#5903
Issues/LizardByte/Sunshine/#5903

Windows AMD64 MSI contains unsigned executables blocked by Smart App Control

OpenAbisibaopened 18d ago

Is there an existing issue for this?

  • I have searched the existing issues

Is your issue described in the documentation?

  • I have read the documentation

Is your issue present in the latest beta/pre-release?

None

Describe the Bug

Issue: Sunshine v2026.914.233613 cannot start on Windows 11 with Smart App Control enabled because its executables are unsigned.

Steps to reproduce:

  1. Enable Windows 11 Smart App Control.
  2. Download the official Sunshine-Windows-AMD64-installer.msi for v2026.914.233613.
  3. Install Sunshine using the MSI installer.
  4. Attempt to start the Sunshine service or run sunshine.exe directly.
  5. Windows blocks execution with Application Control error 4551.

Observed behavior:

  • The MSI installer completes successfully.
  • SunshineService is installed but remains stopped.
  • Running sc.exe start SunshineService returns StartService FAILED 4551: Application Control policy blocked this file.
  • Running sunshine.exe directly is also blocked.
  • Windows Security displays a Smart App Control notification indicating that the application's publisher could not be verified.

Signature verification:

  • Official MSI installer: Valid
  • C:\Program Files\Sunshine\sunshine.exe: NotSigned
  • C:\Program Files\Sunshine\tools\sunshinesvc.exe: NotSigned
  • sunshine.exe extracted directly from the MSI: NotSigned

I also compared the SHA-256 hashes of the installed executable and the executable extracted from the MSI. They are identical, confirming that the installed executable was not modified during installation.

The MSI itself has a valid digital signature, but the executable files checked above are unsigned.

Could the Windows AMD64 release artifacts be checked to confirm whether the executable files are expected to be digitally signed?

Expected Behavior

Sunshine should install and start successfully on Windows 11 with Smart App Control enabled, using appropriately signed and trusted executable files.

The Sunshine service should start without Application Control error 4551, and the web interface should become accessible.

Additional Context

Sunshine version: v2026.914.233613

Installation package: Sunshine-Windows-AMD64-installer.msi (official GitHub release)

Security configuration: Windows 11 Smart App Control enabled

SHA-256 of sunshine.exe (installed and extracted from MSI):

8E2C4627318432B67520A9DE7CFD8AC089068A2873CCF8443756733A1AF7D571

The executable was also tested from a separately extracted Sunshine ZIP package and was blocked by Windows Application Control.

Disabling Smart App Control has not been attempted, because I would prefer to keep this Windows security feature enabled.

Host Operating System

Windows

Operating System Version

Windows 11 Home

Architecture

amd64/x86_64

Package

Windows - msi installer (recommended)

GPU Type

NVIDIA

GPU Model

NVIDIA GeForce RTX 5070 Ti Laptop GPU

GPU Driver/Mesa Version

32.0.15.7290

Capture Method

None

Apps

undefined

Log output

Sunshine cannot start, so a current Sunshine web UI troubleshooting log is unavailable.

Windows Service Control Manager output:


[SC] StartService FAILED 4551:
Application Control policy blocked this file.


PowerShell service status:


Name             Status   StartType
SunshineService  Stopped  Automatic


Running `sunshine.exe` directly also produces an Application Control policy block.

Authenticode verification:


sunshine.exe       NotSigned
sunshinesvc.exe    NotSigned
MSI installer      Valid

Online logs

No response

Activity

1