From 90bd93f47f22810562f1353afd68baf9ae427610 Mon Sep 17 00:00:00 2001 From: Wanjohi Date: Wed, 2 Sep 2026 16:56:29 +0300 Subject: [PATCH] docs(nesdoctor): Windows will block it, and here is why and what to press Reported from a real machine on release day. The README asks strangers to run a binary, so it should say what actually happens when they try. The why matters more than the workaround: SmartScreen objects to the file being unsigned and having no download history, not to anything the program does. And history attaches to the file hash, so a project releasing four times in an afternoon never accumulates any -- waiting is not a strategy. Offers the source build as the version that requires no trust, and says that stopping is a reasonable choice. Reproducible CI builds and published checksums prove provenance without moving SmartScreen an inch, and pretending otherwise would be the kind of overclaim this tool cannot afford. --- apps/nesdoctor/README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/apps/nesdoctor/README.md b/apps/nesdoctor/README.md index b04ad0ce..4b2c0b77 100644 --- a/apps/nesdoctor/README.md +++ b/apps/nesdoctor/README.md @@ -26,6 +26,22 @@ Or build it yourself: cargo run --release -p nesdoctor ``` +### Windows will block it + +It will, and not because of anything the program does. SmartScreen refuses any +executable that is **unsigned** and has **no download history** — and history +attaches to the file hash, so every new release starts from zero. Ours is both, +for now. + +On the dialog: **More info** → **Run anyway**. If that is not a trade you want +to make, stopping there is completely reasonable — or build from source above, +which needs no trust at all. + +Every binary is built by GitHub Actions from a tagged commit, never from +anyone's machine, and `SHA256SUMS` is published beside it. That proves the file +came from the source you can read. It does not make Windows any happier, which +is a separate problem and one we owe money rather than words to fix. + Checks every hard requirement for running a Nestri box, measures what your connection actually does when it is busy, and asks at most five questions.