Support signed Windows msi installer

[ekrich]

I am on a typical corporate network and unable to install the MSI even via an elevated permissions shell at the command line.

Windows protected your PC
Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.

App: 
scala-cli-x86_64-pc-win32.msi 
Publisher:  
Unknown publisher 

I believe we need a signed MSI as talked about in the following link:

https://www.scala-sbt.org/sbt-native-packager/formats/windows.html

[bjornregnell]

This would be very good to have!

[lwronski]

@ekrich
Kind of late answer, but can you try to install scala-cli in version 0.1.10 via MSI installer in typical corporate network ? You can find here MSI installer of Scala CLI 0.1.10.

We processed verification of scala-cli 0.1.10 MSI installer in Windows Defender and I hope, it should work now.

[ekrich]

Sure, I can try when I get back to the office next week and any details on other methods that may have worked.

[ekrich]

@lwronski That version, https://github.com/VirtusLab/scala-cli/releases/tag/v0.1.10, allows the installer to run but then I don't have admin privileges so I can't install, even into my home directory. We could request to get scalacli approved if the installers can be signed on each release - that may be the easiest. Otherwise an installer like "Git for Windows" that allows local (into user) install without enhanced privileges.

We are also still having a coursier redirect basic auth proxy issue which I haven't had a chance to look into yet which makes Metals and other tools not function when on the network.

I was able to get scalacli installed via sdkman but with some difficulty and running some commands locally.

Edit: I can post the sdkman details but I am not sure who prepares those release or where I should do that.

[Gedochao]

We sign each subsequent release at this point, so the issue shouldn't be present.
The verification process with Microsoft sometimes takes up to even 2 weeks after a relase, so please remember to be patient (although sometimes it gets approved on the same day, that process is outside of our control).
Issues with proxies are tracked elsewhere: #1109
Closing this.

[SethTisue]

@Gedochao on scala/scala3#22711 you wrote:

Also the msi is not signed

We hope to resolve this part when we can. Efforts are in progress.

So I'm confused to come to this ticket and see it closed as completed? Am I misunderstanding something?

[Gedochao]

@SethTisue Right. We don't exactly 'sign' the MSI per se for Windows, as that would require having a dedicated MS org with the right permissions.Which is something that was discussed on Scala Core in the past, and certain processes are underway to make the related bureaucracy happen eventually, AFAIK.
Tagging @sjrd who might know more regarding how far are we with that (if I remember correctly, we expect it to still take a while).

As for what we are actually doing - instead of signing the MSI (which would solve all problems for Windows users), we verify it with MS, so that Windows doesn't flag it as malicious. The major downside of that approach (beyond it still not being signed with MS) is that the verification takes up to 30 days, during which users may still get the installer flagged by their system. The main merit of this approach is that it doesn't require any red tape or setup.

You can find docs on how we verify our stuff in here: https://github.com/VirtusLab/scala-cli/blob/main/.github/release/windows-antimalware-analysis.md

All of the above also applies to the Scala 3 language installer, which we ship with the language since Scala 3.6.2: https://github.com/scala/scala3/releases/tag/3.6.2

[bjornregnell]

and certain processes are underway to make the related bureaucracy happen eventually, AFAIK

If we could get proper MS signing it would be really fantastic for all Windows users of Scala! An example: around 90% of my students are on Windows and for 200+ Scala beginners each year here at Lund University would benefit greatly from this, and I guess it may be a similar situation around the planet wherever programming beginners are approaching Scala on Windows. (Non-beginners in programming probably can get around this, but complete beginners often need help from another person (teaching assistant in my case) to get around all warnings and clicks, and with proper signing more will manage on their own...)

[bjornregnell]

So perhaps re-open this and close when full signing is in place?

[Gedochao]

Please note that Windows only complains about it if you download the .msi manually, rather than via a package manager. And then, only if the <=30 days until verification is completed have not yet elapsed.

That being said, sure, let's reopen and track the Scala CLI side of things here.
Just be aware that it's a "done when it's done" thing, that isn't fully within our control when it'll happen.
I believe we closed back in the day, as the installer verification was deemed sufficient.