Why I'm not making a Windows installer (nor code-signing)

[David Healey]

@dannytaurus said in Why I'm not making a Windows installer (nor code-signing):

SmartScreen reputation still builds up gradually per certificate.

This is now the case for all signing options include EV. The only exception is Microsoft store publishing. Really annoying, but I think my EV certificate still gives me instant rep because I bought it pre-2024

[digi]

Jeez, this sounds like a PITA. I'm making a guitar plugin atm, but I have a standalone build too...

[DanH]

@dannytaurus I think in 5 years I’ve only ever had one complaint about the smart screen. Users must be pretty used to it.

[dannytaurus]

@DanH Agreed, especially music producers who might be downloading and installing free and shady plugins from all over the place. They know how to do the 'install anyway' dance.

But for my first plugins (fully self-contained VST3) the ZIP method is same-effort for the end user. Anyone used to breezing past the 'install anyway' screens also knows how to drop a VST3 into the system folder.

Like I said, when I register as a limited company, I'll definitely do Azure code-signing and make a proper installer (and no Unknown Publisher screen). I just need to register the limited company before shipping plugins with sample archives or expansions.

[David Healey]

@dannytaurus said in Why I'm not making a Windows installer (nor code-signing):

I just need to register the limited company before shipping plugins with sample archives or expansions.

You probably already know this, but being a limited company (especially as a sole director) gives some nice tax advantages.

[dannytaurus]

@David-Healey Yeah, even though the UK government is doing all it can to erode them away year after year

Aside from tax efficiency, the main reasons I'm doing it are for plugins:

1. Ability to use Azure cloud-signing on Windows, and
2. Ability to have Meat Beats Ltd as my Apple signing ID instead of my full name.

[Orvillain]

haha. Wait until you need to support AAX. Now that is a proper headf**k !!!

My current approach is, locally I'm building an inno installer for windows and accepting the smartscreen issue for now. On Mac I'm building a pkg, and my post-install script runs a quarantine flag removal on the installed vst3 file. It seems to be working for some alpha testing.

Eventually I need to jump through all of the hoops to get codesigning up and running and a proper CI system - was thinking Github actions. Then it can all just live in one place, I click a button, and I get a build from whatever branch I choose.

[dannytaurus]

@Orvillain I'll never support AAX. My audience simply doesn't live there. Thank goodness!

On Mac I'm building a pkg, and my post-install script runs a quarantine flag removal on the installed vst3 file. It seems to be working for some alpha testing.

If by alpha testing, you mean on your own machine and a few developer friends, then yes that'll work but it's unlikely to survive contact with the real world.

Fortunately the macOS side is the easiest to solve. Get a $99/year developer account, get your App and Installer signing certs and apply them during the export and packaging phase. Extremely easy.

[David Healey]

@dannytaurus The same certificate can be used for AAX on both macOS and Windows too.

[Lindon]

@David-Healey said in Why I'm not making a Windows installer (nor code-signing):

@dannytaurus The same certificate can be used for AAX on both macOS and Windows too.

Windows too? How?

[David Healey]

@Lindon You can export the certificate from macOS certificate manager (something like a .pfx file, can't remember the extension exactly). This can then be imported on Windows.

It cannot be used to get past smart-screen but it can be used to sign AAX plugins if you don't have a Windows signing certificate. You can also use a self-signed certificate for this purpose. Pro-tools doesn't mind. If you're using iLok though then you probably need a proper certificate.

Covered in my Packaging workshop too: https://audiodevschool.com/courses/packaging-for-windows/

[Lindon]

@David-Healey I was looking for a simple one-man-band way to get past the windows "smart screen" - but thanks anyway....

[Orvillain]

@dannytaurus said in Why I'm not making a Windows installer (nor code-signing):

If by alpha testing, you mean on your own machine and a few developer friends, then yes that'll work but it's unlikely to survive contact with the real world.

It does. I have 30 odd testers up and running.

[Christoph Hart]

@Orvillain you can sign AAX with a self signed bullshit certificate no need to give the mafia any money…

[Orvillain]

@Christoph-Hart said in Why I'm not making a Windows installer (nor code-signing):

@Orvillain you can sign AAX with a self signed bullshit certificate no need to give the mafia any money…

Interesting, I wasn't aware of that. More details would be lovely! Private message if you need to :-)

[David Healey]

@Orvillain said in Why I'm not making a Windows installer (nor code-signing):

Interesting, I wasn't aware of that. More details would be lovely! Private message if you need to :-)

https://forum.hise.audio/topic/14949/why-i-m-not-making-a-windows-installer-nor-code-signing/13?_=1785506496174