Install Software Safely: Sources, Hashes, Signatures and Licenses (Tech+)

Why it matters. Most malware on home PCs isn’t forced in by hackers; people install it themselves because it looked like something they wanted. A free game, a “codec” to play a video, a PDF that was really a program. Knowing where software should come from, and how to check it, is the cheapest security skill there is.

Where software comes from

Think of buying medicine. A pharmacy is safest, a shop you trust is fine, and a stranger selling pills from a car trunk is a terrible idea even if the box looks right. Software is the same.

On iPhone, apps can normally only come from the App Store. Android lets you install files called APKs from anywhere if you allow “install unknown apps,” and that setting is how most Android malware gets in. Leave it off.

Before you start: open PowerShell

Click Start (the Windows logo), type powershell, and click Windows PowerShell. A normal window is fine; nothing here needs “Run as administrator.” Stuck? Here is how to open PowerShell, step by step. Make a practice folder so everything stays in one place:

PS> New-Item -ItemType Directory -Force $HOME\safe-install | Out-Null; Set-Location $HOME\safe-install

1. Package managers: an app store you type into

A package managerIn plain words: An app store you use by typing. You ask for a program by name and it finds, downloads, checks and installs it for you.Technical: A tool that installs, updates and removes software from trusted repositories (online catalogs). It verifies each download against a known hash or signature before installing. winget, apt, dnf and Homebrew are package managers. keeps a catalog of programs and where to get them. Windows 10 and 11 include winget. Search the catalog for PuTTY, a free tool IT people use to connect to other computers:

PS> winget search putty

Name                            Id                                       Version    Match                  Source
------------------------------------------------------------------------------------------------------------------
PuTTY                           XPFNZKSKLBP7RJ                           Unknown                           msstore
PuTTY                           PuTTY.PuTTY                              0.85.0.0                          winget
Avash                           AdrienCros.Avash                         0.13.2     Tag: putty             winget
...

Notice the look-alikes. The Id column is what matters: PuTTY.PuTTY is the real one. Now look at its details:

PS> winget show --id PuTTY.PuTTY

Found PuTTY [PuTTY.PuTTY]
Version: 0.85.0.0
Publisher: Simon Tatham
Homepage: https://www.chiark.greenend.org.uk/~sgtatham/putty/
License: MIT
...
Installer:
  Installer Type: wix
  Installer Url: https://the.earth.li/~sgtatham/putty/0.85/w64/putty-64bit-0.85-installer.msi
  Installer SHA256: 2213ebacf962b709411d654a40087508a694756bc4e41c5a1c24ad86596b2511

Two lines to notice: the Publisher (who made it) and the Installer SHA256, a long code that is the file’s fingerprint. When you run winget install --id PuTTY.PuTTY, winget downloads the installer, works out that fingerprint itself, and refuses to install if the two don’t match. We didn’t install anything on our test PC, but you can. On Ubuntu, apt does the same job, and checks that the whole catalog was signed by Ubuntu’s key:

$ apt-cache policy sqlite3
$ grep Signed-By /etc/apt/sources.list.d/ubuntu.sources

sqlite3:
  Installed: (none)
  Candidate: 3.45.1-1ubuntu2.9
  Version table:
     3.45.1-1ubuntu2.9 500 (phased 20%)
        500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
     3.45.1-1ubuntu2.8 500
        500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
     3.45.1-1ubuntu2 500
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Installed: (none) and Candidate tell you it isn’t installed yet and which version you’d get. The Signed-By lines show every Ubuntu source is checked against Ubuntu’s signing key. To install, you would run sudo apt install sqlite3; to remove, sudo apt remove sqlite3. (Ubuntu in WSL: Start, type Ubuntu. We didn’t run those two, since they need your password.)

2. Check a download’s hash

A hashIn plain words: A fingerprint for a file: a long code worked out from every byte in it. Change one letter and the whole code changes.Technical: The output of a one-way hash function such as SHA-256 (Secure Hash Algorithm, 256-bit). The same file always gives the same hash; you can’t rebuild the file from it, and finding two different files with the same SHA-256 hash is not practical. is a fingerprint worked out from every byte of a file. The same file always gives the same hash, and changing even one letter gives a completely different one. See it with two notes that differ by a single character:

PS> Set-Content .\note1.txt "Meet at 5pm"; Set-Content .\note2.txt "Meet at 6pm"
PS> Get-FileHash .\note1.txt, .\note2.txt | Select-Object Hash

Hash
----
0FCA2347282167A1173A8796F3374C606673B9D61E8E6377FD25BE67E8C3DC00
27E7ABA7624C00BDC9BA940A5209197E535818CA719C6E50EF0E5AA5767A364E

One character changed; nothing in the two hashes looks alike. That’s why makers publish the hash of each download. If the file you got has the same hash, it’s exactly the file they published, not one that was damaged on the way or swapped by an attacker.

Try it with a real download: PuTTY’s official site publishes a list of SHA-256 hashes next to its files. These two lines download the program and the list into your practice folder (downloading a program doesn’t install or run it):

PS> Invoke-WebRequest https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe -OutFile putty.exe
PS> Invoke-WebRequest https://the.earth.li/~sgtatham/putty/latest/sha256sums -OutFile sha256sums.txt

Now work out the hash of what you downloaded, and find the hash PuTTY published for the same file:

PS> Get-FileHash .\putty.exe | Select-Object Algorithm, Hash
PS> Select-String -Path .\sha256sums.txt -Pattern " w64/putty.exe$"

Algorithm Hash
--------- ----
SHA256    D01FDB5AAE8F112526040A39B0BFB9E27D813003178645E65F8D1CFDB2A26C87

sha256sums.txt:53:d01fdb5aae8f112526040a39b0bfb9e27d813003178645e65f8d1cfdb2a26c87  w64/putty.exe

Same code (Windows shows it in capitals; capitals don’t matter in a hash). Comparing 64 characters by eye is tiring, so let PowerShell do it:

PS> (Get-FileHash .\putty.exe).Hash -eq (Select-String .\sha256sums.txt -Pattern " w64/putty.exe$").Line.Split(" ")[0]

True

True means they match. False means don’t run it: download it again from the official site, and if it still doesn’t match, don’t use it.

Mac and Linux have the same check built in. In Terminal on a Mac type shasum -a 256 putty.exe; on Linux, sha256sum putty.exe. We ran both in Ubuntu, which taught us something real:

$ mkdir -p ~/safe-install && cd ~/safe-install
$ curl -sSO https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe
$ sha256sum putty.exe
$ ls -l putty.exe

5c9950be2a2f1ee5a495a9f00928a1a414ec885c14fbf3270caa257e2dfaf743  putty.exe
-rw-r--r-- 1 steven steven 342 Nov  4 21:06 putty.exe

The hash didn’t match, and the file was only a few hundred bytes. The word latest in the address isn’t a real file; the server answers “it moved, look over there” (a redirect), and curl saved that short message instead of the program. Browsers and Invoke-WebRequest follow redirects for you; curl needs -L to do the same:

$ curl -sSLO https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe
$ sha256sum putty.exe
$ shasum -a 256 putty.exe

d01fdb5aae8f112526040a39b0bfb9e27d813003178645e65f8d1cfdb2a26c87  putty.exe
d01fdb5aae8f112526040a39b0bfb9e27d813003178645e65f8d1cfdb2a26c87  putty.exe

Now both match the published list. A damaged or wrong download is far more common than an attack, and the hash check catches both.

The hash check caught us downloading a 300-byte web page and calling it PuTTY. Without it, I’d have spent an hour wondering why it wouldn’t run. — Nyx

3. Check the digital signature

A hash proves the file wasn’t changed. It doesn’t prove who made it: an attacker who swaps the file can swap the posted hash too. A digital signatureIn plain words: A tamper-proof seal on a file that shows who made it. If anyone changes the file afterwards, the seal breaks.Technical: The publisher signs a hash of the file with their private key; a certificate from a trusted certificate authority (CA) ties that key to their verified name. Windows calls this Authenticode. is like a wax seal with the maker’s crest: it shows who made the file, and it breaks if anyone changes a single byte. Windows can check it:

PS> Get-AuthenticodeSignature .\putty.exe | Format-List Status, StatusMessage
PS> (Get-AuthenticodeSignature .\putty.exe).SignerCertificate.Subject

Status        : Valid
StatusMessage : Signature verified.

CN=Simon Tatham, O=Simon Tatham, S=Cambridgeshire, C=GB

Valid means the seal is unbroken. The Subject line names who signed it: Simon Tatham, PuTTY’s author, verified by a certificate company. Here’s what other results mean:

PS> Set-Content .\hello.ps1 "Write-Output hi"; Get-AuthenticodeSignature .\hello.ps1 | Select-Object Status

   Status
   ------
NotSigned

A script you just wrote has no seal, which is normal. You also see signatures without typing anything: when an installer asks “Do you want to allow this app to make changes to your device?” (that box is User Account Control), a blue box with a Verified publisher name means it’s signed, and a yellow box saying Unknown means it isn’t. A blue Windows protected your PC screen is SmartScreen warning that a file is rare or unknown. In each case, stop and ask whether you trust where the file came from. On a Mac, the matching warning is “cannot be opened because the developer cannot be verified.”

4. Licenses: what you’re allowed to do

When you install software you rarely own it; you get a licenseIn plain words: Permission to use software, with rules attached, like the terms on a rental agreement.Technical: A legal agreement that sets how software may be used, copied, shared or changed, and on how many devices. The EULA (End User License Agreement) is the version you click “I agree” to during installation., permission to use it under certain rules. The rules you click “I agree” to during setup are the EULA (End User License Agreement). Nobody reads it all, but it’s where limits like “one computer only” or “not for business use” live.

Businesses also buy licenses in bulk: per user or per device (one license for each person or computer), or a site license that covers a whole organization. “Free” isn’t the same as “open source,” and free for home use often isn’t free for work. winget shows the license of anything in its catalog:

PS> "7zip.7zip", "Google.Chrome", "Microsoft.Office" | ForEach-Object { winget show --id $_ | Select-String "^Found|^License:" }

Found 7-Zip [7zip.7zip]
License: LGPL-2.1
Found Google Chrome [Google.Chrome]
License: Freeware
Found Microsoft 365 Apps for enterprise [Microsoft.Office]
License: Commercial

Three programs, three kinds of license: open source (LGPL), freeware and commercial. Cracked copies of paid software break the license and are one of the most common ways malware spreads, because the “crack” is a program from a stranger that you run with full permission.

5. File extensions, and why hidden ones trick people

A file extensionIn plain words: The letters after the last dot in a file name. They tell Windows which app should open the file.Technical: A suffix such as .docx, .pdf or .exe. Windows chooses the program to open a file by its extension alone, not by what is actually inside it. is the letters after the last dot in a file name: .docx for Word, .pdf, .jpg. Windows decides what to do with a file from its extension, and some extensions mean “this is a program that will run”:

The trick: Windows hides known extensions by default. A program named invoice.pdf.exe shows up as invoice.pdf, and attackers give it a PDF-looking icon. The real extension is only what comes after the last dot:

PS> Set-Content .\invoice.pdf.txt "not really a PDF"; Get-ChildItem .\invoice* | Select-Object Name, Extension

Name            Extension
----            ---------
invoice.pdf.txt .txt

Windows sees .txt, not .pdf. (We used a harmless text file; a real attack would end in .exe.) Turn extensions on so you always see the whole name: open File Explorer (the folder icon on the taskbar), click View at the top, then Show → File name extensions. On Windows 10 it’s the View tab → check File name extensions. On a Mac: Finder → Settings → Advanced → Show all filename extensions.

6. Uninstall what you don’t use

Every installed app is one more thing that needs updates and one more thing an attacker can target. Removing old apps is real security, not just tidying up. Deleting the program’s folder isn’t enough, because it leaves settings, services and update tasks behind; use the proper uninstaller:

• Windows: Settings → Apps → Installed apps, click the … next to the app, then Uninstall. Or with winget: winget uninstall --id followed by the app’s Id (we didn’t uninstall anything on our test PC).
• Mac: drag the app from Applications to the Trash; some apps include their own uninstaller.
• iPhone and Android: press and hold the app icon, then choose Remove App or Uninstall.
• Ubuntu: sudo apt remove and the package name.

To see what winget knows about an app you have, including whether it’s out of date:

PS> winget list --name 7-Zip

Name              Id        Version Available Source
----------------------------------------------------
7-Zip 25.01 (x64) 7zip.7zip 25.01   26.05     winget

A version in the Available column means an update is waiting.

7. Keep apps updated

Installing safely is half the job; the other half is keeping it patched. Turn on automatic updates wherever an app offers them, and every few weeks run winget upgrade to list everything out of date (the lock down your devices lesson walks through it). On Ubuntu, this lists what’s waiting:

$ apt list --upgradable 2>/dev/null | head -4

Listing...
apparmor/noble-updates 4.0.1really4.0.1-0ubuntu0.24.04.9 amd64 [upgradable from: 4.0.1really4.0.1-0ubuntu0.24.04.5]
apport-core-dump-handler/noble-updates 2.28.3-0ubuntu0.1 all [upgradable from: 2.28.1-0ubuntu3.8]
apport/noble-updates 2.28.3-0ubuntu0.1 all [upgradable from: 2.28.1-0ubuntu3.8]

To install them all you’d run sudo apt update && sudo apt upgrade (not run here; it needs your password). Phones: turn on automatic updates in the App Store or Google Play settings.

Clean up

You didn’t install anything, but you did download PuTTY. Remove the practice folders:

PS> Set-Location $HOME; Remove-Item -Recurse -Force $HOME\safe-install

$ cd ~ && rm -r ~/safe-install

What you learned

• app store > package manager > official site — and never a random download site
• Get-FileHash — the file’s fingerprint; it must match the one the maker published
• Get-AuthenticodeSignature — Valid plus the right name means the maker signed it and nobody changed it
• open source, proprietary, freeware, subscription — the EULA sets the rules
• File name extensions — turn them on; only the last dot counts
• Installed apps → Uninstall — fewer apps, fewer targets
• winget upgrade — updates matter as much as the install

If a site makes you hunt between three giant green DOWNLOAD buttons to find the real one, none of them is the real one. Close the tab and go to the maker’s own site. — Nova

Where this fits

This is part of the free CompTIA Tech+ roadmap: computer basics in the order the exam teaches them. These topics are in the Tech+ practice test, scored by exam domain.

NextProgramming basics explained→

Go deeper

• Operating systems, software and file systems — where apps live and how licenses started
• Lock down your own devices — updates, antivirus and the rest of the checklist
• Read email headers and report phishing — where fake attachments usually arrive
• How to open Command Prompt and PowerShell — for the commands above

Explainer, written by StashGrid with AI help and checked against the CompTIA Tech+ (FC0-U71) exam objectives before publishing. Every command in a copy box was run on Nov 4, 2026, in Windows PowerShell 5.1 on Windows 11 as a normal user (no administrator rights) and in Ubuntu 24.04 (WSL), and the outputs are from those runs. Not run: installing, upgrading or uninstalling anything (winget install, winget uninstall, sudo apt install, sudo apt remove, sudo apt upgrade), the click paths for File Explorer, Settings, Mac, iPhone and Android, and the Mac shasum command on a real Mac (we ran the same command in Ubuntu). StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.