01 · Verify
Check the release
Download xucRun-Installer-<Version>-x64.exe and SHA256SUMS.txt from the same official release and compare the SHA-256 values exactly.
Before installation
Sign locally.
Then install.
The Core installer automatically uses a certificate created on your computer. Its private key stays local, and the developer certificate is not installed as a trusted root certification authority.
Security boundary
The checksum comes first.
Local signing does not establish the origin of the download. First compare the unchanged xucRun-Installer-<Version>-x64.exe SHA-256 checksum with its entry in SHA256SUMS.txt from the same official GitHub release. <Version> represents the version number shown there.
Start the installer only when the values match exactly. Keep the original file as an unchanged reference.
Get-FileHash .\xucRun-Installer-<Version>-x64.exe -Algorithm SHA256
Design decision
Trust stays on your computer.
The original developer signature makes subsequent changes to the published package detectable. Because the developer certificate is self-signed, however, it would have to be installed permanently as a trusted root certification authority and trusted publisher for Windows to consider that signature valid.
Local signing avoids this permanent developer trust. The local certificate has a non-exportable private key and is installed as a trust anchor only on your computer. A later compromise of the developer certificate therefore does not automatically extend the trust already established on your system.
The Core installer automatically creates the local xucRun standard certificate or reuses the existing valid certificate. The developer certificate is not offered as a trust anchor. The separate Tray installer then uses the same local signer.
02 · Start
Run the installer
Start the downloaded xucRun-Installer-<Version>-x64.exe and confirm User Account Control.
03 · Verify and sign
Use a local certificate
The installer verifies all embedded signatures, creates or reuses the local certificate, and re-signs temporary package files with it.
.\xucRun-Installer-<Version>-x64.exe
04 · Install
Install the verified package
Only after successful re-signing does the installer set up the included components in the selected language.
Automatic verification
Core components. One signer.
The installer verifies the embedded Core components, signs temporary copies with the local standard certificate, and installs them only after every new signature is valid. Local machine-bound signing does not require an online timestamp service.
Raw-package security notice: Deliberately start Windows PowerShell as administrator before invoking Install-xucRun.ps1 directly. The script does not elevate itself from a user-writable package directory and rejects a non-elevated invocation.
xucRun.exe,xucRunBroker.exe, andxucRunApproval.exe- the two Core language DLLs below
Languages Install-xucRun.ps1
Before installation, the installer checks again that every Core file has the same valid local signature. The optional Tray is installed separately and bound to the same signer.
Local certificate
The key stays on this computer.
RSA 3072 · SHA-256
Non-exportable and reusable
The Core installer creates a non-exportable private key in the local computer certificate store and establishes trust only there. Later updates reuse the same valid certificate. A different computer deliberately receives a new local identity.
The self-signed certificate does not establish public Microsoft SmartScreen reputation. Windows may therefore still display an application warning despite a correct local signature.
Do not continue
Any mismatch is a stop signal.
Do not install the package if the xucRun-Installer-<Version>-x64.exe checksum differs, embedded files are missing, signers differ, or an existing signature cannot be verified. Delete the file and download the official release again.
The Windows SDK and signtool.exe are not required for the user workflow.