Windows
Windows 10 or 11, 64-bit.
The installer is signed with my own certificate, not one bought from a certificate authority, so each computer has
to trust that certificate once before installing.
The certificate can only sign programs, not websites, and it expires in September 2031. Windows shows its thumbprint
on the certificate's Details tab. It should be:
C3E8 4EF4 E5E5 AE72 2810 37AD 79F3 4B93 5F76 1B4F
1. Trust the certificate (once per computer)
Open PowerShell as administrator: right-click Start and choose Terminal (Admin), or Windows PowerShell (Admin) on
Windows 10. Then run these three lines. If you saved the certificate somewhere other than Downloads, change the path
in the first line.
$cer = "$env:USERPROFILE\Downloads\windows-codesign.cer"
Import-Certificate -FilePath $cer -CertStoreLocation Cert:\LocalMachine\Root
Import-Certificate -FilePath $cer -CertStoreLocation Cert:\LocalMachine\TrustedPublisher
Or click through it instead:
- Double-click
windows-codesign.cer and choose Install Certificate.
- Choose Local Machine, then Next. Windows asks for administrator permission.
-
Choose “Place all certificates in the following store”, click Browse and pick Trusted Root Certification
Authorities. Click Next, then Finish.
- Do steps 1 to 3 again, picking Trusted Publishers this time.
On a managed PC, IT can push the certificate with Group Policy or Intune instead.
2. Install
Run Bismuth-<version>-x64.msi. If SmartScreen stops it, right-click the file,
choose Properties and tick Unblock, then run it again. To check the signature first, run this in PowerShell. Its
Status should be Valid.
Get-AuthenticodeSignature .\Bismuth-<version>-x64.msi
Update
Run the new MSI. It replaces the installed version, and your settings stay.
Check the download
In PowerShell, this prints the file's SHA-256. It should match the one above.
Get-FileHash .\Bismuth-<version>-x64.msi