Installing CViper Light

Getting past the Windows warning

The first time you download and run CViper Light, your browser and then Windows may stop and ask whether you are sure. That is expected for a new app like this one. Here is why it happens, what to press, and how to check the file is the one we published.

Why the warning appears. Windows trusts an installer more when it is signed with a paid code-signing certificate, or when it comes from the Microsoft Store. CViper Light is new, it is not in the Store yet, and its installer is not signed with one of those certificates. So Windows does not recognise who made it, and asks you to decide.

The warning is about how well known the file is, not something Windows found inside it. It does not mean the file is harmful — and it does not prove it is safe either. If you want to be sure, check the file as shown below before you run it.

1. Keep the download

Get the installer from the Download button on the home page, or download it here. It is one file, CViper-Light-Windows-x64.exe.

Your browser may say the file “isn't commonly downloaded”, and may not save it until you say so. The exact words change between versions, but the steps are much the same:

  • Microsoft Edge — in the downloads list, hover over the file, open the “…” menu and choose “Keep”. If Edge asks again, choose “Show more”, then “Keep anyway”.
  • Google Chrome — in the downloads list, choose “Keep” (or “Download suspicious file”) beside the file.

2. Run it past SmartScreen

When you open the installer, a blue window titled “Windows protected your PC” may appear. It shows only a “Don't run” button at first.

  1. Choose More info. The window now shows the app's file name, and the publisher as “Unknown publisher” — that is the missing certificate described above.
  2. Choose Run anyway. The CViper Light installer opens.

If you would rather not see this at all, a Microsoft Store listing is on its way.

3. Check the file, if you want to be sure

Every file on a CViper Light release has a SHA-256 checksum: a long string of letters and numbers worked out from the file's exact contents. If one byte of the file were different, the checksum would be completely different.

  1. Open the releases page. The newest release is at the top. Under its files, find CViper-Light-Windows-x64.exe; the checksum shown beside it starts sha256:.
  2. Open PowerShell in the folder you downloaded to (usually Downloads) and run: 
    Get-FileHash .\CViper-Light-Windows-x64.exe
  3. Compare the Hash it prints with the checksum on the release page, after the sha256:. PowerShell prints capital letters and GitHub prints small ones; that difference does not matter. Every other character must match. If they do not, do not run the file — delete it and download it again, and tell us on GitHub Issues if it still does not match.

The file on the release page was built in public by the app's own release workflow, so you can see exactly what produced it. The source code is open too, on GitHub.