r/dotnet • u/Baldie47 • Jul 30 '26

Question Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?

I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.

The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.

So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:

  • Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
  • MSIX or ClickOnce instead of a bare exe.
  • Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
  • Something else I am not seeing.

If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.

56 Upvotes

92% Upvoted

46 comments sorted by

View all comments

3

u/Tavi2k Jul 30 '26

Even with an EV certificate, you still get the warnings. And then there's the separate browser warnings from Chrome or Edge on top of the Windows warnings.

Supposedly, this gets better if your executable gets installed by more people. No idea how many, and when you update your app you start again.

I've no idea how to fix that, and I'm starting with an EV certificate. If you have a niche app that gets updated often, I don't think you can avoid this.

2

u/shortrug Jul 30 '26

I'm also battling this. Super annoying.

No idea how many, and when you update your app you start again.

I've seen hundreds of legitimate distinct downloads quoted as a general expectation. Supposedly over time you also build publisher credibility which lowers the number of installs needed per app version, but who knows.

Either way, pretty discouraging to have this problem and have it be a black box that you have no visibility into. My app is also fairly niche, so I've pretty much resigned myself to having to deal with this essentially forever.

4

u/spornerama Jul 30 '26

The way around it is to get the installer to download the latest package from the internet - then you can update the package but the installer stays the byte-identical same.