[Info] SQLitePCLRaw.batteries_v2.dll ""blocked"" by Microsoft

[NewPublicUser]

Hi,

Just for your information, when this library is installed on a Windows system with:

Windows Security > App & browser control > Smart App Control settings > Enabled

Windows blocks the execution of the SQLitePCLRaw.batteries_v2.dll library because it cannot verify the publisher.

This basically happens because it is not signed (which is expected), and due to reputation. I understand that the more downloads you get, the less Windows will interfere over time, but you can also submit samples to Microsoft at:

If you need to report a false positive to Microsoft, go to this link:
https://www.microsoft.com/en-us/wdsi/filesubmission

Home User → Select Smart App Control → Upload file → Mark “Incorrectly detected as malware/malicious” → Continue

[utelle]

Just for your information, when this library is installed on a Windows system with:

Windows Security > App & browser control > Smart App Control settings > Enabled

Windows blocks the execution of the SQLitePCLRaw.batteries_v2.dll library because it cannot verify the publisher.

The reason is simply that the DLL is not signed.

Of course, I'd love to code sign all DLLs belonging to this project. However, at the moment I can't do it for the following reasons:

1. Buying a code signing certificate is expensive.
2. I provide the packages for free, and with a little luck, the donations users make could cover the cost of 2–3 cups of coffee a year (which is significantly less than what would be required for a code signing certificate).
3. Even if I could spare the money, it is really difficult to qualify for a code signing certificate as a private person.

The packages should continue to be available free of charge. So we would need a sponsor to provide the necessary funds for a code-signing certificate.

This basically happens because it is not signed (which is expected), and due to reputation.

Yes. And there is not much I can do about it.

I understand that the more downloads you get, the less Windows will interfere over time,

Since I started to publish my own NuGet packages roughly 6 months ago, I could observe about 15.000 downloads per NuGet package. However, the downloads are spread across several versions and likely come mostly from CI runs on GitHub or elsewhere.

but you can also submit samples to Microsoft at:

If you need to report a false positive to Microsoft, go to this link: https://www.microsoft.com/en-us/wdsi/filesubmission

Most likely, this process would have to be repeated for every new release and for every included DLL. Sorry, that won't happen.

Beginning with the release of version 2.3.4 I started to generate GitHub attestations, so that everyone can verify that the packages originate from GitHub workflows. That's all I can do for now.

If you want that to change, find a sponsor for a code signing certificate or become one yourself.