Microsoft Defender SmartScreen flags installer as unrecognised app

[Robert]

Hi,

this appears to be a long standing problem which could put off new users?

Here is the message I see after running the installer:

------------

Windows protected your PC

Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk

-------------

I have checked a installers eg. 3.2.6-1 x64, 3.2.6-1 x32, 3.1.6-1 x64 and they are all have the same issue.

What do you think?

I suggest changing the page https://rubyinstaller.org/ to mention this.

e.g. something like:

***

"Note that Windows Defender SmartScreen will flag the installer as unrecognised and will prevent the app from starting. This is because Microsoft is trying to protect you from malicious apps. Unfortunately, Microsoft also requires organisations to pay for validation. 

Please click the box "More info" and then "Run anyway" to install. If you are concerned about whether the installer has been tampered with you can verify the PGP signature of the download.

***

Thanks,

Robert

[Lars Kanis]

Hi Robert,

I sign all RubyInstaller releases since 2018 with my certificate. This dropped issues with anti virus a lot. See here: https://github.com/oneclick/rubyinstaller2/issues/120

You can verify the signature in the file properties of the installer exe. It should have a valid signature of "Open Source developer Lars Kanis"

Is it valid on your system? How about the latest installer 3.3.6-2? Or are only older releases affected?

--

Regards, Lars

Am 29.11.24 um 04:20 schrieb Robert:

--
You received this message because you are subscribed to the Google Groups "RubyInstaller" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rubyinstalle...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/rubyinstaller/85385ddf-8af0-46d0-ad24-4afa3bcada09n%40googlegroups.com.

[Robert]

Hi Lars, 

thanks for your reply. 

Yes the latest 3.3.62 installer is being flagged as unrecognised.

When I look at the digital signature for rubyinstaller-3.3.6-2-x64, it does indeed seem to show you do have a valid signature:

Signer info: Open Source Developer, Lars Kanis

Certificate info: Certum Code Signing 2021 CA

Valid from: 21/10/24 to 21/10/25

I notice that when I click on file properties->digital signatures->details->view certificate there is a button at the bottom of the dialog box which says "Install Certificate".

Here is a screenshot:

https://imgur.com/a/wRx0WXc

Surely Windows doesn't require a user to manually add a certificate via this button before installing software?

Or does it?  :-)

Regards, 

Robert

[Lars Kanis]

Installing the certificate is only a way to extract the certificate from the exe file. It is not necessary.

Regards, Lars

To view this discussion visit https://groups.google.com/d/msgid/rubyinstaller/372c013c-fd20-4bbe-9bbc-3514af755fd6n%40googlegroups.com.

[Mohit Sindhwani]

Hi Lars, Robert,

On 2024-12-1 2:00 pm, Robert wrote:
> Hi Lars,
>
> thanks for your reply.
>
> Yes the latest 3.3.62 installer is being flagged as unrecognised.
>
> When I look at the digital signature for rubyinstaller-3.3.6-2-x64, it
> does indeed seem to show you do have a valid signature:
>
> Signer info: Open Source Developer, Lars Kanis
> Certificate info: Certum Code Signing 2021 CA
> Valid from: 21/10/24 to 21/10/25
>

I do see the SmartScreen and it shows as Unrecognised but shows your
details in the [More Details] part. I have this documented on the
installation instructions on my page:
https://notepad.onghu.com/2023/ruby3.3-windows-day0-install-hello_world/
(all screenshots in the post)

I can change the note a bit on my page if it helps? Also, of course, if
needed, on the RubyInstaller page?

Best regards,
Mohit.