Windows Smart App Control is blocking the app

[fmartelg]

Diagnostic output

Not available. See next step.

Current Behavior

I suppose a recent update enabled Windows Smart App Control on my device. The app looks for verified signatures before any app is launched. If the app lacks such a signature it gets blocked. There is no manual override.

jrnl does not appear to be signed. As a result, invoking the app from the terminal now yields:

XYZ> jrnl
ResourceUnavailable: Program 'jrnl.exe' failed to run: An error occurred trying to start process 'c:\users\XYZ\.local\bin\jrnl.exe' with working directory 'C:\Users\XYZ'. An Application Control policy has blocked this file.At line:1 char:1
+ jrnl
+ ~~~~.

Clicking on jrnl.exe yields a pop-up windows stating that "Smart App Control has blocked an app that my be unsafe". In short, I cannot use the app on my device.

The solution -- according to Microsoft -- is for the app provider, in this case jrnl, to sign their app with a valid signature.

(FWIW according to MS optional diagnostic data must be enabled to have Smart App Control enabled. I am opted out of optional diagnostic data so in principle it should not be turned on....)

Expected Behavior

I expect the app to run.

Repro Steps

XYZ> jrnl
ResourceUnavailable: Program 'jrnl.exe' failed to run: An error occurred trying to start process 'c:\users\XYZ\.local\bin\jrnl.exe' with working directory 'C:\Users\XYZ'. An Application Control policy has blocked this file.At line:1 char:1
+ jrnl
+ ~~~~.

Debug output

XYZ> jrnl
ResourceUnavailable: Program 'jrnl.exe' failed to run: An error occurred trying to start process 'c:\users\XYZ\.local\bin\jrnl.exe' with working directory 'C:\Users\XYZ'. An Application Control policy has blocked this file.At line:1 char:1
+ jrnl
+ ~~~~.

Other Information

No response

[micahellison]

I'm not sure if it's possible for us to sign a jrnl release in a way that conforms to Microsoft's demands, and I can't find any resources about doing this with PyPI projects such as ours.

If anyone has an experience with this or links to explainers on how to accomplish this with Python, please feel free to share your expertise in this thread.

[micahellison]

I get the impression that the solution for this would involving compiling a Windows executable for jrnl instead of relying on pipx as the delivery method for Windows users.

We've had this on the wishlist for years (#1393) but it would be more sustainable if someone else built a downstream project to do this, since such a feature would likely require a different release cadence. Maybe someone from Microsoft might even be interested in maintaining that. After all, several Linux distros maintain jrnl packages because they know it adds value to their distros.