Windows binaries are unsigned — blocked by Smart App Control / SmartScreen

What happened?

On Windows 11 with Smart App Control (SAC) in Enforce mode, the unsigned entire.exe (~48 MB Go binary) is killed on launch with:

An Application Control policy has blocked this file
... did not meet the Enterprise signing level requirements

The blocking policy GUID is {0283ac0f-fff1-49ae-ada1-8a933130cad6} — the built-in Smart App Control policy. Because Git hooks spawn a fresh entire process on every relevant action, every new entire process fails once SAC enforces. (A long-running background process started before enforcement can keep working from memory until the next reboot, which is why it looks like "it worked yesterday, broken today.")

Root cause

entire.exe is shipped unsigned. The release pipeline only signs macOS binaries:

• .goreleaser.yaml / .github/workflows/release.yml apply Developer ID signing + notarization for darwin builds only. There is no Authenticode signing step for the windows builds.
• GitHub Releases, the entire.io installer, and the Scoop bucket all distribute the same unsigned exe, so reinstalling / switching channels does not help.

Smart App Control only allows binaries that are signed or that have an established Microsoft cloud reputation. A new, unsigned, low-reputation Go binary evaluates to zero reputation and is blocked. Unlike AppLocker / WDAC, SAC has no per-file allowlist — the only way to run an unsigned binary is to turn SAC off entirely, which is irreversible (SAC cannot be re-enabled without reinstalling Windows) and disables OS-wide malware protection. So "allow just this exe" is not possible for affected users.

SAC auto-promotes itself from evaluation mode (state=2) to enforce mode (state=1) on its own ML-driven schedule with no user action and little notice, so this can hit any new Win11 machine at an arbitrary time.

Steps to reproduce

1. Fresh Windows 11 install with Smart App Control left at the default (evaluation mode, which later auto-promotes to Enforce).
2. Install entire (Scoop / entire.io installer / GitHub Releases download).
3. Once SAC is in Enforce mode, run any command or trigger a Git hook that spawns entire.exe.
4. The process is blocked: An Application Control policy has blocked this file.

Expected behavior

The official Windows entire.exe should run on a default Windows 11 machine without requiring the user to disable Smart App Control.

Suggested fix

Add Authenticode code signing for the Windows binaries in the release pipeline (mirroring the existing macOS Developer ID + notarization flow). An EV / Azure Trusted Signing certificate establishes SmartScreen/SAC reputation immediately, which is what SAC requires.

Current workaround

The only workaround today is disabling Smart App Control — which is irreversible and removes OS-wide protection. Not acceptable as a long-term answer for a single CLI.

Environment

• OS: Windows 11, Smart App Control = Enforce (state 1)
• Install: Scoop / entire.io / GitHub Releases (all ship the same unsigned exe)
• Binary: entire.exe, unsigned (NotSigned)

Start with .goreleaser.yaml and .github/workflows/release.yml, comparing the existing darwin signing and notarization steps with the Windows builds. Trace how GitHub Releases, the entire.io installer, and Scoop receive the executable. Done means official Windows entire.exe artifacts are Authenticode-signed and can launch on Windows 11 with Smart App Control in Enforce mode.