Unknown publisher error when opening sts-4.28.0.RELEASE/SpringToolSuite4.exe

[ramunask]

Describe the bug

sts-4.28.0.RELEASE/SpringToolSuite4.exe cannot be opened in Windows 11 because of Unknown publisher error.

To Reproduce

Steps to reproduce the behavior:

• download https://cdn.spring.io/spring-tools/release/STS4/4.28.0.RELEASE/dist/e4.34/spring-tool-suite-4-4.28.0.RELEASE-e4.34.0-win32.win32.x86_64.zip
• extract
• double click on sts-4.28.0.RELEASE/SpringToolSuite4.exe
• dialog "Windows protected your PC" is shown

Sample

Windows does not Root certificate from signature:

• Serial Number: 07a4883ab28ef42dd78c5862cd19892df5563731
• Subject: CN = DigiCert Private Shared Code Signing RSA Root CA, OU = Secure Software Manager, O = DigiCert, Inc., C = US

[BoykoAlex]

@ramunask I can start the STS app without the Defender complaining but if I look at the certificates via file properties I also see that the root certificate has a trust issue. I know that the certificate is ours and valid I'm just not sure if this is the right root certificate... trying to find this out. If it is the right root certificate and I need to find out how to download it (as I wasn't able to)
Once the certificate is downloaded you can added to trusted root certificates manually with these instructions: https://knowledge.digicert.com/solution/how-to-import-intermediate-and-root-certificates-using-mmc or https://learn.microsoft.com/en-us/windows-hardware/drivers/install/trusted-root-certification-authorities-certificate-store

[ramunask]

Thanks @BoykoAlex . I know, that I can add root certificate to my Trusted Root Certificates list, but I do not want do this on company PC. I can't find nothing searching by this Root Certificate Serial Number 07a4883ab28ef42dd78c5862cd19892df5563731. Also there is no such certificate in https://www.digicert.com/kb/digicert-root-certificates.htm.

For example I checked earlier sts-4.22.0 version, and Windows shows valid certificate chain, see:

P.S. on my personal PC, also with Windows 11, it runs even chain is invalid.

[BoykoAlex]

@ramunask Looks like our signing service has changed. I've adopted the changes and built a snapshot windows distribution. Please find any windows distribution on this page: https://cdn.spring.io/spring-tools/snapshot/STS4/nightly-distributions.html
I have this chain now:

Looks very promising to me. Please give it try on your PC at work. Should work now.

If it does we can discuss whether we'd need a new release (4.28.1) to have this fixed urgently.

[ramunask]

Please give it try on your PC at work. Should work now.

I checked these builds:

• spring-tool-suite-4-4.29.0.202502122002-SNAPSHOT-e4.33.0-win32.win32.x86_64.zip
• spring-tool-suite-4-4.29.0.202502122002-SNAPSHOT-e4.34.0-win32.win32.x86_64.zip
• spring-tool-suite-4-4.29.0.202502122002-SNAPSHOT-e4.35.0-win32.win32.x86_64.zip

All has valid certificate chain:

If it does we can discuss whether we'd need a new release (4.28.1) to have this fixed urgently.

I would say, that new release is needed.

[BoykoAlex]

@martinlippert what do you think about us getting 4.28.1? Thinking of just releasing Eclipse side...

[BoykoAlex]

Marking as fixed and preparing 4.28.1 release for Eclipse extensions