Sign Windows executables installed by the MSI package

[omomit]

Summary

Please consider Authenticode-signing the Windows executables installed by the official Nextcloud Talk Desktop MSI package.

After installing Nextcloud Talk Desktop from the official MSI installer, the installed executable files appear to be unsigned:

C:\Program Files\Nextcloud Talk\Nextcloud Talk.exe
C:\Program Files\Nextcloud Talk\app-2.2.0\Nextcloud Talk.exe

This creates trust and deployment issues in managed Windows environments.

Environment

• Product: Nextcloud Talk Desktop
• Version: 2.2.0
• Installer type: official Windows MSI
• Installation path: C:\Program Files\Nextcloud Talk\
• OS: Windows

Steps to reproduce

1. Download and install the official Windows MSI package for Nextcloud Talk Desktop.
2. Check the installed executable signatures, for example:

Get-AuthenticodeSignature "C:\Program Files\Nextcloud Talk\Nextcloud Talk.exe"
Get-AuthenticodeSignature "C:\Program Files\Nextcloud Talk\app-2.2.0\Nextcloud Talk.exe"

Actual result

The installed executable files are not digitally signed.

Expected result

All Windows PE files distributed by the official installer should be Authenticode-signed and timestamped, especially:

C:\Program Files\Nextcloud Talk\Nextcloud Talk.exe
C:\Program Files\Nextcloud Talk\app-<version>\Nextcloud Talk.exe

Ideally, the MSI package and all installed executable files should be signed with a consistent publisher identity, for example Nextcloud GmbH.

Why this matters

The MSI package is especially relevant for managed and enterprise environments. Unsigned executables installed under Program Files make deployment and operation harder because they may trigger or complicate:

• Microsoft Defender SmartScreen warnings;
• Smart App Control behavior;
• AppLocker or WDAC allowlisting policies;
• EDR/AV reputation-based detections;
• enterprise software inventory and compliance checks;
• user trust and incident response workflows.

For enterprise administrators, a signed MSI alone is not always sufficient. The installed executable files also need valid signatures so that endpoint controls can verify publisher identity and file integrity after installation and during application launch.

Related issue

This appears related to the earlier issue about unsigned executables triggering SmartScreen warnings:

• unsigned exe triggers SmartScreen #778

That issue was closed as not planned, but the problem still affects current MSI-based installations and is especially important for enterprise deployment.

Implementation note

The build configuration already appears to contain Windows signing support via WINDOWS_SIGN_PARAMS. If possible, please enable this in the official release pipeline and ensure that both the installer artifact and all installed Windows executables are signed and timestamped.

Thank you.

[ShGKme]

Thank you for the report. I can confirm the problem, and I'm checking the possible position.

Note that the .msi installer itself is signed.

[hiSandog]

This looks like a good regression-test candidate because the failure is narrowed to “Sign Windows executables installed by the MSI package”. If a minimal fixture can exercise C:\Program Files\Nextcloud Talk\ and assert the expected behavior around Program Files, it would make the eventual fix much easier to keep from regressing.