fix(windows): look less like malware to antivirus programs: the program is not compressed inside, and its file details say what it is

HumanBean commented

2026-11-13 11:26:36 +00:00

Owner

Windows flags the launcher as a virus. It isn't one, but it has everything antivirus machine-learning checks look for: an unsigned program that unpacks compressed code into memory when it starts, installs itself, makes shortcuts and replaces itself on update, and whose file details say nothing about what it is. This PR removes the two of those that can be removed without a certificate.

What changed

scripts/package.sh: the Windows program is no longer built with EnableCompressionInSingleFile. A compressed .NET single file unpacks its code into memory at start, which looks like a packed dropper. That's a common cause of Wacatac-style !ml detections on .NET single-file apps.
- Cost: LongshotLauncher-<v>-windows-x64-setup.exe grows from 51 MB to 106 MB, and an installed launcher's self-update downloads 106 MB.
- The portable zip stays about the same, 45 MB (the zip compresses it instead).
- These are measured with dotnet publish -r win-x64 on this head, with compression on and off.
App/LongshotLauncher.csproj: the program's version resource (Properties → Details) now has real details instead of LongshotLauncher in every field:

Field	Before	After
CompanyName	LongshotLauncher	MagicBeanDev
ProductName	LongshotLauncher	Longshot Launcher
FileDescription	LongshotLauncher	Longshot Launcher
Comments	–	Installs, builds, updates and starts Longshot
LegalCopyright	(empty)	Copyright © the Longshot Launcher contributors. GPL-3.0-or-later

These were read back from the published exe's VERSIONINFO resource; the SDK writes it on Linux too, as it does the icon.

Notes

The 106 MB setup is over Cloudflare's 100 MB upload limit. The release workflow already sends large files to RELEASE_UPLOAD_API (the organization variable Longshot's builders use). It's worth checking the next nightly's publish succeeds.
The proper fix is Authenticode signing (README, Planned next), which needs a certificate. Until then, a detection can also be reported to Microsoft as a false positive at https://www.microsoft.com/wdsi/filesubmission.

Testing

python -I tests/test_launcher_core.py --longshot <Longshot checkout>: 632 checks passed. python -I tests/test_release.py: OK. bash -n scripts/package.sh: OK.
dotnet publish App/LongshotLauncher.csproj -c Release -r win-x64 --self-contained -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true with and without compression, for the sizes and the version resource above.
Not tested: whether Windows Defender (or another antivirus) still flags the new exe. That needs a scan on Windows, of a nightly built from this. It reduces the triggers, but it can't promise there'll be no detection.

🤖 Generated with Claude Code

Windows flags the launcher as a virus. It isn't one, but it has everything antivirus machine-learning checks look for: an unsigned program that unpacks compressed code into memory when it starts, installs itself, makes shortcuts and replaces itself on update, and whose file details say nothing about what it is. This PR removes the two of those that can be removed without a certificate. ## What changed - **`scripts/package.sh`:** the Windows program is no longer built with `EnableCompressionInSingleFile`. A compressed .NET single file unpacks its code into memory at start, which looks like a packed dropper. That's a common cause of `Wacatac`-style `!ml` detections on .NET single-file apps. - Cost: `LongshotLauncher-<v>-windows-x64-setup.exe` grows from **51 MB to 106 MB**, and an installed launcher's self-update downloads 106 MB. - The portable zip stays about the same, **45 MB** (the zip compresses it instead). - These are measured with `dotnet publish -r win-x64` on this head, with compression on and off. - **`App/LongshotLauncher.csproj`:** the program's version resource (Properties → Details) now has real details instead of `LongshotLauncher` in every field: | Field | Before | After | |---|---|---| | CompanyName | LongshotLauncher | MagicBeanDev | | ProductName | LongshotLauncher | Longshot Launcher | | FileDescription | LongshotLauncher | Longshot Launcher | | Comments | – | Installs, builds, updates and starts Longshot | | LegalCopyright | (empty) | Copyright © the Longshot Launcher contributors. GPL-3.0-or-later | These were read back from the published exe's `VERSIONINFO` resource; the SDK writes it on Linux too, as it does the icon. ## Notes - **The 106 MB setup is over Cloudflare's 100 MB upload limit.** The release workflow already sends large files to `RELEASE_UPLOAD_API` (the organization variable Longshot's builders use). It's worth checking the next nightly's publish succeeds. - **The proper fix is Authenticode signing** (README, *Planned next*), which needs a certificate. Until then, a detection can also be reported to Microsoft as a false positive at https://www.microsoft.com/wdsi/filesubmission. ## Testing - `python -I tests/test_launcher_core.py --longshot <Longshot checkout>`: 632 checks passed. `python -I tests/test_release.py`: OK. `bash -n scripts/package.sh`: OK. - `dotnet publish App/LongshotLauncher.csproj -c Release -r win-x64 --self-contained -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true` with and without compression, for the sizes and the version resource above. - **Not tested:** whether Windows Defender (or another antivirus) still flags the new exe. That needs a scan on Windows, of a nightly built from this. It reduces the triggers, but it can't promise there'll be no detection. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

HumanBean added 1 commit

2026-11-13 11:26:36 +00:00

fix(windows): look less like malware to antivirus programs: the program is not compressed inside, and its file details say what it is

CI / Compile and test (pull_request) Has been skipped

Details

CI / Conventional Commit title (pull_request) Successful in 2s

Details

dfb3763e7c

Co-Authored-By: Claude Opus 5.5 <[email protected]>

HumanBean merged commit 5820883521 into main

2026-11-13 11:31:43 +00:00

HumanBean deleted branch fix/windows-av-false-positive

2026-11-13 11:31:43 +00:00

HumanBean referenced this pull request from a commit

2026-11-13 11:31:44 +00:00

fix(windows): look less like malware to antivirus programs: the program is not compressed inside, and its file details say what it is (#32)

HumanBean referenced this pull request

2026-11-13 13:31:10 +00:00

fix(release): CI starts the Windows launcher under Wine from a build that unpacks itself, so the uncompressed launcher builds again #37

HumanBean referenced this pull request from a commit

2026-11-13 13:36:24 +00:00

fix(release): CI starts the Windows launcher under Wine from a build that unpacks itself, so the uncompressed launcher builds again (#37)

Rows
Columns

fix(windows): look less like malware to antivirus programs: the program is not compressed inside, and its file details say what it is #32

What changed

Notes

Testing