Request: code-signed Windows installer (SmartScreen blocks 2.4.0 as "Malicious file")

[AmirZ93]

Hi, and thanks for building TwinDesk. It looks like a really useful project.

I'm a regular user and I tried to install TwinDesk-Setup-2.4.0.exe, downloaded from this repo's GitHub Releases page. Windows SmartScreen showed a red "Malicious file" screen with only a "Don't run" button, which stopped me from installing it.

Some details that might help:

• VirusTotal flags the installer on 19/65 engines: https://www.virustotal.com/gui/file/39ffc5458abbedddf9b3d9da23356e70dd688be4c4af6b16ac31478d5f6c8fda
• Most detections look heuristic or ML-based (names like "Heur", "Malware-gen", "Generic.ml", "Boxter"), and several of them come from the same underlying engine, so this looks like a false positive to me. I'm not claiming the app is malicious.
• Microsoft Defender itself did not flag the file: my Protection history shows no threat, so the block came from SmartScreen's reputation check.

Because the installer is unsigned and new, it has no reputation, and TwinDesk needs powerful permissions (input control, screen capture, clipboard, calls and texts). Many users will understandably refuse to run it.

Could you please consider:

1. Publishing a release with an Authenticode-signed Windows installer. The README mentions the WIN_CSC_LINK secret in the build workflow, so it seems to be supported already. A signed build is the main thing that lets SmartScreen reputation build up.
2. Submitting the installer to Microsoft as a false positive: https://www.microsoft.com/wdsi/filesubmission
3. Publishing SHA-256 hashes next to each release, and ideally building releases only from GitHub Actions so users can verify them.

I'm happy to test a new build and report back. Thanks again for your work!

[InukaAsith]

working on this with signpath foundation and on last steps now