Why I'm not making a Windows installer (nor code-signing)

[dannytaurus]

For context, on the Mac side (my daily development platform):

Gatekeeper flat out refuses an unsigned, un-notarized plugin, so there's no ZIP escape hatch like on Windows. And yet it was the easy half. Not painless in the Apple way of things, but genuinely quick, and available to me as an individual with no company.

Apple Developer account. $99 a year, open to individuals anywhere. No company registration, no face scan theatre, just an Apple ID and standard identity verification. This is the thing Microsoft's equivalent (Azure Trusted Signing) doesn't offer UK individuals, and it's the whole reason the Mac release was unblocked while the Windows one needed a workaround.

Certificates. The account gets you two Developer ID certs: Application (signs the plugin bundles) and Installer (signs the pkg). Generated once through the developer portal, installed into the keychain, done.

Signing and notarization. This part is scripted and runs as part of my build: codesign each bundle with the hardened runtime enabled, submit to Apple's notarization service with notarytool, staple the ticket. Notarization sounds scary but it's an automated malware scan on Apple's servers that takes a few minutes and gives you an answer, not a reputation system you wait months to accrue. Once it passes, users see zero warnings, forever, on every machine. That's the deal Windows code signing doesn't offer even when you pay: on Windows a fresh cert still has to earn SmartScreen reputation over time. Meh.

The installer. I used Package Builder ($30 Mac app) rather than the free Packages app or hand-writing pkgbuild scripts. Drop in the AU and VST3, select "Code Sign and Notarize" with the Developer ID Installer cert and your Apple ID. It signs the pkg and submits it for notarization itself, so the installer comes out fully cleared, not just the plugins inside it. Awesome.

So the finished state is lopsided but works for me. Mac: signed, notarized, one pkg, double-click, no warnings. Windows: ZIP and a one-line readme. The platform that mandates signing made it a solved problem for an individual developer in an afternoon for $99 a year. The platform where signing is optional made it annoying enough to avoid shipping an executable at all.

[David Healey]

@dannytaurus said in Why I'm not making a Windows installer (nor code-signing):

SmartScreen reputation still builds up gradually per certificate.

This is now the case for all signing options include EV. The only exception is Microsoft store publishing. Really annoying, but I think my EV certificate still gives me instant rep because I bought it pre-2024

[digi]

Jeez, this sounds like a PITA. I'm making a guitar plugin atm, but I have a standalone build too...

[DanH]

@dannytaurus I think in 5 years I’ve only ever had one complaint about the smart screen. Users must be pretty used to it.

[dannytaurus]

@DanH Agreed, especially music producers who might be downloading and installing free and shady plugins from all over the place. They know how to do the 'install anyway' dance.

But for my first plugins (fully self-contained VST3) the ZIP method is same-effort for the end user. Anyone used to breezing past the 'install anyway' screens also knows how to drop a VST3 into the system folder.

Like I said, when I register as a limited company, I'll definitely do Azure code-signing and make a proper installer (and no Unknown Publisher screen). I just need to register the limited company before shipping plugins with sample archives or expansions.

[David Healey]

@dannytaurus said in Why I'm not making a Windows installer (nor code-signing):

I just need to register the limited company before shipping plugins with sample archives or expansions.

You probably already know this, but being a limited company (especially as a sole director) gives some nice tax advantages.

[dannytaurus]

@David-Healey Yeah, even though the UK government is doing all it can to erode them away year after year

Aside from tax efficiency, the main reasons I'm doing it are for plugins:

1. Ability to use Azure cloud-signing on Windows, and
2. Ability to have Meat Beats Ltd as my Apple signing ID instead of my full name.

[Orvillain]

haha. Wait until you need to support AAX. Now that is a proper headf**k !!!

My current approach is, locally I'm building an inno installer for windows and accepting the smartscreen issue for now. On Mac I'm building a pkg, and my post-install script runs a quarantine flag removal on the installed vst3 file. It seems to be working for some alpha testing.

Eventually I need to jump through all of the hoops to get codesigning up and running and a proper CI system - was thinking Github actions. Then it can all just live in one place, I click a button, and I get a build from whatever branch I choose.

[dannytaurus]

@Orvillain I'll never support AAX. My audience simply doesn't live there. Thank goodness!

On Mac I'm building a pkg, and my post-install script runs a quarantine flag removal on the installed vst3 file. It seems to be working for some alpha testing.

If by alpha testing, you mean on your own machine and a few developer friends, then yes that'll work but it's unlikely to survive contact with the real world.

Fortunately the macOS side is the easiest to solve. Get a $99/year developer account, get your App and Installer signing certs and apply them during the export and packaging phase. Extremely easy.

[David Healey]

@dannytaurus The same certificate can be used for AAX on both macOS and Windows too.

[Lindon]

@David-Healey said in Why I'm not making a Windows installer (nor code-signing):

@dannytaurus The same certificate can be used for AAX on both macOS and Windows too.

Windows too? How?

[David Healey]

@Lindon You can export the certificate from macOS certificate manager (something like a .pfx file, can't remember the extension exactly). This can then be imported on Windows.

It cannot be used to get past smart-screen but it can be used to sign AAX plugins if you don't have a Windows signing certificate. You can also use a self-signed certificate for this purpose. Pro-tools doesn't mind. If you're using iLok though then you probably need a proper certificate.

Covered in my Packaging workshop too: https://audiodevschool.com/courses/packaging-for-windows/

[Lindon]

@David-Healey I was looking for a simple one-man-band way to get past the windows "smart screen" - but thanks anyway....