Bug report: OpenWork 0.18.13 Windows installer is unsigned and blocked by Windows Defender Application Control / Smart App Control — in-app update to 0.18.13 fails
Environment
- OS: Windows (Win32), Windows 11
- Installed OpenWork: 0.18.12 (installs and runs fine)
- Update target: 0.18.13 (
openwork-win-x64-0.18.13.exe)
- Windows security features active: Smart App Control ON (
VerifiedAndReputablePolicyState: 1), HVCI/VBS enabled, WDAC code integrity policy enforced (Policy ID {0283ac0f-fff1-49ae-ada1-8a933130cad6})
Summary
The in-app updater downloads openwork-win-x64-0.18.13.exe, but the update can never be applied: Windows Code Integrity (Defender Application Control / Smart App Control) refuses to launch the installer because the 0.18.13 installer is not digitally signed (Authenticode status: NotSigned).
Steps to reproduce
- On Windows 11 with Smart App Control ON (or an enforced WDAC policy), run OpenWork 0.18.12.
- Let the app check for updates / download 0.18.13.
- The updater downloads the file but the install never completes.
Expected behavior
- The installer should be digitally signed (EV or standard code-signing certificate) so it passes Windows Code Integrity checks, OR
- The update should apply successfully on Windows 11 with Smart App Control enabled.
Actual behavior
- Code Integrity blocks launching the installer. Windows Event Log
Microsoft-Windows-CodeIntegrity/Operational, Event ID 3077:
"Code Integrity determined that a process (...) attempted to load ...openwork-win-x64-0.18.13.exe that did not meet the Enterprise signing level requirements or violated code integrity policy (Policy ID:{0283ac0f-fff1-49ae-ada1-8a933130cad6})."
- Trying to run the installer manually (even elevated) gives: "This command cannot be run due to the error: An Application Control policy has blocked this file."
Get-AuthenticodeSignature on both the Downloads copy and the updater's pending copy reports NotSigned.- The file hash matches the official update metadata (
update-info.json sha512), so this is the genuine release build — not a tampered download.
Impact
- Users on Windows 11 with Smart App Control enabled (default on new devices) or with enterprise WDAC policies cannot update OpenWork and cannot install newer releases. 0.18.12 works only because it predates/avoids the same block on this machine.
- This is likely a packaging/signing regression on the release pipeline for 0.18.13.
Suggested fix
- Sign the Windows NSIS installers (and ideally the app binaries) with a trusted code-signing certificate before publishing releases.
- Verify installer signature (
signtool verify / Authenticode) as a release-pipeline CI check so unsigned builds never ship.
Bug report: OpenWork 0.18.13 Windows installer is unsigned and blocked by Windows Defender Application Control / Smart App Control — in-app update to 0.18.13 fails
Environment
openwork-win-x64-0.18.13.exe)VerifiedAndReputablePolicyState: 1), HVCI/VBS enabled, WDAC code integrity policy enforced (Policy ID{0283ac0f-fff1-49ae-ada1-8a933130cad6})Summary
The in-app updater downloads
openwork-win-x64-0.18.13.exe, but the update can never be applied: Windows Code Integrity (Defender Application Control / Smart App Control) refuses to launch the installer because the 0.18.13 installer is not digitally signed (Authenticode status:NotSigned).Steps to reproduce
Expected behavior
Actual behavior
Microsoft-Windows-CodeIntegrity/Operational, Event ID 3077:Get-AuthenticodeSignatureon both the Downloads copy and the updater's pending copy reports NotSigned.update-info.jsonsha512), so this is the genuine release build — not a tampered download.Impact
Suggested fix
signtool verify/ Authenticode) as a release-pipeline CI check so unsigned builds never ship.