Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Windows binaries are unsigned — blocked by Smart App Control / SmartScreen

Aperta
  • Qualcosa non va?
#1,505 1 commento 3 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
github-actions, go
Ambito
build-system, release, security

Direzione di ricerca

Inizia con .goreleaser.yaml e .github/workflows/release.yml, confrontando i passaggi esistenti di firma e notarizzazione di darwin con le build Windows. Traccia il modo in cui GitHub Releases, l’installer di entire.io e Scoop ricevono l’eseguibile. Il lavoro è completato quando gli artefatti Windows ufficiali entire.exe sono firmati con Authenticode e possono essere avviati su Windows 11 con Smart App Control in modalità Enforce.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What happened?

On Windows 11 with Smart App Control (SAC) in Enforce mode, the unsigned entire.exe (~48 MB Go binary) is killed on launch with:

An Application Control policy has blocked this file
... did not meet the Enterprise signing level requirements

The blocking policy GUID is {0283ac0f-fff1-49ae-ada1-8a933130cad6} — the built-in Smart App Control policy. Because Git hooks spawn a fresh entire process on every relevant action, every new entire process fails once SAC enforces. (A long-running background process started before enforcement can keep working from memory until the next reboot, which is why it looks like "it worked yesterday, broken today.")

Root cause

entire.exe is shipped unsigned. The release pipeline only signs macOS binaries:

  • .goreleaser.yaml / .github/workflows/release.yml apply Developer ID signing + notarization for darwin builds only. There is no Authenticode signing step for the windows builds.
  • GitHub Releases, the entire.io installer, and the Scoop bucket all distribute the same unsigned exe, so reinstalling / switching channels does not help.

Smart App Control only allows binaries that are signed or that have an established Microsoft cloud reputation. A new, unsigned, low-reputation Go binary evaluates to zero reputation and is blocked. Unlike AppLocker / WDAC, SAC has no per-file allowlist — the only way to run an unsigned binary is to turn SAC off entirely, which is irreversible (SAC cannot be re-enabled without reinstalling Windows) and disables OS-wide malware protection. So "allow just this exe" is not possible for affected users.

SAC auto-promotes itself from evaluation mode (state=2) to enforce mode (state=1) on its own ML-driven schedule with no user action and little notice, so this can hit any new Win11 machine at an arbitrary time.

Steps to reproduce

  1. Fresh Windows 11 install with Smart App Control left at the default (evaluation mode, which later auto-promotes to Enforce).
  2. Install entire (Scoop / entire.io installer / GitHub Releases download).
  3. Once SAC is in Enforce mode, run any command or trigger a Git hook that spawns entire.exe.
  4. The process is blocked: An Application Control policy has blocked this file.

Expected behavior

The official Windows entire.exe should run on a default Windows 11 machine without requiring the user to disable Smart App Control.

Suggested fix

Add Authenticode code signing for the Windows binaries in the release pipeline (mirroring the existing macOS Developer ID + notarization flow). An EV / Azure Trusted Signing certificate establishes SmartScreen/SAC reputation immediately, which is what SAC requires.

Current workaround

The only workaround today is disabling Smart App Control — which is irreversible and removes OS-wide protection. Not acceptable as a long-term answer for a single CLI.

Environment

  • OS: Windows 11, Smart App Control = Enforce (state 1)
  • Install: Scoop / entire.io / GitHub Releases (all ship the same unsigned exe)
  • Binary: entire.exe, unsigned (NotSigned)
Lingua principale
Go
Stelle
5.1k
Fork
475
Merge medio
1g 17h
PR unite (30g)
208

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di entireio/cli

Tutte le issue di entireio/cli

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.