Check an installer signature on the actual executable, not the Verified badge on a GitHub commit. A signed source commit and a signed Windows installer are different things. The installer signing status can also differ between Open-Shell versions.
What to do
- Right-click the downloaded executable and open Properties. Look for Digital Signatures; its absence is a reason to investigate, not evidence that a browser failed to download correctly.
- Run Get-AuthenticodeSignature in PowerShell on that exact file and inspect Status and SignerCertificate. Do not substitute the signature of a similarly named shortcut.
- Compare the result with the release notes and relevant project discussion. Later builds mention signed binaries; do not assume that statement covers every earlier asset.
- When a status is unexpected, stop and verify the source, hash, and release tag. Keep Windows protection enabled while resolving the discrepancy.
Get-AuthenticodeSignature -LiteralPath "$env:USERPROFILE\Downloads\OpenShellSetup_4_4_198.exe" | Format-List Status,StatusMessage,SignerCertificateCheck the result
A valid result should refer to the file you downloaded and a certificate that can be inspected. Save the status text with the filename if asking the project for help.
Limits & precautions
No signing certificate or Valid result is asserted for a file not inspected locally. A valid signature authenticates a signer and file integrity; it is not a guarantee of universal safety.
Questions & answers
Does GitHub Verified mean the EXE is signed?
No. It can refer to the commit signature rather than Authenticode on the executable.
Should I ignore an unsigned-installer warning?
Investigate the exact release and Windows protection policy instead of automatically bypassing the warning.
Sources & scope
Documentation checked October 30, 2026. These instructions are documentation-led, not a claim of hands-on testing on your Windows build.