armslengthVersionsPricingDocumentationOpen the app

Windows or macOS warned me about the download

Most people never see the warnings below. The one-line installer from the setup guide downloads the program in a way Windows and macOS do not flag, checks it, and installs it. The warnings appear when you download the program file in a web browser and open it yourself. One exception: Windows 11 with Smart App Control turned on blocks the program either way (see below).

Windows 11 with Smart App Control

If Smart App Control is on, Windows 11 blocks the program outright, whichever way you install it, until we ship a Microsoft-signed build. That is in progress. Do not turn Smart App Control off: Windows cannot turn it back on without resetting the computer. Meanwhile, email ops@armslength.dev and we will help you connect another way.

What the warning means

Windows and macOS warn about programs from publishers they do not recognise. armslength does not yet sign its program with a Microsoft or Apple developer certificate, so they cannot vouch for us. The warning does not mean the file is damaged or unsafe; it means the system cannot tell. Check the file yourself first (below), then decide.

Check the file in three steps

  1. Download SHA256SUMS and SHA256SUMS.sig for your release from armslength.dev/releases. This is a separate site from the download server; the two copies must match.
  2. Work out your file's fingerprint: on macOS or Linux shasum -a 256 <file>, on Windows PowerShell Get-FileHash <file> -Algorithm SHA256. It must equal that file's line in SHA256SUMS.
  3. Check that SHA256SUMS was signed by us: download allowed_signers (our public release key; its fingerprint is SHA256:C/okul9gv+3ZykRoQKMNcrDfQFh5qdZgzsQy3n8ahCA) and run ssh-keygen -Y verify -f allowed_signers -I release -n armslength-release -s SHA256SUMS.sig < SHA256SUMS. It must say “Good” signature. If anything does not match, do not run the program, and tell us at ops@armslength.dev.

Then, on Windows

On the blue “Windows protected your PC” screen, click More info. The publisher shows as “Unknown publisher” because we do not have a Microsoft certificate yet; check the file name is the one you checked above, then click Run anyway.

Then, on macOS

macOS says it could not verify the program and offers to move it to the Bin. Click Done. Open System Settings, then Privacy & Security, scroll down and click Open Anyway next to the message about bridge, and confirm.

Easier: use the one-line installer instead. It also refuses to install a file that fails its check.