* the first one comes from Edge, as it flags the file as "unsecure download" -- I suspect Edge is more careful about "new files" that it sees, and displays the warning. If the user runs the file, Edge will send the files hash to its servers, and if enough users download it, it will stop displaying the warning, assuming it is safe.
* the second one is the "This file is downloaded from the internet" warning, which is displayed for any file downloaded from the internet. The warning is displayed for files which have an "Alternate Data Stream" and an ADS is created on download. You can look at the alternate data streams using the "dir /r" command. For racket it shows that it has a "Zone.Identifier" alternate data stream:
dir /r racket-8.0-x86_64-win32-cs.exe
Volume in drive C is Windows
Directory of C:\Users\aharsanyi\Downloads
02/15/2021 01:24 PM 181,647,576 racket-8.0-x86_64-win32-cs.exe
159 racket-8.0-x86_64-win32-cs.exe:Zone.Identifier:$DATA
1 File(s) 181,647,576 bytes
0 Dir(s) 235,121,123,328 bytes free
The ADS can be opened as a file in notepad using: "notepad.exe racket-8.0-x86_64-win32-cs.exe:Zone.Identifier", which for Racket contains:
There are tools to remove these alternate data streams, the ADS will be created on download and the user has to either explicitly remove it or deal with the warning dialog. ZoneID=3 means the file is from the "internet", ZoneID=2 would mean that it comes from a list of "trusted sites" and ZoneID=4 indicates that the file comes from sites that have been identified as malicious. The zone comes from the Windows internet settings. Not sure if it is affected by the file being signed with an EV certificate.
* the third dialog shows up when the application wants to install for all users, this is the "this software wants to make changes to your computer..." warning. The warning shows up for all software which requests elevated privileges, but the header of the dialog is blue for signed applications and yellow for unsigned ones (I assume it would be red for software which is identified as bad, but I have never seen that). This dialog does not show up if you try to install the application for the local user only, but of course, in such a case, the application is only available for the current user.
Alex.