Dokumentacja
Why Windows warns before the first launch, and how to check the file
When you start the installer or the portable exe for the first time, Windows shows a blue SmartScreen box: Windows protected your PC, unknown publisher. This page says why that happens, what it does and does not mean, and how to check for yourself that the file is the one published on this site.
Zaktualizowano · Vitalii Yemets
What the warning means
SmartScreen compares a file's signature and reputation against Microsoft's records. HoldToType's builds carry no code-signing certificate, so there is no publisher name to show, and a new release has no reputation yet. The warning does not say the file is harmful; it says Windows cannot vouch for who made it. Programs from large companies pass because they buy a certificate, and the certificate costs a few hundred dollars a year plus an identity check, which is why a one-person open-source program often goes without.
Why the builds are not signed yet
Signing is on the roadmap in the form of a Microsoft Store build: the Store signs packages itself, and the warning goes away for that route. Until then every release publishes the SHA-256 of its files on the releases page, and the source is on GitHub, so the exe can be built from the same code by anyone.
How to check the file
Open PowerShell in the folder with the downloaded file and run:
Get-FileHash .\holdtotype-setup.exe -Algorithm SHA256
Compare the hash it prints with the one on the releases page next to the same version. If the two strings match, the file is byte for byte the one published there. If they differ, do not run it: download again from GitHub, and if it differs again, write an issue.
How to run it anyway
- In the SmartScreen box click More info.
- Click Run anyway. The box does not come back for that file.
- If the button is missing, your organisation has locked SmartScreen down; use the portable archive from releases, which needs no installer, or ask the administrator.
The portable way around it
The portable archive is the same program in a folder: unpack it anywhere, including a USB stick, and run the exe. Windows may still show the warning on the first launch of the exe, with the same More info and Run anyway. Nothing is written outside the folder and no administrator rights are needed. Deleting the folder removes the program.
Building it yourself
If checking a hash is not enough, build the exe from the sources with one script and Docker Desktop; the build page walks through it. The result is your own build, from code you can read, and SmartScreen has no say in it.
Questions
Is the warning a virus alert?
No. A virus alert comes from Defender with a red box and a threat name. SmartScreen's blue box says only that the publisher is unknown.
Will the warning ever go away?
For the Store build, yes, once it is published; for the direct download, once a signing certificate is bought or the file has gathered enough reputation, which takes many downloads.
Does HoldToType need administrator rights?
The installer asks for them to write a shortcut and an uninstall entry. The portable exe does not need them at all.
Download and check the hash
The file, the SHA-256 and the sources are all on the same site.