Windows build: optional code-signing to cut AV/SmartScreen friction (do NOT hard-gate; no EV cert) #10

Open
opened 2026-07-14 19:34:05 +00:00 by mohlec · 0 comments
Owner

Problem

Our Windows installer is unsigned (no Authenticode signature). This causes:

  • SmartScreen "Windows protected your PC / unknown publisher" prompts for every tester.
  • Aggressive AV scanning of the unknown 108MB installer. On 2026-07-14, a tester's win11-laptop BSOD'd (PAGE_FAULT_IN_NONPAGED_AREA) while Malwarebytes scanned the unsigned -setup.exe — its service crash-looped in CleanControllerImpl.dll then its kernel driver page-faulted. The app did not cause the crash (user-mode Electron can't BSOD Windows), but unsigned installers make AV this twitchy.

Hard requirement

Do NOT hard-gate CI on signing. Builds must keep producing working unsigned installers when no cert is configured. No EV cert / not paying Microsoft. Wire signing to activate only when signing env vars are present (electron-builder CSC_LINK / CSC_KEY_PASSWORD), else build unsigned. Conditional, never a gate.

Options (all avoid paying Microsoft for an EV cert)

  1. Self-signed cert pushed to NCW-managed machines as a Trusted Publisher (GPO/Intune). Free. Removes SmartScreen + AV friction on the managed fleet only (not for arbitrary external users). Best fit since Slash is internal.
  2. Azure Trusted Signing (~$10/mo, org-verification required) — cheap OV-equivalent if a small recurring cost is ever acceptable. Listed for completeness; skip per "not paying" directive.
  3. Accept unsigned + document Defender/Malwarebytes exclusions for the installer + SmartScreen "More info -> Run anyway" for testers. Zero cost, current state.

Suggested implementation

  • electron-builder: sign win target only if CSC_LINK is set (default electron-builder behavior) - already conditional; just document + optionally add a self-signed cert path for NCW machines.
  • Update the Windows install runbook/RUNBOOK with the AV-exclusion + SmartScreen steps (option 3) as the interim.

Related: PR #9 (updater URL + rename). Incident context: win11-laptop Malwarebytes BSOD 2026-07-14.

## Problem Our Windows installer is **unsigned** (no Authenticode signature). This causes: - SmartScreen "Windows protected your PC / unknown publisher" prompts for every tester. - Aggressive AV scanning of the unknown 108MB installer. On 2026-07-14, a tester's win11-laptop BSOD'd (`PAGE_FAULT_IN_NONPAGED_AREA`) while **Malwarebytes** scanned the unsigned `-setup.exe` — its service crash-looped in `CleanControllerImpl.dll` then its kernel driver page-faulted. **The app did not cause the crash** (user-mode Electron can't BSOD Windows), but unsigned installers make AV this twitchy. ## Hard requirement **Do NOT hard-gate CI on signing.** Builds must keep producing working **unsigned** installers when no cert is configured. **No EV cert / not paying Microsoft.** Wire signing to activate only when signing env vars are present (electron-builder `CSC_LINK` / `CSC_KEY_PASSWORD`), else build unsigned. Conditional, never a gate. ## Options (all avoid paying Microsoft for an EV cert) 1. **Self-signed cert** pushed to NCW-managed machines as a Trusted Publisher (GPO/Intune). Free. Removes SmartScreen + AV friction **on the managed fleet only** (not for arbitrary external users). Best fit since Slash is internal. 2. **Azure Trusted Signing** (~$10/mo, org-verification required) — cheap OV-equivalent if a small recurring cost is ever acceptable. Listed for completeness; **skip per "not paying" directive.** 3. **Accept unsigned** + document Defender/Malwarebytes exclusions for the installer + SmartScreen "More info -> Run anyway" for testers. Zero cost, current state. ## Suggested implementation - electron-builder: sign win target only if `CSC_LINK` is set (default electron-builder behavior) - already conditional; just document + optionally add a self-signed cert path for NCW machines. - Update the Windows install runbook/RUNBOOK with the AV-exclusion + SmartScreen steps (option 3) as the interim. Related: PR #9 (updater URL + rename). Incident context: win11-laptop Malwarebytes BSOD 2026-07-14.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
slash/slash-desktop#10
No description provided.