Sign Windows executables installed by the MSI package

Summary

Please consider Authenticode-signing the Windows executables installed by the official Nextcloud Talk Desktop MSI package.

After installing Nextcloud Talk Desktop from the official MSI installer, the installed executable files appear to be unsigned:

C:\Program Files\Nextcloud Talk\Nextcloud Talk.exe
C:\Program Files\Nextcloud Talk\app-2.2.0\Nextcloud Talk.exe

This creates trust and deployment issues in managed Windows environments.

Environment

• Product: Nextcloud Talk Desktop
• Version: 2.2.0
• Installer type: official Windows MSI
• Installation path: C:\Program Files\Nextcloud Talk\
• OS: Windows

Steps to reproduce

1. Download and install the official Windows MSI package for Nextcloud Talk Desktop.
2. Check the installed executable signatures, for example:

Get-AuthenticodeSignature "C:\Program Files\Nextcloud Talk\Nextcloud Talk.exe"
Get-AuthenticodeSignature "C:\Program Files\Nextcloud Talk\app-2.2.0\Nextcloud Talk.exe"

Actual result

The installed executable files are not digitally signed.

Expected result

All Windows PE files distributed by the official installer should be Authenticode-signed and timestamped, especially:

C:\Program Files\Nextcloud Talk\Nextcloud Talk.exe
C:\Program Files\Nextcloud Talk\app-<version>\Nextcloud Talk.exe

Ideally, the MSI package and all installed executable files should be signed with a consistent publisher identity, for example Nextcloud GmbH.

Why this matters

The MSI package is especially relevant for managed and enterprise environments. Unsigned executables installed under Program Files make deployment and operation harder because they may trigger or complicate:

• Microsoft Defender SmartScreen warnings;
• Smart App Control behavior;
• AppLocker or WDAC allowlisting policies;
• EDR/AV reputation-based detections;
• enterprise software inventory and compliance checks;
• user trust and incident response workflows.

For enterprise administrators, a signed MSI alone is not always sufficient. The installed executable files also need valid signatures so that endpoint controls can verify publisher identity and file integrity after installation and during application launch.

Related issue

This appears related to the earlier issue about unsigned executables triggering SmartScreen warnings:

• #778

That issue was closed as not planned, but the problem still affects current MSI-based installations and is especially important for enterprise deployment.

Implementation note

The build configuration already appears to contain Windows signing support via WINDOWS_SIGN_PARAMS. If possible, please enable this in the official release pipeline and ensure that both the installer artifact and all installed Windows executables are signed and timestamped.

Thank you.

Start by inspecting the Windows build configuration around WINDOWS_SIGN_PARAMS and the official release pipeline. Verify the MSI and installed executables with Get-AuthenticodeSignature; done means the distributed Windows PE files and MSI are Authenticode-signed, timestamped, and identify a consistent publisher.