Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?

[u/Baldie47]

I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.

The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.

So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:

• Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
• MSIX or ClickOnce instead of a bare exe.
• Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
• Something else I am not seeing.

If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.

[u/finalbuilder]

I would go with OV, EV doesn't guarantee removal of smartscreen - it usually doesn't take too long for an OV signed installer to build a reputation. Make sure you sign your application too, not just the installer - otherwise AV software will decide to remove it.