Sign the Windows Installer

[GyulyVGC]

We should sign the Windows Installer to increase the overall trust in the project, and to get rid of this annoying message:

---

This was delayed for a long time since code signing certificates are quite expensive.

However, as @celtic-coder mentioned in #252:

Perhaps you can check out SignPath for Open Source projects?

[GyulyVGC]

@all-contributors please add @celtic-coder for ideas.

[allcontributors]

@GyulyVGC

I've put up a pull request to add @celtic-coder! 🎉

[GyulyVGC]

This finally happened thanks to the @SignPath foundation 🎉

---

For future reference I'll leave here a message I received from a member of their team concerning that installation warnings still may appear for a period of time, even if the Installers will be now signed starting from version 1.4.1:

About the Smartscreen Warning:

Yes, even after signing with our OSS certificate, it's still possible that Microsoft SmartScreen will display a warning, especially for new or rarely downloaded applications. This is not a reflection of the signature's validity, but rather how SmartScreen reputation works.
To clarify:

• SmartScreen uses a reputation-based system that takes into account things like the number of downloads, file history, and publisher reputation.
• Signing the application is the first and most important step toward building that reputation.
• Over time, as more users download and run your application, SmartScreen warnings typically disappear over time.

Unfortunately, there’s no way to immediately “pre-clear” or bypass SmartScreen via code signing alone, not even with a commercial EV certificate. Since newly issued certificates (including for OSS projects) start with zero reputation, SmartScreen may still flag them at first. But a valid digital signature does help users verify authenticity and should eventually allow SmartScreen to recognize the application as trustworthy.

That said, Microsoft also allows developers to manually submit their signed files for review. This can help accelerate the process:

• You can go to the Windows Defender Security Intelligence portal:
  • https://www.microsoft.com/en-us/wdsi/filesubmission
• Submit your signed installer or executable for analysis.
• There is also a feedback option for SmartScreen alerts, which can be helpful for reputation building.