search

BitBoxSwiss / bitbox-wallet-app

The BitBoxApp for desktop and mobile.
https://bitbox.swiss/app
Apache License 2.0
251 stars 82 forks source link

Digitally sign the Windows binaries #2808

Open pebroz opened 1 month ago

pebroz commented 1 month ago

BitBox.exe on Windows is not digitally signed, new releases are thus blocked for a period of time by antimalware and security products. In my case the attack surface reduction rules within Microsoft Defender prevents running the program due the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion".

The setup program is already signed, aswell as the bundled libraries and Qt binaries. Version BitBox-4.43.0-win64

sveroa commented 1 month ago

Same issue her

benma commented 1 month ago

Thanks for the report.

Is this a new issue? We've always only ever signed the installer executable and never heard of this problem before.

pebroz commented 1 month ago

Has existed for some time for me. Companies are increasing cyber security, so more of an issue with companies. This is not enforced in Windows consumer editions by default yet. After enough intelligence has been gathered the binary will eventually run, but it means a delay before I can use new releases.

Unsigned is even worse on Apple, I propose the binary get signed. Just checking the installer does little for at runtime or after install modification of the BitBox client.

benma commented 1 month ago

Thanks for the hint. on macOS we sign the .app folder using codesign before creating the installer.

I'll see if I can sign the BitBox.exe too.

sveroa commented 1 month ago

It seems like most executables should be signed....I'm getting the block message on the uninstall.exe as well

Rule: "Block executable files from running unless they meet a prevalence, age, or trusted list criteria"