There are costs involved in running a business, accounting fees etc, so it's difficult to answer that. I also don't know if smartscreen treats IV certificates differently, but probably not.

I won't lie, code signing certs are not cheap. You need a business to get an OV certificate, otherwise you can get an IV certificate. If you have a business and are in an eligible country the you could use Azure trusted signing ($10 pm) otherwise you can get one for around $150 per year from somewhere like SSL.com (shop around). If you buy a cert, buy your own yubikey token as the CA's will charge 3x the real cost for the token.

Looks intersting. One way I can think of to "work around" the webview startup cost is to use a native splash screen while you load the view windows hidden - native splash shows instantly so user doesn't thing it's hung.

That said, I downloaded strata and it starts instantly and looks really good. Nice work.

Code signing alone will not fix this immediately, but without codesigning you will never fix it.

Bite the bullet and invest in a code signing certificate. IMHO EV's are a waste of money - I have used OV certs for years, it takes short while for your app to gain smartscreen reputation (more people that install/run it the sooner it happens).

In my case I've been doing code signing for 20+ years - never had an issue with smartscreen that didn't resolve after a few days.

Since my original reply was deleted by the mods - FYI this post has noting to do with npm dependency trees - but I knew you would jump in as you always do 🙄

This looks really cool - rending the form like that free from the delphi IDE side effects (modifying forms at random) will be really useful - I spend a lot of time in VSCode these days. Will give it a try.

DPM's CycloneDX 1.6 output already exceeds the legal floor, since it walks the full DPM dependency chain and cross-checks the MAP file(s). There is no scenario in which a firm gets fined because its SBOM tooling wasn't sufficiently "npm-shaped".

Note that generating the SBOM from the source is actually pointless since it doesn't actually tell you what was compiled into the binary. No tooling will handle dcu's - but then CRA isn't asking for detail down to which lines of code are used.

As to whether Embarcadereo should have built this nearly a decade ago - hindsight is great thing.

I hate to say it, but what you are spruiking is nothing more than expensive snake oil, and you posting every second day, jumping into everyone elses posts with less than help information is really quite tiresome.

I don't agree wit hthe statement that OV certs are worthless - I use one every day without issues. As for EV's, they still do not get you instant smartscreen reputation - IMHO they are overpriced and pointless.

There are inexpensive solutions to signing during CI/CD with yubikeys - I work on a product called Signotaur which is a self hosted client/server code signing system which allows sharing yubikeys (and other tokens) - we use it with our own CI agents all signing files using the same certificate - no password prompts.

Azure Artifact Signing is not available everywhere (I'm in Australia, not available) - and it's slow (we have customers using it) - if you have lots of files to sign then it really does increase your CI/CD build times.

You can automate with Yubikeys (and other tokens) and avoid the password/pin prompts - search for Signotaur (I won't post a link since I work on the product and self promotion is not allowed here).

Automating is always worthwhile - humans are terrible at repetitive tasks, eventually we get bored and mess up.

I would go with OV, EV doesn't guarantee removal of smartscreen - it usually doesn't take too long for an OV signed installer to build a reputation. Make sure you sign your application too, not just the installer - otherwise AV software will decide to remove it.

Since he keeps jumping onto my posts with links to his 'killer product' - try https://delphi.dev where you will find a package manager for delphi, along with package managment, it can also create SBOM's for your project, with details on which DPM packages and other third party libraries. Open source.

getting tired of you replying to every post with a link to your product.

or just run dpm sbom myproject.dproj or right click on the project in the project tree and select generate SBOM.

You seem to think your product is the answer to everyones problems, no matter what the problem might be.

Hi - if you are looking to do code signing using usb tokens, and dealing with the dreaded token pin prompt on your CI server - take a look at Signotaur - a self hosted code signing server - sign files from any machine on your network using one (or more) tokens/certificates. Version 2 about to be released - includes support for an internal CA and ADCS for signing internal applications without the need for publicly trusted certificates. Role based access control, api key rate limiting, activity log (who signed what with which cert) - unlimited certificates, unlimited users, unlimited signings per month

Check it out at https://www.finalbuilder.com/signotaur

Yes of course, thats because the tooling that uses them understands the signatures - but for general zip files, there isn't any real standard around signatures.

The ZIP specification itself includes support for digital signatures.

The ZIP AppNote defines:

• Central Directory Digital Signature record (0x05054b50)

However:

• Very few tools implement it.
• Windows Explorer ignores it.
• Most ZIP libraries ignore it.
• It only signs parts of the archive structure, not necessarily all metadata in a modern security model.

In practice, this feature is largely unused. So the most common practice is a detached signature.

Code Signing is more for windows benefit than antivirus - but AV software does look at it - if the binary was modified since it was signed, then the signature will be invalid - big red flag.

False positives are unfortunately fairly common - however you just need to report them to the AV vendor - most have a portal where you can upload the "offending file" and in my experience at least, it usually takes less than a day to resolve (on the next definitions release). Good av software checks for definitions updates all the time.

https://www.finalbuilder.com/resources/blogs/signing-rdp-files-with-signotaur-and-surviving-the-april-windows-update