Why Windows shows a warning

Windows may stop the NavuTron installer with a SmartScreen warning. Do not brush it aside: before going on, verify the file as explained on this page.

What happens

When you start the installer, Windows may show a SmartScreen window saying it protected your PC, without offering a button to go on straight away.

SmartScreen judges programs by the reputation of their publisher and file. A new program, given to few people, with a publisher Windows cannot identify, has no reputation yet.

Image coming soon

The SmartScreen window reporting an unrecognised app

Why the installer is self-signed

The NavuTron installer is signed with a self-signed certificate: a certificate we created ourselves, not issued by a certificate authority that Windows recognises. This is why Windows cannot confirm who published the file and lists the publisher as unknown.

The risk is real. Anyone can create a self-signed certificate with any name, so that signature alone does not prove the file comes from us or that nobody has changed it. The warning is doing its job: Windows cannot vouch for this file.

What does prove it is the minisign signature described below. Choose “Run anyway” only for a file downloaded from your personal link and verified.

How to verify the installer

Along with the installer you receive a file with the same name and the .sig extension: it is the installer's minisign signature, made with the NavuTron key. It is the same kind of signature the app checks before installing an update.

The public key to verify it comes with your personal link, in the email: it is a single line of text starting with RW, ready to use with minisign -P. In the commands, replace X.Y.Z with the version and PUBLIC_KEY with that line.

Install minisign, the verification tool, for example with Scoop or Chocolatey, or from the project's website: minisign
The .sig file holds the signature encoded in base64. In PowerShell, in the folder with both files, extract the signature file that minisign reads:
```
$f = "Drokaris_X.Y.Z_x64-setup.exe"
[IO.File]::WriteAllBytes("$PWD\$f.minisig", [Convert]::FromBase64String((Get-Content -Raw "$f.sig").Trim()))
```
In the same window, verify the installer with the public key:
```
minisign -Vm $f -x "$f.minisig" -P PUBLIC_KEY
```
If the signature is valid, minisign confirms it and shows the trusted comment: it must contain the exact name of the file you are about to install, with its version. If minisign reports an error, or the name is different, do not run the installer.

Signing certificate (optional) Download the certificate (.cer)

To check the installer's signature: open the Properties of the downloaded file, then Digital Signatures, Details, View Certificate, and compare the thumbprint with the one below. You do not need to install the certificate.

Thumbprint (SHA-1): 62 37 CD 6A 21 D0 4C 13 48 E4 6E 44 50 77 AB 28 8E 34 71 05
SHA-256: 6C 2D 40 8A 46 DF D8 96 89 C7 85 A8 5B B7 D2 AA 18 2B 94 A2 82 AD 57 F7 AA E3 0C 5D D5 DC 44 4B

How to proceed in 3 steps

More info

In the SmartScreen window, select “More info”: the file name and the publisher, listed as unknown, appear.

Image coming soon
The SmartScreen window with the More info link
Run anyway

Check that the file name is the one you verified, then select “Run anyway”.

Image coming soon
The SmartScreen window with the file name, the unknown publisher and the Run anyway button
Install

NavuTron installs for your user account, without asking for administrator rights.

What NOT to do

Do not turn off SmartScreen: it also protects you from the other programs you download.
Do not run a NavuTron installer that came from another source or from a link that is not yours.
Do not choose “Run anyway” if the signature check failed: delete the file.