Verify Your DEP Download
From DEP 0.20.2, the installer and every DEVlink program file in DEP are signed by DEVlink AB, verified publisher. This page shows how to check the signature and the SHA-256 checksum before you install, and how to allow-list DEP in your company.
What the signature tells you
DEP files are signed with Authenticode through Microsoft's Azure Artifact Signing (Public Trust). Microsoft validated DEVlink AB as a company before it issued the signing certificate. Every signature also carries a timestamp from Microsoft.
| Field | Value |
|---|---|
| Signer | CN=DEVlink AB, O=DEVlink AB, L=Falkenberg, S=Halland, C=SE |
| Signed files | DEPSetup-<version>.exe and every DEVlink program file it installs |
| Timestamp | Microsoft timestamping service |
Origin and integrity, nothing more. A valid signature proves that the file comes from DEVlink AB and has not been changed since it was signed. It is not a quality or safety certification of DEP.
Check the signature
Use any of the three methods below. Each must name DEVlink AB as the signer.
1. The Windows administrator prompt
If you install DEP for all users (All users on this PC), Windows asks for administrator approval and the prompt shows Verified publisher: DEVlink AB. If it shows Unknown or another publisher, select No.
Setup first asks who can use DEP. If you choose Only for me, no administrator rights are needed and Windows shows no prompt. Use method 2 or 3 instead.
2. File Explorer
- Open the propertiesRight-click
DEPSetup-<version>.exeand select Properties. - Open the signaturesOpen the Digital Signatures tab. The list shows DEVlink AB with a timestamp. If the tab is missing, the file is not signed: do not run it.
- Check the signatureSelect the entry and then Details. The dialog must say This digital signature is OK.
3. PowerShell
Open PowerShell in the download folder:
Get-AuthenticodeSignature .\DEPSetup-<version>.exe | Format-List Status, SignerCertificate, TimeStamperCertificateStatus must be Valid, and SignerCertificate must show the DEVlink AB subject in the table above. Any other status, for example NotSigned or HashMismatch, means that you must not run the file.
Compare the SHA-256 checksum
The checksum confirms that you have exactly the file that DEVlink released:
Get-FileHash -Algorithm SHA256 .\DEPSetup-<version>.exeCompare the result with the value for your version:
| Version | Installer | SHA-256 |
|---|---|---|
| 0.21.1 | DEPSetup-0.21.1.exe | 907975cfbcc8b6a7c1ebd851419c3860f3fd51b563db44befe02de898a193110 |
| 0.20.2 | DEPSetup-0.20.2.exe | 6704bb00622425d8ce71e0ba50665df99bc47bc759a7bd4881e4d487caa3fad7 |
If the values differ, do not run the file. Download it again or contact DEVlink. DEP 0.20.1 and earlier were unsigned builds. For those, compare the result with the .sha256 file that was delivered with the installer.
Check an installed copy
After installation, open Help → About DEVlink Engineering Platform. DEP checks its own code signature with Windows when the window opens. A correctly installed copy shows Signed by DEVlink AB · verified publisher. The link Verify this download in the same window opens this page.
Allow-list DEP in your company
If your IT department controls which programs may run (for example with AppLocker, Windows Defender Application Control or an endpoint security product), allow DEP by its publisher:
- Publisher: DEVlink AB.
- Do not allow-list by certificate thumbprint. The signing certificates are renewed every three days, so a thumbprint rule stops matching new releases.
- The timestamp keeps a signature valid after its certificate expires. Older signed releases therefore stay valid.
Windows SmartScreen
Windows may also show a SmartScreen prompt naming the publisher. Continue only after the signature and the checksum are both correct. If you are unsure, contact DEVlink before you run the file.