Compare the SHA-256 of the exact installer on your disk with the digest shown for that release asset. A match establishes that the bytes match the published asset; it does not by itself prove that software is harmless or suitable for your Windows build.
What to do
- Open the assets section for the same version as your filename. Do not compare a 4.4.198 installer against a digest from a later release or a source-code archive.
- In PowerShell, run Get-FileHash against the completed download. Include the full path in quotes, especially when the Downloads folder name or username contains spaces.
- Compare all 64 hexadecimal characters with the project asset digest. Letter case is not significant, but a missing or different character means the values do not match.
- When the values differ, do not run the file. Delete that copy and obtain a fresh one from the project asset, then calculate the hash again.
Get-FileHash -LiteralPath "$env:USERPROFILE\Downloads\OpenShellSetup_4_4_198.exe" -Algorithm SHA256Check the result
For OpenShellSetup_4_4_198.exe, the GitHub asset page publishes a4d2d4459de55b5e962ba2a14f7bb794170511649138173dfa72949837b48c3f. Treat this as a version-specific reference.
Limits & precautions
This website has read the published digest; it has not independently downloaded and scanned the executable in a Windows laboratory. Signature inspection and malware scanning are separate checks.
Questions & answers
Can renaming a file change its SHA-256?
Changing the filename alone does not change its contents, so the content hash stays the same.
Is the source ZIP the installer?
No. A source archive and the executable are different assets with different hashes.
Sources & scope
Documentation checked October 30, 2026. These instructions are documentation-led, not a claim of hands-on testing on your Windows build.