Verify the download
No file of the Game is signed by the operating system. Instead, they all come from the repository's public CI and carry two proofs anyone can check: the SHA-256 checksum and the GitHub attestation.
Why it is not signed
Signing an app for Windows takes a code signing certificate, paid every year; Quiz your slop is free and open source and does not carry that cost. On Linux, AppImage and .deb files distributed outside the stores have no system signature either.
Instead, every version is built by the repository's release workflow, from a tag, and published on GitHub Releases with SHA256SUMS.txt and a provenance attestation for each file.
The SmartScreen warning (Windows)
When you open the installer, Windows may show the blue "Windows protected your PC" screen. It appears for programs without a paid signature or not yet downloaded much — it does not mean the file has a virus.
- If you like, check the file first (sections below).
- On the SmartScreen screen, click "More info".
- Check that the app is quiz-your-slop-windows-x64-setup.exe and click "Run anyway".
Check the checksum (SHA-256)
Download SHA256SUMS.txt of the same version into the folder where the Game file is. It has one line per file: the SHA-256 hash and the name.
Linux: checks the files in the folder that are on the list (it should say OK).
sha256sum -c --ignore-missing SHA256SUMS.txt
Windows (PowerShell): prints the hash, which must match the installer line in SHA256SUMS.txt (upper or lower case does not matter).
Get-FileHash .\quiz-your-slop-windows-x64-setup.exe -Algorithm SHA256
Check the origin (GitHub attestation)
The checksum proves the file arrived whole; the attestation proves where it came from: that it was built by this repository's release workflow, at which commit. With the GitHub CLI (gh) installed and signed in, run the command with the name of the file you downloaded. If the file was swapped or changed, the verification fails.
Any system, with gh:
gh attestation verify quiz-your-slop-windows-x64-setup.exe --repo Thyago331/quiz-your-slop
What about automatic updates?
When it opens, the Game asks GitHub Releases whether there is a new version and, if you accept, downloads and installs it with one click. It only installs a file signed with the project's key, whose public part ships inside the Game: a file swapped on the way is refused.