Digitally sign the Windows binaries

[pebroz]

BitBox.exe on Windows is not digitally signed, new releases are thus blocked for a period of time by antimalware and security products. In my case the attack surface reduction rules within Microsoft Defender prevents running the program due the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion".

The setup program is already signed, aswell as the bundled libraries and Qt binaries. Version BitBox-4.43.0-win64

[sveroa]

Same issue her

[benma]

Thanks for the report.

Is this a new issue? We've always only ever signed the installer executable and never heard of this problem before.

[pebroz]

Has existed for some time for me. Companies are increasing cyber security, so more of an issue with companies. This is not enforced in Windows consumer editions by default yet. After enough intelligence has been gathered the binary will eventually run, but it means a delay before I can use new releases.

Unsigned is even worse on Apple, I propose the binary get signed. Just checking the installer does little for at runtime or after install modification of the BitBox client.

[benma]

Thanks for the hint. on macOS we sign the .app folder using codesign before creating the installer.

I'll see if I can sign the BitBox.exe too.

[sveroa]

It seems like most executables should be signed....I'm getting the block message on the uninstall.exe as well

Rule: "Block executable files from running unless they meet a prevalence, age, or trusted list criteria"