make screenpipe not killed / deleted by windows defender ($150)

[louis030195]

/bounty 150

not sure why, check tauri discord they have some conversation about it, maybe need windows signing

https://tauri.app/v1/guides/distribution/sign-windows

[linear]

MED-99 make screenpipe not killed / deleted by windows defender ($100)

[algora-pbc]

💎 $150 bounty • Screenpi.pe

Steps to solve:

1. Start working: Comment /attempt #321 with your implementation plan
2. Submit work: Create a pull request including /claim #321 in the PR body to claim the bounty
3. Receive payment: 100% of the bounty is received 2-5 days post-reward. Make sure you are eligible for payouts

Thank you for contributing to mediar-ai/screenpipe!

Add a bounty • Share on socials

Attempt	Started (GMT+0)	Solution
🟢 @Neptune650	Oct 8, 2024, 5:40:16 PM	#740

[daveads]

@louis030195 Did some research a code signing certificate is actually required for this... And it isn't really free

• https://about.signpath.io/
• https://codesigningstore.com/

https://federicoterzi.com/blog/automatic-codesigning-on-windows-using-github-actions/

[kerosina]

@louis030195 Did some research a code signing certificate is actually required for this... And it isn't really free

• https://about.signpath.io/
• https://codesigningstore.com/

https://federicoterzi.com/blog/automatic-codesigning-on-windows-using-github-actions/

Since this is an open source project, you can get signing for free
https://about.signpath.io/product/open-source
However, signed builds are built from the public repo and must be built through their CI.

[kerosina]

if for some reason you don't qualify for SignPath's free signing and you only care about Windows Defender, you can submit the builds to Defender XDR with a description about the program. My program was incorrectly marked as malicious by Defender, and by submitting it there, explaining what the program did, I got defender to remove the false positive, so its worth a try.

[daveads]

@louis030195 Did some research a code signing certificate is actually required for this... And it isn't really free

• https://about.signpath.io/
• https://codesigningstore.com/

https://federicoterzi.com/blog/automatic-codesigning-on-windows-using-github-actions/

Since this is an open source project, you can get signing for free https://about.signpath.io/product/open-source However, signed builds are built from the public repo and must be built through their CI.

cool

[kerosina]

@louis030195 contact signpath here, as screenpipe seems fill the requirements for free signing https://about.signpath.io/product/open-source

[nerdynomadd]

Since the requirements to storing Private Keys for Code Signing Certificates were updated in June 2023, the new security practice (and requirement) is to store it on a hardware token secured for that purpose. As far as I know, it is no longer possible to purchase Code Signing Certificates and integrate them directly into the CI without using a Cloud solution.

As this project is backed by a company, it should be suitable to apply to a regular code signing certificate.

CodeSigningStore provides cheap code signing certificates, and an access to DigiCert One (https://www.digicert.com/digicert-one).
An alternative solution would be Azure Trusted Signin solution (https://azure.microsoft.com/en-us/products/trusted-signing), which is also cheap but on a based monthly payment.

If you decide to opt for one of these two solutions, I could write the CI part, as I already have the code to integrate these cloud services.

[louis030195]

i received an OSS certificate from signpath btw, if anyone wants to help, dont have the bandwidth to work on this

i can share the cert somehow i guess

[Neptune650]

/attempt #321
@louis030195 I can do this as it's simple GitHub Actions work, I need you to send over the certificate (.cer) and the private key (.key) to neptune650@proton.me and by following the guide you've sent.

As for #435 it is being worked on, currently I'm working on fixing some issues regarding Rusty V8 build, because they don't provide pre-built binaries for Windows ARM64 - however this can make build time considerably longer, tell me your thoughts.

Algora profile	Completed bounties	Tech	Active attempts	Options
@Neptune650	1 bounty from 1 project	C++, C, Python & more		Cancel attempt