Do not turn off Windows protection just to run a blocked installer. Confirm the exact release asset, inspect the warning, and distinguish a signature or reputation decision from a damaged download. The project has a discussion about signing and the 4.4.198 installer.
What to do
- Write down the exact warning and the Windows security feature reporting it. Avoid relying on a screenshot that hides the file name or publisher details.
- Compare the source URL with the project release assets. Check the SHA-256 against the value published for the exact installer version; do not use a hash from another release.
- Inspect the Authenticode status separately. A GitHub Verified commit badge does not tell you whether the downloaded EXE has a valid Windows digital signature.
- Read the project signing discussion and relevant release notes. On a managed PC, ask the administrator to review the file instead of changing application-control policy yourself.
Check the result
Confirm that provenance, exact filename, published digest, and signature result have been recorded. If Windows still blocks the file, stop rather than treating the warning as a cosmetic error.
Limits & precautions
A matching SHA-256 proves only that your file matches the referenced bytes; it is not a malware scan or a guarantee of safety. This site has not run or certified the installer.
Questions & answers
Should I switch off antivirus or Smart App Control?
No. Investigate the warning and source without bypassing protective policy.
Does GitHub Verified mean the EXE is signed?
No. Commit or tag verification is different from an Authenticode signature on the installer.
Sources & scope
Documentation checked October 30, 2026. These instructions are documentation-led, not a claim of hands-on testing on your Windows build.