We have made significant progress in setting up proper Authenticode signing for our Windows MSI packages through the SignPath OSS program.

Here is what has been accomplished:
- Our application to the SignPath OSS program has been accepted
- The GitHub Actions CI/CD pipeline has been fully configured to automatically submit signing requests after each successful Windows build
- The MSI artifact configuration has been set up to sign both the installer package and all nested executables and DLLs
- A first test signing request was successfully processed, with all verifications passing (source code origin, build workflow, malware scan)

We are now waiting for SignPath to activate the production certificate, after which every nightly Windows MSI build will be automatically signed with a trusted certificate.

This means that in the near future, users will no longer see the "Unknown publisher" warning when installing QElectroTech on Windows.

Thanks to everyone who encouraged us to pursue this — it has been a long time coming!

Roadmap :

Await the EV certificate from the SignPath Foundation
Change test-signing to release-signing in windows-msi.yml
Add the SignPath signature to windows-build.yml for the NSIS .exe and Ready-To-Use
Configure the NSIS project in SignPath

It was a real struggle with WiX v7 — between the EULA, namespaces, !(bind.Variable.) vs $(var.), WixVariable refusing to be a child of WixUI, and the non-embedded cab1.cab. But the result is clean and robust.

To summarise what we now have in the repository:

windows-build.yml — full MSYS2/UCRT64 build with NSIS, ccache, portable artefacts + installer, triggered manually
windows-msi.yml — generates a standalone MSI with WiX v7, embedded GPL-2 licence, QET.bat launcher adapted for Program Files
test-vs2026.yml — validates compatibility with the VS 2026 image prior to the 8 June migration
QElectroTech.wxs — complete WiX v7 definition with automatic harvesting, shortcuts, .qet file association

https://github.com/qelectrotech/qelectr … -win64.msi

Enjoy!

The installer isn't ready for production yet; it still needs some finishing polished. OK ->Done.

It’s already very complicated to compile QET for Windows; setting up a CI/CD pipeline on our GitHub is even more complicated.

For years (15 years) I have been providing QET packages for Windows; they are cross-compiled on my Debian machine using MXE and based on the old scripts from the Digikam developer. See: https://qelectrotech.org/forum/viewtopi … 976#p13976

Cross-compilation is an advantage for me as everything is scripted, but it  involves compromises: static builds, EXE files containing the DLLs, and deployment with winqtdeploy not working in cross-compilation!
https://github.com/qelectrotech/qelectr … Windows.sh

Furthermore, the NSIS installer scripts are still based on the old 2.X version; I don’t have the time and nor healthor, the skills to rewrite them to make them compatible with NSIS 3.X. EDIT: DONE!

We are therefore looking for people with expertise in Windows CI/CD (AppVeyor, GitHub), as well as people capable of reviewing the Windows installer.

Even €200 a year is out of the question – we don’t have enough donations to cover that certificate. I’m already paying for the Apple Developer Account out of my own pocket – €99 a year just to signed and notarized Apple Silicon bundles aarch64 – and on top of that, there’s the hosting fee of €160/year and the domain registrar fee...

https://github.com/qelectrotech/qelectr … issues/445

Please search on www "bypass SmartScreen warning in Windows."

Hello
I can't install the program. No matter which file I use, Windows keeps telling me that the file isn't trustworthy and that I can't download it. What can I do?