Windows 8 default AV detects release as unsafe

[alexcroox]

After building the app (using nodebob) on a fresh Windows VM, opening the app gives a giant warning about the file being unsafe.

Is there some sort of signing required for Windows apps that this build process doesn't support?

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[baconbrad]

Might not be nw.js. This is a typical Windows 8 alert for any unsigned application downloaded from the internet.

[alexcroox]

Is there anyway to sign nw builds?

[zdnet]

any solution to codesign the nw .exe?

[mscreenie]

If you're combining your app and nwjs into a single executable then you need to sign the .exe yourself. A signed version of nw.exe will not help in this case.

Signing is relatively cheap compared to a few years back, although it is a inconvenience.

[shaynem]

We purchased our own code signing certificate and do it ourselves but we're
distributing nwjs rather then just the app itself

If you need any help with getting a cert I can point you in the right
direction. Some of the cheaper code signing certificate will still get
smart screen warnings so you need to be careful.

Shayne.
On 24 Aug 2015 7:34 pm, "FringeKit" notifications@github.com wrote:

any solution to codesign the nw .exe?

—
Reply to this email directly or view it on GitHub
#3454 (comment).

[HanaHsu]

@shaynem
Our company signed up a Microsoft developer account and got a publisher code.
But we still have problems to sign our nwjs app.

Could you please share your experiences about signing a nwjs exe file? It will be a great help.

[Yimiprod]

@shaynem Same problem to sign our nwjs app, if you can help on how to do it.

[shaynem]

Hello

Sorry - i didn't see this notification

Here is what we do.

We have purchased a certificate from Global sign (
https://www.globalsign.com/en-au/code-signing/) the EV Certificate

We then use the signtool.exe from the Windows SDK (Just download it for
your windows version)

"C:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool" sign /f
%CUR_DIR%\buildTools\cert\OS201505041536.pfx /p CertificatePassword /tr
http://tsa.starfieldtech.com /td SHA256 %EXE_PATH%

change %CUR_DIR% to the full location of your pfx file (Your actual
certificate) and the %EXE_PATH% to the path of the file your trying to
sign. - the CertificatePassword = the password of your certificate if it
has one, if not just remove the /p

I pulled this line from our batch file we use to automate the build process

Shayne.

[shaynem]

p.s - We originally purchased a certificate from
http://codesigning.ksoftware.net/ -- Because they are super cheap after
all.

But we still ran into issues with Windows Smart Screen.

This is there response when I asked them about there code signing
Certificates (Even tho you go through EV with Comodo once you purchase it
through there site)

"Shayne -- no one ever told you these were EV code signing certificates, I
don't believe in the extra value (of 10 times the price), because you can
get all of the benefits of the EV certs without all of the extra cost and
validation.

To get through SmartScreen - use IE on your own computer to download your
program, when SmartScreen comes up choose More Info and Run Anyway, once
your installer or program starts you can exit, you don't need to complete
the setup each time. Repeat that process 10-12 times and give it a few
hours to get back to Microsoft. You'll see SmartScreen leave you alone
shortly after that. Once one file with your signature gains reputation,
that reputation will be shared with any other files you sign too.

If you just want the refund, let me know and I'll make that happen for you
too."

I wasn't about to put up with that crap each time we did a new build... and
i'm certain you would probably end up with other problems at some point
down the track.

I thought I would add this info to help people in the future which means -
Don't go purchase a cheap code signing certificate unless you want to build
your own reputation and await it to be pushed to other's.

On Wed, Oct 14, 2015 at 2:37 PM, Shayne shayne.mcc@gmail.com wrote:

Hello

Sorry - i didn't see this notification

Here is what we do.

We have purchased a certificate from Global sign (
https://www.globalsign.com/en-au/code-signing/) the EV Certificate

We then use the signtool.exe from the Windows SDK (Just download it for
your windows version)

"C:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool" sign /f
%CUR_DIR%\buildTools\cert\OS201505041536.pfx /p CertificatePassword /tr
http://tsa.starfieldtech.com /td SHA256 %EXE_PATH%

change %CUR_DIR% to the full location of your pfx file (Your actual
certificate) and the %EXE_PATH% to the path of the file your trying to
sign. - the CertificatePassword = the password of your certificate if it
has one, if not just remove the /p

I pulled this line from our batch file we use to automate the build
process

Shayne.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.