Sign releases on Windows to avoid security warnings on startup (and Windows Defender problems)

[sampottinger]

It looks like new builds do not have sufficient reputation and are triggering warnings on Windows 10's SmartScreen. This may require a more expensive EV cert. It also appears that Processing 3 may not be signed for windows but likely has enough reputation to get through the screen. This means this would be a new signing process?

[benfry]

Sounds like it… and anything that helps us deal with false Windows Defender flags would also help. Obviously they're totally different systems, but we should keep an eye out for anything we can do here.

For the last two years or so, each release gets flagged as being afflicted by a different Windows virus (I'd be more concerned if it weren't a different one each time) and there's not much we can do.

[sampottinger]

Cool cool! Let me follow up on email re the EV cert.

[benfry]

Possible useful resource https://stackoverflow.com/questions/252226/signing-a-windows-exe-file

Also posted #173, which covers the same issues for exported applications on Windows.

[benfry]

Added notes to the new troubleshooting page so we have something to refer people to in the meantime: https://github.com/processing/processing4/wiki/Troubleshooting#viruses-and-trojans

[benfry]

Notes about the validation process (this is for SSL, but the code signing process is similar validation-wise) https://www.namecheap.com/support/knowledgebase/article.aspx/9917/68/ev-process-and-its-documentation/

[benfry]

Additional references:

• Partnering with the industry to minimize false positives from Microsoft
• Code signing certs for open source projects for €25