Beginning April 28, 2026 with Jenkins weekly 2.562, the MSI installer is signed using the Microsoft Artifact Signing Service. The installer is signed by LF Open Source, LLC, courtesy of the Linux Foundation. The same change will be made in Jenkins LTS 2.555.2 beginning May 13, 2026.
In the transition period, there are some changes to the installation process. We hope that these changes are temporary while the installer’s reputation develops in Microsoft Defender SmartScreen.
Windows Edge - infrequently downloaded</h2>
Windows Edge, the default browser on Microsoft Windows, is integrated with Windows Defender SmartScreen.
That integration causes new installers and new applications to be flagged as "infrequently downloaded".
Windows administrators that download the Jenkins installer with Microsoft Edge will need to click the "Keep anyway" button until Windows Defender SmartScreen decides the Jenkins MSI installer has enough reputation.
The Windows Edge dialog looks like this:
Windows Defender SmartScreen</h2>
When the MSI installer is run, Windows displays the SmartScreen prompt that says:
Microsoft Defender SmartScreen prevented an unrecognized app from starting.
Running this app might put your PC at risk.
— Microsoft Defender SmartScreen
The dialog looks like this:
Click the "More info" link and that will change the dialog to display the publisher of the signed MSI file.
The publisher is "LF Open Source, LLC".
The dialog looks like this:
Press the "Run anyway" button and the MSI installer will run.
Frequently Asked Questions</h2>
Why change the MSI signing?</h3>
The previous code signing certificate expires May 16, 2026.
An unsigned MSI installer has an even worse experience for users than the experience with Windows Defender SmartScreen.
</div>
Why use LF Open Source, LLC?</h3>
The Linux Foundation has already pioneered the MSI installer signing process through their work with the NodeJS Foundation.
We were able to use their experiences to quickly revise our MSI installer signing to use the same techniques used by the NodeJS Foundation.
We interact frequently with the Linux Foundation because they host the Jira issue tracker for the Jenkins project.
Those interactions continue to help the Jenkins project.
The Linux Foundation is the parent organization of the Continuous Delivery Foundation.
The Continuous Delivery Foundation is the parent organization of the Jenkins project and holds its intellectual property.
</div>
Windows Edge, the default browser on Microsoft Windows, is integrated with Windows Defender SmartScreen. That integration causes new installers and new applications to be flagged as "infrequently downloaded".
Windows administrators that download the Jenkins installer with Microsoft Edge will need to click the "Keep anyway" button until Windows Defender SmartScreen decides the Jenkins MSI installer has enough reputation.
The Windows Edge dialog looks like this:
Windows Defender SmartScreen</h2>
When the MSI installer is run, Windows displays the SmartScreen prompt that says:
Microsoft Defender SmartScreen prevented an unrecognized app from starting.
Running this app might put your PC at risk.
— Microsoft Defender SmartScreen
The dialog looks like this:
Click the "More info" link and that will change the dialog to display the publisher of the signed MSI file.
The publisher is "LF Open Source, LLC".
The dialog looks like this:
Press the "Run anyway" button and the MSI installer will run.
Frequently Asked Questions</h2>
Why change the MSI signing?</h3>
The previous code signing certificate expires May 16, 2026.
An unsigned MSI installer has an even worse experience for users than the experience with Windows Defender SmartScreen.
</div>
Why use LF Open Source, LLC?</h3>
The Linux Foundation has already pioneered the MSI installer signing process through their work with the NodeJS Foundation.
We were able to use their experiences to quickly revise our MSI installer signing to use the same techniques used by the NodeJS Foundation.
We interact frequently with the Linux Foundation because they host the Jira issue tracker for the Jenkins project.
Those interactions continue to help the Jenkins project.
The Linux Foundation is the parent organization of the Continuous Delivery Foundation.
The Continuous Delivery Foundation is the parent organization of the Jenkins project and holds its intellectual property.
</div>
When the MSI installer is run, Windows displays the SmartScreen prompt that says:
Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.
The dialog looks like this:
Click the "More info" link and that will change the dialog to display the publisher of the signed MSI file. The publisher is "LF Open Source, LLC".
The dialog looks like this:
Press the "Run anyway" button and the MSI installer will run.
Frequently Asked Questions</h2>
Why change the MSI signing?</h3>
The previous code signing certificate expires May 16, 2026.
An unsigned MSI installer has an even worse experience for users than the experience with Windows Defender SmartScreen.
</div>
Why use LF Open Source, LLC?</h3>
The Linux Foundation has already pioneered the MSI installer signing process through their work with the NodeJS Foundation.
We were able to use their experiences to quickly revise our MSI installer signing to use the same techniques used by the NodeJS Foundation.
We interact frequently with the Linux Foundation because they host the Jira issue tracker for the Jenkins project.
Those interactions continue to help the Jenkins project.
The Linux Foundation is the parent organization of the Continuous Delivery Foundation.
The Continuous Delivery Foundation is the parent organization of the Jenkins project and holds its intellectual property.
</div>
Why change the MSI signing?</h3>
The previous code signing certificate expires May 16, 2026.
An unsigned MSI installer has an even worse experience for users than the experience with Windows Defender SmartScreen.
</div>
Why use LF Open Source, LLC?</h3>
The Linux Foundation has already pioneered the MSI installer signing process through their work with the NodeJS Foundation.
We were able to use their experiences to quickly revise our MSI installer signing to use the same techniques used by the NodeJS Foundation.
We interact frequently with the Linux Foundation because they host the Jira issue tracker for the Jenkins project.
Those interactions continue to help the Jenkins project.
The Linux Foundation is the parent organization of the Continuous Delivery Foundation.
The Continuous Delivery Foundation is the parent organization of the Jenkins project and holds its intellectual property.
</div>
The previous code signing certificate expires May 16, 2026. An unsigned MSI installer has an even worse experience for users than the experience with Windows Defender SmartScreen.
Why use LF Open Source, LLC?</h3>
The Linux Foundation has already pioneered the MSI installer signing process through their work with the NodeJS Foundation.
We were able to use their experiences to quickly revise our MSI installer signing to use the same techniques used by the NodeJS Foundation.
We interact frequently with the Linux Foundation because they host the Jira issue tracker for the Jenkins project.
Those interactions continue to help the Jenkins project.
The Linux Foundation is the parent organization of the Continuous Delivery Foundation.
The Continuous Delivery Foundation is the parent organization of the Jenkins project and holds its intellectual property.
</div>
The Linux Foundation has already pioneered the MSI installer signing process through their work with the NodeJS Foundation. We were able to use their experiences to quickly revise our MSI installer signing to use the same techniques used by the NodeJS Foundation.
We interact frequently with the Linux Foundation because they host the Jira issue tracker for the Jenkins project. Those interactions continue to help the Jenkins project.
The Linux Foundation is the parent organization of the Continuous Delivery Foundation. The Continuous Delivery Foundation is the parent organization of the Jenkins project and holds its intellectual property.