32-bit
wixmachine scopegithub.com · known platform- File name
- cmake-4.4.2-windows-i386.msi
- SHA-256
- 12ffcdd391c8f63b47a59b910316c3855a851b36e959c38a469ba398302fe74b
- Product code
- {404AFA98-3F56-403E-B43E-4DEE0D288789}
by Kitware · BSD-3-Clause
CMake is a cross-platform, open-source build system generator.
These URLs are the ones Kitware declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Kitware published. Delete it.
Windows · PowerShell
Get-FileHash "cmake-4.4.2-windows-x86_64.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "cmake-4.4.2-windows-x86_64.msi"Expected output
5f391b528a6604c7248375d107ee993baa85667549ecb6e4c14bed9d9a718c41
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
32-bit · machine scope · MSI convention
msiexec /i "cmake-4.4.2-windows-i386.msi" /qn /norestart64-bit · machine scope · MSI convention
msiexec /i "cmake-4.4.2-windows-x86_64.msi" /qn /norestartARM64 · machine scope · MSI convention
msiexec /i "cmake-4.4.2-windows-arm64.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 32-bit
{404AFA98-3F56-403E-B43E-4DEE0D288789}
Uninstall, with the usual prompts
msiexec /x {404AFA98-3F56-403E-B43E-4DEE0D288789}Silent, for deployment
msiexec /x {404AFA98-3F56-403E-B43E-4DEE0D288789} /qn /norestartProduct code · 64-bit
{DD378698-40A3-4351-8FA2-5B516B5EF2E3}
Uninstall, with the usual prompts
msiexec /x {DD378698-40A3-4351-8FA2-5B516B5EF2E3}Silent, for deployment
msiexec /x {DD378698-40A3-4351-8FA2-5B516B5EF2E3} /qn /norestartProduct code · ARM64
{897E426B-A92C-4619-8BCF-DF4ED1E05EB2}
Uninstall, with the usual prompts
msiexec /x {897E426B-A92C-4619-8BCF-DF4ED1E05EB2}Silent, for deployment
msiexec /x {897E426B-A92C-4619-8BCF-DF4ED1E05EB2} /qn /norestartThe codes above belong to CMake 4.4.2, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "CMake*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 6 of 6 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 6 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 29.8 / 35 |
| Served over HTTPS | 6 of 6 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | BSD-3-ClauseA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
The installer comes from a recognised distribution platform rather than Kitware's own domain. That is normal for this kind of software and not a red flag by itself.
Every one of the 6 installers on this page comes with the SHA-256 Kitware declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 95/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Kitware.CMake --exactUpgrade later
winget upgrade --id Kitware.CMakeWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of CMake, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
1B00A7351ED58AE4F561B3089B17EF11FB26A97CD2FC5889AAC20C03C76EAD82
2D4800CB2CFB9028EDEF95FD36C3F1A1C7B20771F6C6B828F23A84E8014D543A
3157AFEFDC5D53A64D3287D307A20A6B4D89D7FEBC1105122918F5E7E87FFF4D
36F9807FA26F36A2A9AB8ABAC359AD34140401C2FD82C3F5673A93DFA45C4E24
091919E1CDE162B69D2D5E0F3B1F5670C973E72133F78126FBB18042947D6F19
DC59D9F377F891B8DA42EDE22F53717034A9D093092FCEAF6297FEEEC6AFBA29
786A25282A466C384E45D4D974CCD8D0528CD3CB70F1858BF7510266B095F2BB
82DB53FCB8F38BE541A26093489F39D5ED79B71B53CD121FC32A022A6BF310B1
47996E7E91026C21488AD7170246DD9FA36E45B605BD74927A9915E59795D534
1B2A35DFD18ADB5EB0CCFE3D3A1E756A198F06981F9CD52DD44735615044D0F7
156D70EB7625A7B469444DF7D0861D2AF8D5D0A437FCE32C350372B08F5620E8
57437E918B2929BBD25B8D427611120149DF02D4B216872E0F48F361F03D71E5
370B81C753916D89EDA85E63590E72124569B661B0F47BB1BAD53A3834800592
6F54AB92A19BF7D6695A40F3A774A8D1A54E90730C726FAD8AFB44544DB892DA
91A70D399778BF510790462EDF112DCCB3E5DCACF763EF392EBFC5B251A5589F
397ECA1926539326CDB72BD8D321AE1684BBDA232AD76DE95D3244A37FC9D7E2
B6C50584847F02FE7F11D94AD1D99D592B5B371C476E2DE3770AE3EE823B2638
54C0ABA5997E5678409116A9450181E84D0ABBC58FE815BB05705A90AFC739D1
911B289997E2E93243F75917E36394898519B219AC161D2288593112AD44B4DE
6915813BEDF3A8A698B72FC858E0C2A99761BE981745C3C3C99BD30E1477E142
34D3A3C7BAAB9A874D271FEA873EE8C4183BD579066697E68500A673B05121CA
5E5AC3542E406BE0D3FB4509BD1D374E1BED1A0C0C71CD72E40DBEB7195D23ED
92EA30F5541ABB693A5AC9C1D5F4353369FBC1E8F23A775E3E27F17C5B00212F
C1932E50D5EB726BE6FE57CBCC51C5D13FD404086A287BCC17E75E371009BEB1
604251CB02994A6A1B12887799B0D0B2EFC517B6617F72B0EE9928738A290732
E78145EFB9396BE583161B30C265AD9D5AAFDF8882E337781A946DBEE9B60A02
F10774C2BBEE65E2CBA34CF4956F2CCBD09E83F4988DB35708D72DE2DA2D237A
127346FBCBA783401DE160C93F2BB443BA0402BC5F3A683CCAE63DE34726256B
AA84AE115FC962C6691EC972548C7F7435BD9E7696C9D0487C8BD3A285277ED6
4FDFD91A0093E76C829B1952B0D7C67779FEF6876ADA60204C8BA2CD3B8562E9
D3B686F1A113CFFF553BDF44B65C8101BDD185B773FC578C40D36DFBAF3F9AA2
5F021B6735DFCEDC38A05EC56853683E0E94867D2AB5E021501C26E701CE0B52
9209F3C433EB90D16533A005E45FE07A0BAF449474957D2072C500F2BE51B054
27407844B603D0249440777270F4D0BC3961542866918C5A8772009363D08A2F
BD13C641E2492E06F105C62CF7E4B58C54C0F0042577CECB2470AB30C4144155
D0BD6D1EA054ABA45781D28EC4E4BC64E902A44C723D43DFD5DDD0D169B17417
9094BDFF200028FAE16D5C5327838012E032CF9938D0CD005664863CB5FBF3A6
E6F4E6E726B66ED22A51948C857F980B31349AC22AA0606C2E2474F2034AD326
0CB5F6A6B22D5C11911664C415EB9DBB7047DFDE4363480142032D53BA567FEF
EC1601A86DCB3DDECEC4C548A70C316A80A11E4D04D4B7271A76904A0280A763
5222342B6575E5016E4E6732A53F764E3E59E2D9CAF5881283646BB6A366DDF1
64EC35043C00DE01020854CC48C3628AF0FBFAAA5AE26BD63B29B1FD547BA43A
1A9243C315D721B75DA3E173369237EEE8582DACD15FB056F7B8E5D4EF90D96E
A10FC2527EC0727A5913ACD310CDDAFDBA1E5B4CA765CA23CC6A53C55EEBB7C1
0D17E1E3466F975F1B051DEED540F52EBA88CA362E4F42570B81C354F3EDAC21
1AB3683C2BDB5202773E08CC59572D6DD061425E4D058278A695D7F9FBE6F43B
0BD1B2B1FF551352572A26B648EC1D44A1D7993B685612CE121FD3C40C66BC5C
39C77D14D2F10B871DE6F8009D33067E45FE37C798E2012514FDA1441647AB2D
58DAB64E73D7A9DB463E8D7DEC87102DC9C4CB97EE9833AAC7909CFEB1422608
10664A3A59DAA9EE47BC04D183B16CAFE91235310E728EE3D0C9BA418F0A7BD7
0B677A7AEA4DCFB8DD8B1955EDDD77F2BC2FB10F873392980E1095462099C91E
56F77F1D9EC51A109D17D07C73D3BB1269DCAF0EA2772C1623C6BD9A6B3760A5
589DA314F09F2B7A28A79932EE33E95B388B0749A6799D887139189864F9798F
0CC0B1DB0E0ECBF71457BC84BF0B832BC5293F53B0F65A291F501EC9F04FCF30
859011D49C750F10EBA7F5A8F05DB30A17E5B5FBBF5F555907DA9E2C96BBE0CD
14E1DE34F0BF8CEBC3D7079009B0598D20C4252A80E85DBB0BC4A603B69B2171
349F42C271B247DA170A9AC88A63F5866881358DCA58AD5A73618FC30CEB4B47
586AF52B7B86F9B6916BCC4BC54F73D2BCAFA12731ED0451D532CC17660BDDF0
B2CD97898BA97EE6D08EE2B7E99DEF5EB13C2C24EAE8D5F2C3CD983923C2DB49
ABDE87FC253245850EEC876A326BD67DC3B6045197FF05D38CDF2E770A3FB4D1
7B5C34986F9E08A62397E74408089E2192A12D25436C8A72428FECADEE22FCE4
44F51A53593AFC086ACFC76411194224FA6EB44D7B488CBF3E42A15B7A1065BA
98CB5228627E97F4D1CFDA1613FA467CE72566CEEB1020C5B34B5F37F8923711
488B18E5CFA90F7493696C1FF02C65135403A1AC8A46062023A55816BC3CB790
5696126B264E6384C17C5A96E7969310D83BB775B8CA1E68912406C56E246B7C
8A93D8A11B3277CAFE3862E6EA4E790162E8C47203CB0F1368BB3EF70F2A177A
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every CMake version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Not related to CMake — just other entries, each with its own official URL and published hash.