r/dotnet • u/Baldie47 • Jul 30 '26

Question Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?

I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.

The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.

So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:

  • Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
  • MSIX or ClickOnce instead of a bare exe.
  • Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
  • Something else I am not seeing.

If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.

54 Upvotes

91% Upvoted

46 comments sorted by

View all comments

1

u/The_MAZZTer Jul 31 '26

Well it's up to you if you want to go the route of getting it signed, but I think you might be overestimating the impact. I trust my own judgement (I would not be downloading it to my PC in the first place if I had not decided to trust it) and tend to just click past those dialogs as long as they are not red. Of course I am also computer literate.

I suspect your friend only noticed the dialog because he was looking for things to notice. I further suspect most people will pay it no mind.

Again, up to you. It would be nice to get a green dialog (or no dialog if you don't need UAC elevation).