Code Signing Policy

The installation packages of 3MF Katalog Manager are currently not signed with a code signing certificate. This page explains what that means and how you can still check that a file is genuine.

What that means

Windows therefore shows a SmartScreen warning on first start, and macOS shows a Gatekeeper message. Some antivirus programs treat new, unsigned programs as suspicious as a precaution. What helps is explained in the FAQ on the home page and in the wiki.

Why isn’t it signed?

Signing certificates cost money. Free signing for open-source projects has not been granted to this young project so far; we plan to apply again once the project is better known.

How to check a file

• Download packages only from the project’s releases page or through the download buttons on this website.
• Compare the file’s SHA256 checksum with SHA256SUMS.txt in the same release. Windows: certutil -hashfile filename SHA256. macOS and Linux: shasum -a 256 filename.
• The packages are built from the public source code in GitHub Actions. The source code is under the MIT license.
• If you want to be extra careful, upload the file to VirusTotal before installing.

Updates inside the app

Updates the app downloads itself are signed with the project’s own key (files ending in .sig in the release). The app only installs an update if that signature matches. This applies independently of a code signing certificate.

Privacy

The app contains no telemetry. Network access only happens to check for updates (a request to GitHub) and for connections you set up yourself, for example to printers on your local network. More in the privacy policy.

Questions and reports

For questions or reports about the authenticity of a file: maintainer@3mfkatalog.de.

Last updated: October 2026