YASB fails to start with Smart App Control enabled because QtWidgets.pyd is unsigned

[trnkum]

Windows version

Windows 11

Windows OS build

25H2

YASB version installed

YASB 2.0.5 x64

Describe the bug

YASB 2.0.5 fails to start when Windows Smart App Control is enabled.

QtWidgets.pyd is blocked by Code Integrity:
Event IDs: 3033, 3077
Policy ID: {0283ac0f-fff1-49ae-ada1-8a933130cad6}

C:\Program Files\YASB\lib\PyQt6\QtWidgets.pyd is unsigned,
while yasb.exe and Qt6Widgets.dll have valid signatures.

Running PyQt6 6.10.2 directly with Python 3.14 produces the same error:
ImportError: DLL load failed while importing QtWidgets:
The file was blocked by application control policy.

Relevant log output

YASB startup error:

Traceback (most recent call last):
  File "D:\a\yasb\yasb\venv\Lib\site-packages\freeze_core\initscripts\__startup__.py", line 137, in run
  File "D:\a\yasb\yasb\venv\Lib\site-packages\freeze_core\initscripts\console.py", line 27, in run
  File "main.py", line 11, in <module>
  File "D:\a\yasb\yasb\venv\Lib\site-packages\qasync\__init__.py", line 84, in <module>
ImportError: DLL load failed while importing QtWidgets:
This file was blocked by application control policy.

Windows Code Integrity event:

Event ID: 3077
Code Integrity determined that a process
(\Device\HarddiskVolume6\Program Files\YASB\yasb.exe)
attempted to load
\Device\HarddiskVolume6\Program Files\YASB\lib\PyQt6\QtWidgets.pyd
that did not meet the Enterprise signing level requirements or
violated code integrity policy.

Policy ID: {0283ac0f-fff1-49ae-ada1-8a933130cad6}

Event ID: 3033
Code Integrity determined that yasb.exe attempted to load
C:\Program Files\YASB\lib\PyQt6\QtWidgets.pyd,
which did not meet the Enterprise signing level requirements.

Environment:
- YASB Reborn 2.0.5 x64
- Windows 11, OS build 26200
- Smart App Control: On
- Visual C++ x64 runtime: Installed
- Reinstalling YASB did not resolve the issue

Signature verification:
- C:\Program Files\YASB\yasb.exe: Valid
- C:\Program Files\YASB\lib\PyQt6\Qt6\bin\Qt6Widgets.dll: Valid
- C:\Program Files\YASB\lib\PyQt6\QtWidgets.pyd: NotSigned

Minimal reproduction with Python 3.14 and PyQt6 6.10.2:

uv run --python 3.14 --with pyqt6==6.10.2 python -c "from PyQt6.QtWidgets import QApplication"

Result:
ImportError: DLL load failed while importing QtWidgets:
This file was blocked by application control policy.

[yasb-support]

Hey there! Thanks for the detailed bug report — this is a really thorough investigation. I took a look through the repository and build pipeline to understand what's going on.

What's happening:

I can confirm the issue after examining the build workflow (.github/workflows/windows.yaml) and the build configuration (src/build.py). Here's the signing gap:

• ✅ yasb.exe, yasbc.exe, yasb_themes.exe — signed via SignPath
• ✅ YASBTrayHook.dll — signed via SignPath
• ✅ Qt6Widgets.dll — signed (this is the native Qt DLL shipped by PyQt6)
• ❌ QtWidgets.pyd (and all other PyQt6 .pyd files) — not signed

The .pyd files are Python extension modules (essentially DLLs with a .pyd extension). cx_Freeze copies them into lib/PyQt6/ inside the install directory. When YASB loads, Python imports these modules, and Windows Code Integrity checks each .pyd file's digital signature before allowing it to load. Since they're unsigned, Smart App Control blocks them.

Workarounds you can try right now:

1. Temporarily disable Smart App Control — You can turn it off in Windows Security → App & browser control → Smart App Control, restart YASB, then re-enable it if needed. (Some .pyd files may get cached after first successful load.)

2. Add an exclusion — In Windows Security → Virus & threat protection → Manage settings → Exclusions, add an exclusion for C:\Program Files\YASB\.

3. Run from source with Python — As mentioned in the Installation docs, installing via pip install . and running with python src/main.py bypasses the bundled .pyd signing issue since the files are loaded from your Python environment (though you might encounter the same issue with pip-installed PyQt6 if Smart App Control is very strict).

What needs to happen on the maintainer side:

The build pipeline needs to be updated to include all PyQt6 .pyd files in the SignPath signing step (or at minimum sign them alongside the EXEs). This would need signing configuration for .pyd files, which SignPath supports since they're just PE files with a different extension.

I've added the Needs investigation label so the maintainers take a look at this. Thanks again for the excellent debugging work!

YASB Support Bot