HVAC Network Scanner Files

The executable is now code-signed. Nothing else changes. Full details are in CHANGELOG.md (github.com). The project's website is jamesccupps.github.io/HVAC-Network-Scanner.

Already on 2.13.0? It downloads this update by itself and installs it when you close the scanner, or press Restart to update to 2.13.1 in the header. On 2.10 to 2.12, press Update to 2.13.1. Copies older than 2.10 need this download once.

Download

HVACNetworkScanner.exe is the GUI as one file; no Python needed. It was built by GitHub Actions from the v2.13.1 tag (build log), with PyInstaller and its dependencies pinned by hash.

SHA-256  60EDF7B72627AE151FFA18423859A68E3437A641D782348A2B6ED08BACE873B5

Check it before running. The same hash is in HVACNetworkScanner.exe.sha256:

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

The build signs an attestation that this exact file came from that workflow run and commit. To verify it with the GitHub CLI:

:::powershell
gh attestation verify .\HVACNetworkScanner.exe --repo jamesccupps/HVAC-Network-Scanner

Code-signed

The executable carries an Authenticode signature from James Cupps (Azure Artifact Signing, the certificate his other Windows apps are signed with), so Windows names the publisher. To check it, right-click the file → Properties → Digital Signatures, or:

:::powershell
Get-AuthenticodeSignature .\HVACNetworkScanner.exe | Format-List Status, SignerCertificate

SmartScreen can still warn about a new release until enough people have downloaded it: More info shows the publisher, then Run anyway. If Windows Firewall asks, allow it on the networks you scan, or BACnet replies to a broadcast will be dropped.

It's signed in a CI job of its own that installs nothing from PyPI and never runs the program. The smoke tests, the update test, the SHA-256 above and the attestation are all of the signed file. In-app updates are still checked against the release's signed latest.json, as before.

Only scan networks you own or are authorized to assess.