[Info] SQLitePCLRaw.batteries_v2.dll ""blocked"" by Microsoft

[NewPublicUser]

Hi,

Just for your information, when this library is installed on a Windows system with:

Windows Security > App & browser control > Smart App Control settings > Enabled

Windows blocks the execution of the SQLitePCLRaw.batteries_v2.dll library because it cannot verify the publisher.

This basically happens because it is not signed (which is expected), and due to reputation. I understand that the more downloads you get, the less Windows will interfere over time, but you can also submit samples to Microsoft at:

If you need to report a false positive to Microsoft, go to this link:
https://www.microsoft.com/en-us/wdsi/filesubmission

Home User → Select Smart App Control → Upload file → Mark “Incorrectly detected as malware/malicious” → Continue

[utelle]

Just for your information, when this library is installed on a Windows system with:

Windows Security > App & browser control > Smart App Control settings > Enabled

Windows blocks the execution of the SQLitePCLRaw.batteries_v2.dll library because it cannot verify the publisher.

The reason is simply that the DLL is not signed.

Of course, I'd love to code sign all DLLs belonging to this project. However, at the moment I can't do it for the following reasons:

1. Buying a code signing certificate is expensive.
2. I provide the packages for free, and with a little luck, the donations users make could cover the cost of 2–3 cups of coffee a year (which is significantly less than what would be required for a code signing certificate).
3. Even if I could spare the money, it is really difficult to qualify for a code signing certificate as a private person.

The packages should continue to be available free of charge. So we would need a sponsor to provide the necessary funds for a code-signing certificate.

This basically happens because it is not signed (which is expected), and due to reputation.

Yes. And there is not much I can do about it.

I understand that the more downloads you get, the less Windows will interfere over time,

Since I started to publish my own NuGet packages roughly 6 months ago, I could observe about 15.000 downloads per NuGet package. However, the downloads are spread across several versions and likely come mostly from CI runs on GitHub or elsewhere.

but you can also submit samples to Microsoft at:

If you need to report a false positive to Microsoft, go to this link: https://www.microsoft.com/en-us/wdsi/filesubmission

Most likely, this process would have to be repeated for every new release and for every included DLL. Sorry, that won't happen.

Beginning with the release of version 2.3.4 I started to generate GitHub attestations, so that everyone can verify that the packages originate from GitHub workflows. That's all I can do for now.

If you want that to change, find a sponsor for a code signing certificate or become one yourself.

[avidenic]

Can I suggest https://signpath.org/ ? OSS gets free signing service.

[utelle]

Can I suggest https://signpath.org/ ? OSS gets free signing service.

Thanks for your suggestion. I have to check whether my related GitHub projects (SQLite3MultipleCiphers, SQLite3MultipleCiphers-cb, and SQLite3MultipleCiphers-NuGet) all meet SignPath's requirements and restrictions. Most likely some adjustments would have to be made.

[avidenic]

Awesome, looking forward to next steps!

[utelle]

Awesome, looking forward to next steps!

The projects SQLite3MultipleCiphers-cb and SQLite3MultipleCiphers-NuGet) are already in good shape, because the build process is already fully automated.

However, in project (SQLite3MultipleCiphers updates to new SQLite versions are done manually up to now - simply, because quite frequently the upstream changes require manual adjustments.

I will now start to automate the build process with GitHub workflows. As soon as I have the parts relevant for the other projects ready, I will apply for free code signing at SignPath.

[utelle]

I applied for free signing service at SignPath and I was informed that they will now review the project with a focus on security-related aspects and the project’s reputation. So, let's wait and see what the outcome will be.

In the meantime I worked on improving my GitHub workflows, and most likely the next release (based on the just released SQLite version 3.53.2) will be made via GitHub workflows.

I think the project now fulfills SLSA L2 - or is at least close to it. That hopefully increases the chances for the free signing service.

[avidenic]

This is great news! Thanks for the work you put into this.

[utelle]

Today, I received a note that SQLite3 Multiple Ciphers was accepted for the free SignPath signing service. 🎉

In a first step I will get a self-signed test certificate. I have to adjust all affected GitHub workflows by adding the signing steps. Then I will make the next official release using the test certificate. After all workflows have been adjusted and tested, SignPath will review the signing setup, and if all is correctly set up, the real signing certificate will be issued.

So, we still have a way to go, before real signing will be applied.

[utelle]

Today I made a first release in this repository where the Windows EXEs and DLLs are code-signed with a SignPath Foundation certificate. However, as I said already in my previous post, we still have a way to go until code-signing can be applied to the Windows binaries in the NuGet packages. From my side the necessary steps were prepared for the NuGet-related repositories, and the repositories are now under review by SignPath.

[avidenic]

This is great news!

[utelle]

Yesterday I was informed by SignPath that my NuGet-related repositories were added to the SQLite3MultipleCiphers SignPath account. That is, beginning with the next release the Windows binaries will be code-signed.

The next release will probably happen around mid of October, as the next major SQLite release, version 3.54.0, is planned for October 15.