Windows build needs to be signed, too

[justvanrossum]

We need to figure out:

• how to do it
• how to get a certificate

[justvanrossum]

The current build can be run, but the Windows malware detector ("Defender") flags it as malware, and you have to take some steps before it can be run.

[ftCLI]

I came across the same issue and found the solution in this e-book: https://www.pythonguis.com/packaging-book/

The main decision you have is between Standard Validation and Extended
Validation. Both are sufficient to sign executables, with EV required only for
drivers. That said, EV is the only way to guarantee that no warnings are
shown — with a normal validation cert you need to accrue "reputation" by
having the software installed on a sufficient number of (internet connected)
machines (that report their installs). If that sounds like too high a bar for
your software, you may want to consider EV.

A list of certificate providers can be found in this page: https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/code-signing-cert-manage

Also: https://comodosslstore.com/code-signing

To sign executables: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool

[justvanrossum]

Thank you, that is very useful information!

[justvanrossum]

IMO this describes the best way to to go: https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/ Although for now this seems to be limited to US and Canada-based companies :(

[justvanrossum]

Some more info https://techcommunity.microsoft.com/blog/microsoft-security-blog/trusted-signing-public-preview-update/4399713

[jenskutilek]

Windows code signing is of dubious value, IMHO.

We recently acquired a code signing certificate (the simple version, no extended validation), and our signed installers are still greeted with the "Windows protected your PC" message, requiring additional clicks and confusing users. And it still costs like €800 for 3 years.

YMMV regarding the "Windows protected your PC" dialog, because AFAIK when MS "knows" the installer, and more people have installed it, the warning eventually is not shown anymore. But that's no use for us because we deliver customer-specific installers which don't get used widely in the open.

Nowadays the signing certificates and keys must reside on a hardware dongle, which means you can only sign on one machine to which you have physical access (the dongle can't be used via a Remote Desktop session).