Directories are one route. Windows and Linux software also reaches people through each platform’s own store and its package managers, and each publishes its rules.
Windows: sign the installer and clear warnings
SmartScreen warns on downloaded files that have no established reputation, and it looks at both the program and the certificate that signed it. Microsoft’s Artifact Signing service issues Public Trust certificates to organizations in a listed set of countries, including the US, Canada, the EU and the UK; individual developers must be located in the US or Canada. If Microsoft Defender flags your installer by mistake, submit it as a software developer on Microsoft’s file submission page so analysts can check it.
- Identity validation for Artifact Signing can only be completed in the Azure portal, not with the Azure CLI.
- For an individual, validation needs an Azure billing account of type Individual whose legal name and address match your government ID.
Sources: Microsoft Learn: Artifact Signing quickstart · Microsoft Learn: Microsoft Defender SmartScreen overview · Microsoft Security Intelligence: Submit a file for malware analysis
Microsoft Store: no fee, EXE and MSI accepted
Start at storedeveloper.microsoft.com: the new onboarding flow charges no registration fee for individual or company accounts, and individuals verify with a government ID and a selfie. The Store has allowed unpackaged apps since June 2021: share a link to an offline .msi or .exe installer whose hosted binary stays unchanged, and the certification team tests it. Certification can take up to three business days, and listings appear within about 15 minutes on average once it passes. You can use your own commerce platform and keep 100% of non-game revenue, or Microsoft’s at 15% for apps.
- Microsoft recommends MSIX packaging and says it brings free binary hosting and code signing from Microsoft.
- Pick an individual account for non-business use and a company account for business use; switching from individual to company is not supported.
Sources: Microsoft Learn: Get started with Microsoft Store · Microsoft Learn: Open a developer account
Microsoft Store listing and beta testing
For an MSI or EXE submission, the Store listing needs a description of up to 10,000 characters and at least one screenshot; Microsoft recommends four or more. What’s new allows 1,500 characters, product features take up to 20 entries of 200 characters, and a short description can run to 1,000 though some views show only 270. Keep HTML, code and URLs out of the description. To test first, use a private audience, package flights after release, or hide the app and hand out promotional codes (up to 1600 redemptions per app in six months).
- A private audience is the only option that hides the listing even from someone who has the direct link.
- You cannot revoke access after a tester has downloaded the app, and testers get any later updates you publish.
Sources: Microsoft Learn: Create Store listings for an MSI or EXE app · Microsoft Learn: Beta testing and targeted distribution
winget, Chocolatey and Scoop
winget takes a YAML manifest as a pull request to microsoft/winget-pkgs. Automated validation runs first and a moderator reviews the result; the installer must come straight from the publisher’s website and support non-interactive modes. Chocolatey runs automated validation, verification and cleanup checks, then human review of new versions unless the package comes from a trusted source. Scoop asks you to open an issue first and comment /verify on the pull request.
- winget closes a pull request if you leave a Needs-Author-Feedback label unanswered for 10 days.
- Chocolatey rejects a package left in Waiting status: a reminder after 20 days and automatic rejection 15 days later.
- Scoop manifests need a valid SPDX license and an autoupdate setup, and you should test install, uninstall and persistence.
Sources: Microsoft Learn: Submit your manifest to the repository · Chocolatey docs: Moderation · Scoop: Contribution guidelines
Linux: Flathub and the Snap Store
Flathub takes new apps as a pull request against the new-pr branch of flathub/flathub, reviewed by volunteers whose response time varies. Its inclusion policy rejects console software, thin web wrappers and tray-only apps, expects a reverse-DNS app ID tied to a domain you control, and generally turns away apps with very little development history. It also bars AI tools from opening submission pull requests. A Snap is uploaded from the command line; the store runs an automated review and publishes at once if it passes, though classic confinement needs prior approval.
- Flathub can reject a submission at any stage and recall one after merging if it proves unsuitable.
- After approval Flathub invites you to the new repository; enable two-factor authentication on GitHub and accept within one week.
Sources: Flathub docs: Requirements · Flathub docs: Submission · Snapcraft docs: Publish a snap
Launch posts and press
Show HN is for things people can run on their computers; skip landing pages and sign-up walls, and don’t ask friends to upvote. Product Hunt is free to use, prohibits company accounts, and forbids asking people directly to upvote; ask them to visit and comment instead. For Linux apps, OMG! Ubuntu tells application developers and PR people to email its contact address directly, and it has a separate route for news tips.
- Show HN says upgrades such as a point release generally aren’t substantive enough; a major overhaul is probably fine.
- Product Hunt says you can launch again as often as you have new significant product iterations.
Sources: Hacker News: Show HN guidelines · Product Hunt: Launch Guide · OMG! Ubuntu: Contact
Facts checked Oct 9, 2026 against the sources linked in each section.