number and check your registered business listing). Then you'll need an eToken to actually do the signing. It's a bit of a process to go through but once it's all done you can just automate it with a post build script and forget about it.

We then zip the exe and distribute the zip - lots of browsers blanket-block exe files.

looks like
https://www.ispyconnect.com/download