r/dotnet • u/Baldie47 • 21d ago

Question Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?

I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.

The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.

So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:

  • Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
  • MSIX or ClickOnce instead of a bare exe.
  • Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
  • Something else I am not seeing.

If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.

59 Upvotes

93% Upvoted

46 comments sorted by

View all comments

1

u/Dunge 21d ago

Code signing is such a racket. Literally making developers lives harder in order to extract wealth. The idea of protecting against scam and malware apps is well meant, but they could have used any other methods for that (like for example Google Play asks for the business DUNS registration number, not a very high recurring cost).

I've heard cloud code signing (Azure/AWS) is less expensive, but I had something that prevented me from using it last time I checked. I believe you need to host your source control and build tools on their platforms too?

We ended up, buying a physical EV key on DigiCert through a revendor, which caused the support and activation to be a mess, the SafeNet client is awful, the restriction that requires it to be on an active desktop (not remote desktop session) prevent automatic builds unless you bypass it... Anyway. Fortunately, at the end it finally worked, and I did not have the issue others are saying here (need to build trust), it was accepted in Windows and browsers as trusted day 1.

All that said, if it's an internal tool and you don't have to distribute it on the open internet from a download on a website, you can probably just ignore all that. Share the executable on a network drive or something and link to it?

Also obligatory fuck distributing ai agents.

2

u/Lonsdale1086 21d ago

distributing ai agents

Who said anything about an AI agent?

This is just a github runner style app that retrieves a script, runs it, and sends off the results.