Windows: unsigned by decision; the installer warns about Smart App Control (#264)

moho will not be code-signed. Windows 11's Smart App Control refuses to
start an unsigned program at all - moho installs, then never opens, with
no message - while the installer itself is let through. So the installer
now reads Smart App Control's state and, when it is on, says before
installing that moho will not start, where to turn it off, and that
Windows will not let it back on without a reset; OK installs anyway,
Cancel leaves nothing behind.

The README and the rolling release's notes say the same, with the
SmartScreen "More info > Run anyway" / Unblock step.

Checked on the Windows VM (Smart App Control enforcing): the warning comes
before the first page, and Cancel quits with nothing installed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/rolling-release.yml

@@ -553,9 +553,13 @@ jobs:
             echo "Each carries the \`nobilis\` daemon built alongside it, so the app and"
             echo "the daemon in one download always match."
             echo
-            echo "**The Windows installer is unsigned**, and cross-built with mingw."
-            echo "SmartScreen will warn on first run, and it is right about what it"
-            echo "knows: there is no certificate on it."
+            echo "**The Windows installer is not code-signed**, and cross-built with mingw."
+            echo
+            echo "- SmartScreen warns when you run it: choose *More info*, then *Run anyway*."
+            echo "- If Windows 11's **Smart App Control** is on, moho will install and then"
+            echo "  never open - it blocks every unsigned program, silently. Turn it off in"
+            echo "  *Windows Security > App & browser control > Smart App Control settings*."
+            echo "  The installer checks and warns before installing."
             echo
             echo "Not a versioned release, and no stability promise."
           } > "$RUNNER_TEMP/notes.md"

README.md

@@ -47,8 +47,16 @@ Prebuilt Linux and Windows downloads are on the
 on every change.
 
 The AppImage needs `libfuse2` on recent distributions; if it refuses to start, either install
-that or run it with `APPIMAGE_EXTRACT_AND_RUN=1`. The Windows installer is unsigned and
-cross-built, so SmartScreen will warn on first run.
+that or run it with `APPIMAGE_EXTRACT_AND_RUN=1`.
+
+The Windows installer is not code-signed, and won't be. Two things in Windows react to that:
+
+- **SmartScreen** warns when you run the downloaded installer. Choose *More info*, then
+  *Run anyway* - or beforehand, right-click the file, open *Properties* and tick *Unblock*.
+- **Smart App Control**, on some fresh Windows 11 installs, silently refuses to start any
+  unsigned program: moho installs, then never opens. Turn it off in *Windows Security > App
+  & browser control > Smart App Control settings*. Windows does not let it be switched back
+  on without resetting the PC. The installer checks for this and says so before installing.
 
 ## Build it
 

build/installer.nsh

@@ -25,6 +25,26 @@ Var pid
   !insertmacro _CHECK_APP_RUNNING
 !macroend
 
+; moho is not code-signed, and Windows 11's Smart App Control refuses to
+; start an unsigned program at all - no window, no error, nothing - while
+; this installer itself is let through. So the install would succeed and the
+; app would then silently never open (#264). Said here instead, before
+; anything is installed: what to switch off and where, or stop.
+;
+; VerifiedAndReputablePolicyState: 0 off, 1 on, 2 evaluating. Only "on"
+; blocks; an evaluating machine runs moho, and Windows may later switch
+; Smart App Control off by itself on a machine like that.
+!macro customInit
+  ReadRegDWORD $0 HKLM "SYSTEM\CurrentControlSet\Control\CI\Policy" "VerifiedAndReputablePolicyState"
+  ${if} $0 == 1
+    MessageBox MB_OKCANCEL|MB_ICONEXCLAMATION \
+      "Smart App Control is on, and it will stop moho from starting.$\r$\n$\r$\nmoho is not code-signed, and Smart App Control blocks every program that is not - silently, with no message. To use moho, turn it off:$\r$\n$\r$\n    Windows Security > App & browser control > Smart App Control settings > Off$\r$\n$\r$\nWindows does not let Smart App Control be switched back on without resetting the PC.$\r$\n$\r$\nOK to install anyway (turn it off before opening moho), or Cancel." \
+      /SD IDOK IDOK mohoSacContinue
+      Quit
+    mohoSacContinue:
+  ${endIf}
+!macroend
+
 ; What the program leaves outside its own folder. Not touched by an upgrade,
 ; which runs the old uninstaller too (isUpdated): a new version keeps
 ; everything the old one had.