When a customer downloads my msi the download can...

# compose-desktop

[Nuru Nabiyev]

When a customer downloads my msi the download cancels because of this. Do I need to sign/notarize msi?

[mikehearn]

Signing definitely helps with such situations. Browsers don't like unsigned code or installers.

[mikehearn]

If you're looking for tooling/docs to assist check out my Conveyor product. It simplifies shipping CfD apps considerably, including software updates and signing support.

https://hydraulic.dev/

[Nuru Nabiyev]

Hi Mike! Thanks a lot, I have checked your product before as well but it's too costly for businesses that are pre-revenue. It's great that you are supporting open source projects though! But for now there is no revenue to use your services.

[Nuru Nabiyev]

There are also no docs on how to sign the distributable for windows, only for Apple. How do you sign app for windows, @mikehearn?

[mikehearn]

You can use the MS Store. That's cheap. They'll sign it for you. Unfortunately they may also give you a runaround due to app review, etc. Usual stuff for stores

[mikehearn]

Otherwise you'll have to buy a code signing certificate and I'm afraid those are as/more expensive than Conveyor.

[Nuru Nabiyev]

Does it mean that I have upload my msi to windows store then? I don't want to deal with store (for now), only signing the executable

[mikehearn]

yes you'd have to publish via the store. It costs $19/yr though.

[Nuru Nabiyev]

It's clear now, thanks! Once I have some revenue I'll 100% use your tool 👌

[Alexander Maryanovsky]

Windows randomly flags apps as if they have a virus. In my app one version had this problem. Some random changes and a rebuild, and voila - the “virus” was gone.

[mikehearn]

That's mostly only an issue for unsigned apps or apps signed without an EV certificate

[mikehearn]

because then there's no signal of whether it's good or bad so AV scanners rely on heuristics, machine learning etc