Skip to content

feat(install): Windows is unsigned too, and the path with no warning goes first #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eaitbrahim merged 1 commit into from
Aug 20, 2026
Merged

feat(install): Windows is unsigned too, and the path with no warning goes first #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 19 additions & 18 deletions src/components/pages/InstallPage.astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,19 +145,28 @@ const venvCommands = (os: "mac" | "win"): string => {
hasPlatformBundle && (
<section class="unsigned-note" role="note">
<h2>{c.unsigned.title}</h2>

{/* FIRST, before any of the certificate explanation. Someone reading this is deciding
whether to proceed past a security warning, and "there is a route with no warning
at all" is the most useful thing to hand them at that exact moment -- not four
paragraphs about what Apple charges. It is honest about the trade rather than
selling it: that route needs a terminal, which is the friction the desktop app
exists to remove. */}
<div class="unsigned-first">
<h3>{c.unsigned.avoidTitle}</h3>
<p>{c.unsigned.avoidBody}</p>
<p><a class="button" href="#from-source">{c.unsigned.avoidLink} →</a></p>
</div>

<p>{c.unsigned.lead}</p>
<p><strong>{c.unsigned.reason}</strong></p>

<div class="unsigned-steps">
<div>
<h3>{c.unsigned.macosTitle}</h3>
<ol>{c.unsigned.macosSteps.map((step) => <li>{step}</li>)}</ol>
</div>
<div>
<h3>{c.unsigned.windowsTitle}</h3>
<ol>{c.unsigned.windowsSteps.map((step) => <li>{step}</li>)}</ol>
</div>
</div>
{/* Stacked, not columned: the steps are long enough now that two columns would put
step 6 of one beside step 2 of the other and read as one list. */}
<h3>{c.unsigned.macosTitle}</h3>
<ol>{c.unsigned.macosSteps.map((step) => <li>{step}</li>)}</ol>
<h3>{c.unsigned.windowsTitle}</h3>
<ol>{c.unsigned.windowsSteps.map((step) => <li>{step}</li>)}</ol>

<h3>{c.unsigned.verifyTitle}</h3>
<p>{c.unsigned.verifyLead}</p>
Expand All @@ -167,14 +176,6 @@ const venvCommands = (os: "mac" | "win"): string => {
<h3>{c.unsigned.notMeaningTitle}</h3>
<ul>{c.unsigned.notMeaning.map((item) => <li>{item}</li>)}</ul>

{/* The friction-free alternative, offered here rather than left further down the
page: someone reading a security warning is deciding whether to proceed, and
"there is a path with no warning at all" is the most useful thing to hand them
at that exact moment. */}
<h3>{c.unsigned.avoidTitle}</h3>
<p>{c.unsigned.avoidBody}</p>
<p><a class="button" href="#from-source">{c.unsigned.avoidLink} →</a></p>

<p>
<a href="https://github.com/CodeGateSoftware/keel/blob/main/docs/desktop-install.md">
{c.unsigned.more} →
Expand Down
76 changes: 47 additions & 29 deletions src/i18n/pages/install.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@

export const install: LocalizedPage<InstallContent> = {
en: {
rev: "2026-08-20.3",
rev: "2026-08-20.4",
title: "Download keel — macOS & Windows",
description:
"Download keel for macOS or Windows. Version and links come from GitHub Releases at build time; the five-minute source path is here too.",
Expand Down Expand Up @@ -119,18 +119,24 @@
title: "Your computer will warn you about this download",
lead: "The macOS and Windows builds are not code-signed, so your operating system will refuse the first open and tell you it cannot verify the developer. Nothing is broken, and nothing was detected — your computer simply does not know who wrote the program.",
reason:
"Code signing is a paid certificate. Apple's costs $99 per year, every year, and keel cannot currently afford it. There is no cheaper tier and no free option for open-source projects, and a certificate we made ourselves would do nothing at all, because macOS trusts only certificates Apple issued.",
"Code signing is a paid certificate, and keel cannot currently afford either one: Apple's is $99 per year, and Azure Trusted Signing for Windows is about $120 per year — more than Apple's, and since 2024 it does not even buy an instant SmartScreen pass, because reputation is earned from download volume over time. There is no cheaper tier and no free open-source option on either platform, and a certificate we made ourselves would do nothing at all, because macOS trusts only certificates Apple issued.",
macosTitle: "macOS",
macosSteps: [
"Double-click keel. macOS refuses, saying it cannot verify the developer.",
"Open the downloaded .dmg, then drag keel.app into your Applications folder.",
"Eject the disk image.",
"Open Applications and double-click keel. macOS refuses; click Done.",
"Open System Settings → Privacy & Security.",
"Scroll to the message about keel and click Open Anyway.",
"You only do this once.",
"Scroll to the Security section. There is a line saying keel was blocked, with an Open Anyway button beside it. Click it.",
"Authenticate, then click Open Anyway once more in the dialog that follows.",
"You only do this once. On macOS Sequoia (15) and later, right-clicking the app and choosing Open no longer works as a shortcut — Apple removed that path deliberately.",
],
windowsTitle: "Windows",
windowsSteps: [
"Run the installer. SmartScreen says \"Windows protected your PC\".",
"Click More info, then Run anyway.",
"Before extracting, right-click the downloaded .zip → Properties.",
"At the bottom of the General tab, tick Unblock if it is there, then OK. This is the step people miss, and skipping it brings the warning back on a later launch.",
"Right-click the .zip → Extract All…, into a folder you own — for example C:\\Users\\<you>\\keel. Not Program Files: keel does not need administrator rights and should not be given them.",

Check warning on line 137 in src/i18n/pages/install.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

`String.raw` should be used to avoid escaping `\`. 


See more on https://sonarcloud.io/project/issues?id=CodeGateSoftware_keeltrading.com&issues=AaAhFjRfNlxoHLnTa04X&open=AaAhFjRfNlxoHLnTa04X&pullRequest=27
"Open the extracted folder and double-click keel.exe.",
"If SmartScreen appears — \"Windows protected your PC\" — click More info, then Run anyway.",
],
verifyTitle: "Please check what you downloaded first",
verifyLead:
Expand All @@ -143,17 +149,17 @@
"It does not mean your computer found something wrong. Nothing was scanned and nothing was detected.",
"It does not mean the app behaves differently. A signed and an unsigned build of the same release are the same program.",
],
avoidTitle: "Or skip the warning entirely",
avoidTitle: "First — you may not need to deal with this at all",
avoidBody:
"The five-minute source path below installs the same engine with no installer and no warning, because nothing is downloaded as an application — pip and uv fetch the published wheels directly. It needs a terminal and Python 3.11+, which is exactly the friction the desktop app exists to remove; but if you already have both, it is the shorter road.",
"The five-minute path below installs the same engine with no installer and no warning on any platform, because nothing is downloaded as an application — pip and uv fetch the published wheels directly, and no operating system objects to that. It needs a terminal and Python 3.11 or later, which is exactly the friction the desktop app exists to remove; but if you already have both, it is the shorter road and the rest of this note does not apply to you.",
avoidLink: "Try it in five minutes",
more: "Full explanation, including how to verify what you downloaded",
},
},

ar: {
rev: "2026-08-20.3",
translatedFromRev: "2026-08-20.3",
rev: "2026-08-20.4",
translatedFromRev: "2026-08-20.4",
title: "تنزيل كيل — macOS وWindows",
description:
"نزّل كيل لـ macOS أو Windows. الإصدار والروابط من GitHub Releases وقت البناء؛ ومسار المصدر في خمس دقائق هنا أيضًا.",
Expand Down Expand Up @@ -196,18 +202,24 @@
title: "سيحذّرك جهازك من هذا التنزيل",
lead: "بِنى macOS وWindows غير موقّعة رقميًّا، لذا سيرفض نظامك فتحها أول مرّة ويقول إنه لا يستطيع التحقّق من المطوّر. لا شيء معطّل، ولم يُكتشف شيء — جهازك ببساطة لا يعرف من كتب البرنامج.",
reason:
"التوقيع الرقمي شهادةٌ مدفوعة. شهادة Apple تكلّف 99 دولارًا سنويًّا، كلّ سنة، وكيل لا يقدر عليها حاليًّا. ولا توجد فئة أرخص ولا خيارٌ مجانيٌّ لمشاريع المصدر المفتوح، وشهادةٌ نصنعها بأنفسنا لا تفيد شيئًا البتّة، لأن macOS لا يثق إلا بالشهادات الصادرة عن Apple.",
"التوقيع الرقمي شهادةٌ مدفوعة، وكيل لا يقدر على أيٍّ منهما حاليًّا: شهادة Apple بـ99 دولارًا سنويًّا، وAzure Trusted Signing لويندوز بنحو 120 دولارًا سنويًّا — أغلى من Apple، ومنذ 2024 لا تمنح حتى تجاوزًا فوريًّا لـSmartScreen، لأن السمعة تُكتسب من حجم التنزيلات عبر الوقت. ولا توجد فئة أرخص ولا خيارٌ مجانيٌّ لمشاريع المصدر المفتوح على أيٍّ من النظامين، وشهادةٌ نصنعها بأنفسنا لا تفيد شيئًا البتّة، لأن macOS لا يثق إلا بالشهادات الصادرة عن Apple.",
macosTitle: "macOS",
macosSteps: [
"انقر كيل نقرًا مزدوجًا. سيرفض macOS قائلًا إنه لا يستطيع التحقّق من المطوّر.",
"افتح ملفّ ‎.dmg المنزَّل، ثم اسحب ‏keel.app إلى مجلّد ‏Applications.",
"أخرِج قرص التثبيت (Eject).",
"افتح ‏Applications وانقر كيل نقرًا مزدوجًا. سيرفض macOS؛ اضغط ‏Done.",
"افتح ‏System Settings ← Privacy & Security.",
"انزل إلى الرسالة الخاصّة بكيل واضغط ‏Open Anyway.",
"تفعل هذا مرّةً واحدة فقط.",
"انزل إلى قسم ‏Security. ستجد سطرًا يقول إن كيل حُجب، وبجانبه زرّ ‏Open Anyway. اضغطه.",
"أثبِت هويّتك، ثم اضغط ‏Open Anyway مرّةً أخرى في النافذة التي تظهر.",
"تفعل هذا مرّةً واحدة فقط. وفي macOS Sequoia‏ (15) فما بعد، لم يعد النقر بالزرّ الأيمن واختيار ‏Open يعمل كاختصار — أزالت Apple هذا المسار عمدًا.",
],
windowsTitle: "Windows",
windowsSteps: [
"شغّل المثبّت. سيقول ‏SmartScreen‏: «‏Windows protected your PC‏».",
"اضغط ‏More info ثم ‏Run anyway.",
"قبل فكّ الضغط، انقر بالزرّ الأيمن على ملفّ ‎.zip المنزَّل ← ‏Properties.",
"في أسفل تبويب ‏General، علّم ‏Unblock إن وُجد ثم ‏OK. هذه هي الخطوة التي يغفلها الناس، وتخطّيها يُعيد التحذير عند تشغيلٍ لاحق.",
"انقر بالزرّ الأيمن على ‎.zip ← ‏Extract All…‎ إلى مجلّدٍ تملكه — مثلًا ‏C:\\\\Users\\\\<اسمك>\\\\keel. وليس ‏Program Files: كيل لا يحتاج صلاحيات المسؤول ولا ينبغي منحه إيّاها.",

Check warning on line 220 in src/i18n/pages/install.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

`String.raw` should be used to avoid escaping `\`. 


See more on https://sonarcloud.io/project/issues?id=CodeGateSoftware_keeltrading.com&issues=AaAhFjRfNlxoHLnTa04Y&open=AaAhFjRfNlxoHLnTa04Y&pullRequest=27
"افتح المجلّد المستخرَج وانقر ‏keel.exe نقرًا مزدوجًا.",
"إن ظهر ‏SmartScreen — «‏Windows protected your PC‏» — فاضغط ‏More info ثم ‏Run anyway.",
],
verifyTitle: "من فضلك تحقّق ممّا نزّلته أولًا",
verifyLead:
Expand All @@ -220,17 +232,17 @@
"لا يعني أن جهازك وجد خطبًا ما. لم يُفحص شيء ولم يُكتشف شيء.",
"لا يعني أن التطبيق يسلك سلوكًا مختلفًا. البنية الموقّعة وغير الموقّعة من الإصدار نفسه هما البرنامج نفسه.",
],
avoidTitle: "أو تجاوز التحذير من أصله",
avoidTitle: "أولًا — قد لا تحتاج إلى التعامل مع هذا أصلًا",
avoidBody:
"مسار المصدر في خمس دقائق أدناه يثبّت المحرّك نفسه بلا مثبّت وبلا تحذير، لأنه لا يُنزَّل شيءٌ بوصفه تطبيقًا — بل يجلب pip وuv العجلات المنشورة مباشرةً. يحتاج طرفيّةً وPython 3.11 فأحدث، وهو بالضبط الاحتكاك الذي وُجد تطبيق سطح المكتب ليزيله؛ لكن إن كان كلاهما عندك أصلًا فهو الطريق الأقصر.",
"مسار الخمس دقائق أدناه يثبّت المحرّك نفسه بلا مثبّت وبلا تحذيرٍ على أيّ نظام، لأنه لا يُنزَّل شيءٌ بوصفه تطبيقًا — بل يجلب pip وuv العجلات المنشورة مباشرةً، ولا يعترض أيّ نظام تشغيل على ذلك. يحتاج طرفيّةً وPython 3.11 فأحدث، وهو بالضبط الاحتكاك الذي وُجد تطبيق سطح المكتب ليزيله؛ لكن إن كان كلاهما عندك أصلًا فهو الطريق الأقصر، وبقيّة هذه الملاحظة لا تعنيك.",
avoidLink: "جرّبه في خمس دقائق",
more: "الشرح الكامل، وكيف تتحقّق ممّا نزّلته",
},
},

fr: {
rev: "2026-08-20.3",
translatedFromRev: "2026-08-20.3",
rev: "2026-08-20.4",
translatedFromRev: "2026-08-20.4",
title: "Télécharger keel — macOS et Windows",
description:
"Téléchargez keel pour macOS ou Windows. Version et liens viennent de GitHub Releases au build ; le parcours en cinq minutes depuis les sources est là aussi.",
Expand Down Expand Up @@ -273,18 +285,24 @@
title: "Votre ordinateur va vous avertir à propos de ce téléchargement",
lead: "Les builds macOS et Windows ne sont pas signés, donc votre système refusera la première ouverture en disant qu'il ne peut pas vérifier le développeur. Rien n'est cassé et rien n'a été détecté — votre ordinateur ne sait simplement pas qui a écrit le programme.",
reason:
"La signature de code est un certificat payant. Celui d'Apple coûte 99 $ par an, chaque année, et keel n'en a pas les moyens aujourd'hui. Il n'existe ni offre moins chère ni option gratuite pour les projets open source, et un certificat que nous fabriquerions nous-mêmes ne servirait à rien : macOS ne fait confiance qu'aux certificats émis par Apple.",
"La signature de code est un certificat payant, et keel n'a les moyens ni de l'un ni de l'autre : celui d'Apple coûte 99 $ par an, et Azure Trusted Signing pour Windows environ 120 $ par an — plus cher qu'Apple, et depuis 2024 il n'accorde même pas de passe-droit immédiat auprès de SmartScreen, la réputation s'acquérant au volume de téléchargements dans le temps. Il n'existe ni offre moins chère ni option gratuite pour l'open source sur l'une ou l'autre plateforme, et un certificat que nous fabriquerions nous-mêmes ne servirait à rien : macOS ne fait confiance qu'aux certificats émis par Apple.",
macosTitle: "macOS",
macosSteps: [
"Double-cliquez sur keel. macOS refuse, en disant qu'il ne peut pas vérifier le développeur.",
"Ouvrez le .dmg téléchargé, puis glissez keel.app dans votre dossier Applications.",
"Éjectez l'image disque.",
"Ouvrez Applications et double-cliquez sur keel. macOS refuse ; cliquez sur Terminé.",
"Ouvrez Réglages Système → Confidentialité et sécurité.",
"Descendez jusqu'au message concernant keel et cliquez sur Ouvrir quand même.",
"Vous ne le faites qu'une seule fois.",
"Descendez jusqu'à la section Sécurité. Une ligne indique que keel a été bloqué, avec un bouton Ouvrir quand même à côté. Cliquez dessus.",
"Authentifiez-vous, puis cliquez encore une fois sur Ouvrir quand même dans la boîte de dialogue qui suit.",
"Vous ne le faites qu'une seule fois. Sur macOS Sequoia (15) et versions ultérieures, le clic droit puis Ouvrir ne fonctionne plus comme raccourci — Apple a supprimé ce chemin délibérément.",
],
windowsTitle: "Windows",
windowsSteps: [
"Lancez l'installeur. SmartScreen affiche « Windows a protégé votre ordinateur ».",
"Cliquez sur Informations complémentaires, puis Exécuter quand même.",
"Avant d'extraire, clic droit sur le .zip téléchargé → Propriétés.",
"En bas de l'onglet Général, cochez Débloquer si la case est présente, puis OK. C'est l'étape que l'on oublie, et la sauter fait revenir l'avertissement à un lancement ultérieur.",
"Clic droit sur le .zip → Extraire tout…, vers un dossier qui vous appartient — par exemple C:\\\\Users\\\\<vous>\\\\keel. Pas Program Files : keel n'a pas besoin des droits administrateur et ne doit pas les recevoir.",

Check warning on line 303 in src/i18n/pages/install.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

`String.raw` should be used to avoid escaping `\`. 


See more on https://sonarcloud.io/project/issues?id=CodeGateSoftware_keeltrading.com&issues=AaAhFjRfNlxoHLnTa04Z&open=AaAhFjRfNlxoHLnTa04Z&pullRequest=27
"Ouvrez le dossier extrait et double-cliquez sur keel.exe.",
"Si SmartScreen apparaît — « Windows a protégé votre ordinateur » — cliquez sur Informations complémentaires, puis Exécuter quand même.",
],
verifyTitle: "Vérifiez d'abord ce que vous avez téléchargé",
verifyLead:
Expand All @@ -297,9 +315,9 @@
"Cela ne signifie pas que votre ordinateur a trouvé un problème. Rien n'a été analysé et rien n'a été détecté.",
"Cela ne signifie pas que l'application se comporte différemment. Un build signé et un build non signé de la même version sont le même programme.",
],
avoidTitle: "Ou évitez complètement l'avertissement",
avoidTitle: "D'abord — vous n'avez peut-être pas à vous en occuper",
avoidBody:
"Le parcours en cinq minutes depuis les sources, ci-dessous, installe le même moteur sans installeur et sans avertissement, parce que rien n'est téléchargé en tant qu'application — pip et uv récupèrent directement les wheels publiées. Il faut un terminal et Python 3.11+, ce qui est précisément la friction que l'application de bureau existe pour supprimer ; mais si vous avez déjà les deux, c'est le chemin le plus court.",
"Le parcours en cinq minutes ci-dessous installe le même moteur sans installeur et sans avertissement, sur aucune plateforme, parce que rien n'est téléchargé en tant qu'application — pip et uv récupèrent directement les wheels publiées, et aucun système d'exploitation n'y objecte. Il faut un terminal et Python 3.11 ou plus, ce qui est précisément la friction que l'application de bureau existe pour supprimer ; mais si vous avez déjà les deux, c'est le chemin le plus court et le reste de cette note ne vous concerne pas.",
avoidLink: "Essayez-le en cinq minutes",
more: "Explication complète, et comment vérifier ce que vous avez téléchargé",
},
Expand Down
Loading
Loading