Contact us

Verify the authenticity of an On-Premises package

Every Virto On-Premises package for SharePoint Server Subscription Edition, 2019 and 2016 on download.virtosoftware.com is published as three files with the same name:

  • <name>.zip — the package;
  • <name>.SHA256 — the SHA-256 hash of the archive;
  • <name>.cat — a Windows security catalog that holds the SHA-256 of the archive. The catalog is signed with the UAB Virtosoftware certificate, the same certificate that signs the installers, and carries a Microsoft timestamp.

This applies to all packages of these three editions, including the License Manager. New releases get their .cat file automatically.

The catalog sits next to the archive under the same name. For example, the catalog of https://download.virtosoftware.com/SE/Virto.SharePoint.SE.Tabs.zip is https://download.virtosoftware.com/SE/Virto.SharePoint.SE.Tabs.cat. The examples below use these two files.

Before you start

  • Download the .zip and the .cat file into the same folder.
  • Do not rename the archive before you check it: the catalog is bound to the file name.

Check the package with PowerShell

This is the main method. It takes one command, and the cmdlet is built into Windows. Open PowerShell in the folder with both files and run:

Test-FileCatalog -CatalogFilePath .\Virto.SharePoint.SE.Tabs.cat -Path .\Virto.SharePoint.SE.Tabs.zip -Detailed

The package is authentic when the output shows:

  • Status: Valid — the archive matches the catalog;
  • under Signature, Status: Valid and the publisher CN=UAB Virtosoftware.

Any other result — ValidationFailed, NotSigned or a different publisher — means that the file is not from VirtoSoftware or is damaged. Do not install it.

Check the package in File Explorer

This is the visual method. Double-click the .cat file to open the Security Catalog window.

  1. On the General tab, Windows shows “This security catalog is valid.”

  2. Select View Signature. The window shows “This digital signature is OK” and Name: UAB Virtosoftware.

  3. Select View Certificate. The certificate shows Issued to: UAB Virtosoftware and Issued by: Microsoft ID Verified CS AOC CA 03.

  4. On the Security Catalog tab, the Tag value is the SHA-256 of the archive. Compare it with the hash in the .SHA256 file or with the output of this command:

    Get-FileHash .\Virto.SharePoint.SE.Tabs.zip

Check the package with signtool

If the Windows SDK is installed, you can check the package with signtool:

signtool verify /pa /v /c Virto.SharePoint.SE.Tabs.cat Virto.SharePoint.SE.Tabs.zip

The output shows “Successfully verified”.

Check the installer and the libraries

The installer Setup<Edition>.exe and the libraries inside the package are signed with the same UAB Virtosoftware certificate. Their signatures are checked separately, file by file:

  • open the file’s Properties and select the Digital Signatures tab;

  • or run Get-AuthenticodeSignature, for example:

    Get-AuthenticodeSignature .\SetupSE.exe