CustosPublic beta builds are not code-signed yet. Windows SmartScreen may show an extra warning. Verifying SHA-256 from an official source is how you know the file was not tampered with in transit.
1. Download only from official sources
Trusted origins for CustosXI installers:
| Source | URL |
|---|---|
| Marketing / download page | https://custosxi.com/download/ |
| CDN (latest redirect) | https://downloads.custosxi.com/download/windows/latest |
| CDN file index (JSON) | https://downloads.custosxi.com/files |
Do not install copies from file mirrors, forums, chat attachments, or unofficial GitHub forks unless you fully trust the publisher and have verified the hash yourself.
2. Know the expected file name
Official Windows bootstrap installers follow this pattern:
CustosXI-Setup-{build}.exeProduct version shown in the app and on the website is 1.0.{build} (for example build 1166 → version 1.0.1166).
The download page lists published builds from R2 with upload date, size, and SHA-256 when available.
3. Get the published SHA-256 hash
- Open custosxi.com/download and scroll to Available installer builds.
- Find your file (for example
CustosXI-Setup-1166.exe). - Copy the SHA-256 value shown next to the build (when published).
- Alternatively, open /files JSON and read the
sha256field for the matching object.
If no hash is listed yet for a brand-new build, wait until it is published on the download page or contact support before installing from unofficial mirrors.
4. Compute SHA-256 on your PC (Windows)
PowerShell (recommended)
Replace the path with where you saved the installer (Downloads folder, etc.):
Get-FileHash -Path "$env:USERPROFILE\Downloads\CustosXI-Setup-1166.exe" -Algorithm SHA256The Hash output must match the published value exactly (hex, case-insensitive).
Command Prompt (certutil)
certutil -hashfile "%USERPROFILE%\Downloads\CustosXI-Setup-1166.exe" SHA2565. Compare and decide
| Result | Action |
|---|---|
| Hashes match | File integrity checks out. Proceed with install if you trust the official source. |
| Hashes differ | Do not run the file. Delete it, download again from an official URL, and re-check. |
| No published hash yet | Download only via official redirect; avoid third-party mirrors. |
6. SmartScreen and unsigned builds
CustosXI beta installers may not carry an Authenticode signature yet. That is expected and documented on the download page.
- SmartScreen may label the app as unrecognized.
- Hash verification proves file integrity; it does not replace a code-signing certificate.
- Publisher name in installer metadata: Giorgio Ciranni (Italy).
See also Security for disclosure contacts and safe-download practices.
7. After install - confirm version
Inside CustosXI: Settings → About shows the installed product version (1.0.{build}). It should match the build you downloaded.
Release notes for that build: /releases/.