Verify Your DEP Download
From DEP 0.20.2, the installer and every DEVlink program file in DEP are signed by DEVlink AB, verified publisher. This page shows how to check the signature and the SHA-256 checksum before you install, and how to allow-list DEP in your company.
What the signature tells you
DEP files are signed with Authenticode through Microsoft's Azure Artifact Signing (Public Trust). Microsoft validated DEVlink AB as a company before it issued the signing certificate. Every signature also carries a timestamp from Microsoft.
| Field | Value |
|---|---|
| Signer | CN=DEVlink AB, O=DEVlink AB, L=Falkenberg, S=Halland, C=SE |
| Signed files | DEPSetup-<version>.exe and every DEVlink program file it installs |
| Timestamp | Microsoft timestamping service |
Origin and integrity, nothing more. A valid signature proves that the file comes from DEVlink AB and has not been changed since it was signed. It is not a quality or safety certification of DEP.
Check the signature
Use any of the three methods below. Each must name DEVlink AB as the signer.
1. The Windows administrator prompt
If you install DEP for all users, Windows asks for administrator approval and the prompt shows Verified publisher: DEVlink AB. If it shows Unknown or another publisher, select No.
The default installation is per user and needs no administrator rights, so Windows shows no prompt. Use method 2 or 3 instead.
2. File Explorer
- Open the propertiesRight-click
DEPSetup-<version>.exeand select Properties. - Open the signaturesOpen the Digital Signatures tab. The list shows DEVlink AB with a timestamp. If the tab is missing, the file is not signed: do not run it.
- Check the signatureSelect the entry and then Details. The dialog must say This digital signature is OK.
3. PowerShell
Open PowerShell in the download folder:
Get-AuthenticodeSignature .\DEPSetup-<version>.exe | Format-List Status, SignerCertificate, TimeStamperCertificateStatus must be Valid, and SignerCertificate must show the DEVlink AB subject in the table above. Any other status, for example NotSigned or HashMismatch, means that you must not run the file.
Compare the SHA-256 checksum
The checksum confirms that you have exactly the file that DEVlink released:
Get-FileHash -Algorithm SHA256 .\DEPSetup-<version>.exeCompare the result with the value for your version:
| Version | Installer | SHA-256 |
|---|---|---|
| 0.20.2 | DEPSetup-0.20.2.exe | 6704bb00622425d8ce71e0ba50665df99bc47bc759a7bd4881e4d487caa3fad7 |
If the values differ, do not run the file. Download it again or contact DEVlink. DEP 0.20.1 and earlier were unsigned builds. For those, use the .sha256 file delivered with the installer, as described in Install and Activate.
Allow-list DEP in your company
If your IT department controls which programs may run (for example with AppLocker, Windows Defender Application Control or an endpoint security product), allow DEP by its publisher:
- Publisher: DEVlink AB.
- Do not allow-list by certificate thumbprint. The signing certificates are renewed every three days, so a thumbprint rule stops matching new releases.
- The timestamp keeps a signature valid after its certificate expires. Older signed releases therefore stay valid.
Windows SmartScreen
Windows may also show a SmartScreen prompt naming the publisher. Continue only after the signature and the checksum are both correct. If you are unsure, contact DEVlink before you run the file.