MS Defender Smartscreen

[paolo2504]

Every time a new compiled Windows 64bit package is run, MS Defender Smartscreen warns it is a suspicious application and asks for additional information. Reason is "unknown author". To let installation proceed, it is necessary to force it.
In my memory, this didn't happen before, i mean with packages download from sourceforge and probably with early realy by Oleg.

Not an issue, just to notify this. I don't know how Smartscreen works... Maybe it really complains that somewhere in the package the Author is not populated, maybe the reason is different.

[rousseldenis]

Every time a new compiled Windows 64bit package is run, MS Defender Smartscreen warns it is a suspicious application and asks for additional information. Reason is "unknown author". To let installation proceed, it is necessary to force it. In my memory, this didn't happen before, i mean with packages download from sourceforge and probably with early realy by Oleg.

Not an issue, just to notify this. I don't know how Smartscreen works... Maybe it really complains that somewhere in the package the Author is not populated, maybe the reason is different.

Hi @paolo2504. Thanks for this. Could you provide a little bit more info about the error you had and at least the exact error message string and maybe a screenshot?

Thanks

[paolo2504]

Denis, when an app that was blocked first by Defender SMartscreen is allowed to run, then it runs without beng blocked anymore. I'll provide you the error msg when it will be shown on future GO versions.... Meanwhile look as follows to the sample error messages users get when smartscreen is blocking potentially dangerous apps.

[rousseldenis]

I've submitted the install file to Windows Defender online analysis and it returned as safe.

But further versions will be triggered as 'unknown' until we provide a certificate embedded in install file.

@oleg68 I think this can investigated to avoid annoying messages.

[oleg68]

@rousseldenis @paolo2504

There are two issues

1. Were to keep the crypto files for signing the code that only official builds on github may access them?
2. Such certificates are usually paid. I don't think that it is acceptable for free software.

[rousseldenis]

I think the main error is the 'unknown' author. But I don't know which build property to fix.

[rousseldenis]

And I found this that maybe can be included in build flow:

https://github.com/mtrojnar/osslsigncode

[oleg68]

And I found this that maybe can be included in build flow:

Yes, it can. But the two issues mentioned above are still active.

[rousseldenis]

And I found this that maybe can be included in build flow:

Yes, it can. But the two issues mentioned above are still active.

Indeed, but before going further, we need to check if populating a missing entry for 'unknown' author in build config may be sufficent.

[paolo2504]

just a one-cent thought...what about changing the installer tool ? at present it is nsis or Inno setup if am right. perhaps the problem is there.

[oleg68]

@paolo2504 No, it is not. Windows defender requires that windows executables would be signed with a certificate issued by some certification authority. If we had this certificate we could sign both GrandOrgue.exe and the nsis installation file with it.

[oleg68]

Indeed, but before going further, we need to check if populating a missing entry for 'unknown' author in build config may be sufficent.

Where is this entry? I thing it is in the certificate, isn't it?

[rousseldenis]

Indeed, but before going further, we need to check if populating a missing entry for 'unknown' author in build config may be sufficent.

Where is this entry? I thing it is in the certificate, isn't it?

I don't know. I'm referring to the original post of @paolo2504 here above.

I wanted to say that if we can fix it simply with adding a missing entry without the certificate stuff...

Need exploration.

[oleg68]

I wanted to say that if we can fix it simply with adding a missing entry without the certificate stuff...

If it was possible then Defender could not protect against a malware: everybody could take the GO sources, add some malware code to them, build GO and fill the Manufacter entry.

The protection is based on that only few people have access to the private key (ideally - nobody except the github build bot) and that all changes are merged only after a code revew of several responsible people. The reviewers must check that no malware is added to the source code before their approval.

This protection scheme would't be possible without having a private key with high restricted access.

[paolo2504]

i confirm , as MS stays, that setting 'unblock' in Property dialog before exeting the installer the error does not come out.

[oleg68]

@paolo2504 unfortunally, we can nothing to fix this without a quite expensive purchasing of a certificate, that is not acceptable for the open source project.