# Installing on Windows, and the SmartScreen warning

> Why Windows shows a warning before installing Railbase today, how to verify the download yourself, and what changes once the code-signing certificate is in place.

_Updated: 2026-08-19_

Railbase for Windows ships as an MSI installer. Today that installer is **not
yet Authenticode code-signed**, so Windows shows a warning before it runs. This
page explains exactly what that warning means, how to check the file yourself
instead of taking our word for it, and what will change when the certificate is
in place.

We would rather tell you this here than let you meet an unexplained security
dialog and wonder what you just downloaded.

## What the warning actually says

When you run the MSI you may see a blue full-screen dialog:

> **Windows protected your PC.** Microsoft Defender SmartScreen prevented an
> unrecognised app from starting.

The word doing the work is *unrecognised*. SmartScreen is a **reputation**
check, not a malware scan:

- It does **not** say the file contains malware.
- It does **not** say the file was modified or tampered with in transit.
- It says Microsoft has not yet seen this exact file, signed by a certificate it
  already trusts, enough times to vouch for it.

An unsigned installer from a small vendor always starts in that state. A signed
one from a vendor with an established certificate does not.

## Verify the download yourself

You do not have to trust the dialog *or* us. Every release publishes a SHA-256
checksum for each file, and the checksum is generated from the same bytes we
upload. Check it before you install:

```powershell
Get-FileHash .\railbase_windows_amd64.msi -Algorithm SHA256
```

Compare the value with the one listed for your version on the release page in
your account. If the two match, the file you have is byte-for-byte the file we
published. If they differ, **stop** — delete the file and contact support; do
not install it.

## Installing past the warning

Once the checksum matches:

1. On the SmartScreen dialog choose **More info**.
2. Choose **Run anyway**.
3. Approve the Windows administrator prompt. The installer writes to
   `C:\Program Files\Railbase`, adds a Start-menu entry, and registers Railbase
   in **Installed apps** so it can be removed the normal way.

After installation Railbase runs in the notification area (system tray). It
starts automatically when you sign in, restarts itself if it stops
unexpectedly, and opens the admin panel in your browser on first run.

Your data lives in `%APPDATA%\Railbase` on that machine — the installer never
touches it, including on uninstall.

## Removing Railbase

Use **Settings ▸ Apps ▸ Installed apps ▸ Railbase ▸ Uninstall**, or the tray
menu's *Uninstall Railbase*. That removes the program, the Start-menu entry and
the autostart entry. Your data folder is left in place deliberately; delete
`%APPDATA%\Railbase` yourself if you want it gone.

## What changes when the certificate lands

An Authenticode code-signing certificate is being procured. Once releases are
signed with it:

- The publisher name (Silkway Tech, LLC) appears in the Windows prompt instead
  of "Unknown publisher".
- The SmartScreen warning disappears for good on an EV certificate, and fades as
  reputation accumulates on a standard one.
- Nothing else about the installer changes — the same MSI, the same layout, the
  same uninstall path.

Until then the checksum above is the honest way to confirm what you are running,
and it stays valid afterwards too.

## macOS and Linux

Neither platform has this gap:

- **macOS** installers are signed and notarized by Silkway Tech LLC, and the
  notarization ticket is stapled — they install offline with no prompt.
- **Linux** packages are OpenPGP-signed; the public key is linked from the
  download page so `apt`/`dnf` can verify signatures.