Skip to content

UNSIGNED.md

Latest commit

 

History

History
136 lines (94 loc) · 5.15 KB

UNSIGNED.md

File metadata and controls

136 lines (94 loc) · 5.15 KB
Raw

Running SimpleCue — Gatekeeper, SmartScreen and firewalls

macOS builds are signed and notarised, so they just open. The Windows builds are unsigned and SmartScreen will object once. This page covers that, the firewall prompts, and how to verify a download.

Why the Windows builds are unsigned

macOS signing is covered: this project carries an Apple Developer Program membership and a Developer ID Application certificate, and every macOS artefact is notarised by Apple.

Windows is not. An Authenticode certificate (OV, or EV to skip building SmartScreen reputation) runs ~$200-500/year, and the certificate authorities will only issue one to a registered legal entity — which this project is not. Nothing is wrong with the Windows downloads; Windows simply has no publisher identity to check them against, so it assumes the worst once and then remembers your answer.

If you'd rather not trust a stranger's binary at all, every release is reproducible from source — see the build instructions in the README.

macOS — nothing to do

Every macOS artefact is Developer ID-signed, notarised by Apple and stapled, so it opens on a double-click with no warning and no quarantine step. That covers the nested helper binaries inside the bundle too, which is what the old right-click-Open workaround never did.

To confirm it for yourself:

spctl -a -vv -t install "/Applications/<app>.app"
# accepted / source=Notarized Developer ID

Windows — SmartScreen

"Windows protected your PC — Microsoft Defender SmartScreen prevented an unrecognised app from starting." Click More info, confirm the publisher line reads Unknown publisher, then Run anyway.

To clear the mark-of-the-web before running instead — useful when the block is silent rather than a prompt:

Unblock-File .\<file>.exe

Or right-click the file → Properties → tick Unblock → OK. If you downloaded a .zip, unblock the .zip first, then extract — otherwise every extracted file inherits the flag and you'll be unblocking them one at a time.

Defender antivirus false positives

Unsigned binaries that bundle a runtime occasionally get quarantined outright by Defender's heuristics rather than merely warned about. If the download vanishes from your Downloads folder, check Windows Security → Virus & threat protection → Protection history and choose Restore. Add an exclusion for the install folder if it keeps happening.

Windows — Defender Firewall

SimpleCue listens on the network, so the first time it starts Windows shows:

Windows Defender Firewall has blocked some features of SimpleCue Allow it to communicate on these networks: ☐ Private ☐ Public

Tick Private networks — and Domain networks too if the machine is on a managed domain. SimpleCue needs this to receive OSC, MIDI Show Control, MMC and Art-Net/sACN control.

If you deny it (or the prompt appears behind another window and times out), incoming show control is silently dropped — cues will only fire from the local UI

Leave Public unticked unless you know you need it — that profile covers untrusted networks like conference or hotel Wi-Fi.

If you already clicked Cancel

The prompt does not come back. Fix it in Windows Security → Firewall & network protection → Allow an app through firewall → Change settings, find the entry, tick Private. If SimpleCue isn't listed, Allow another app… → Browse to the .exe.

Or from an elevated PowerShell:

New-NetFirewallRule -DisplayName "SimpleCue" -Direction Inbound -Program "C:\Path\To\SimpleCue.exe" -Action Allow -Profile Private,Domain

To remove a bad rule and get the prompt back on next launch:

Get-NetFirewallRule -DisplayName "*SimpleCue*" | Remove-NetFirewallRule

macOS and Linux firewalls

macOS shows an equivalent one-off prompt — "Do you want the application to accept incoming network connections?" — click Allow. It's under System Settings → Network → Firewall → Options if you need to change it later. On Linux nothing prompts; if you run a firewall, open the ports yourself (ufw allow <port>/udp, since OSC, Art-Net and sACN all arrive over UDP).

Linux

No signing gate. Make the binary executable if you took the tarball:

chmod +x ./SimpleCue

The Linux builds only come as a tarball. There's no .deb or .rpm to sign.

Signing it yourself

Windows — Authenticode

signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 `
  /f mycert.pfx /p <password> .\<file>.exe

An OV certificate still needs to build SmartScreen reputation over time; an EV certificate is trusted immediately. Neither is free.

Verifying a download

Signing proves who built it; a checksum proves you got what they built — worth doing even unsigned. Compare against the SHA-256 shown beside each file on the release page:

shasum -a 256 <file>        # macOS / Linux
certutil -hashfile <file> SHA256   # Windows

You can also confirm the artifact came from this repo's CI by checking the release page it was downloaded from — GitHub shows the workflow run that produced each asset.