Sourcetree not signed

[Werner Grünenfelder]

We received a message from our security department that sourcetree.exe

sha256: 7d8457f4d50715790c53fd8d647fd90e1d41e9b4c59bbb3e6164383a4c2b569a

is not signed by Atlassian and is therefore blocked. We would like to inquire why Atlassian doesn't sign the software and whether this can be corrected.

Best regards

[Reetika Narula]

Hi @Werner Grünenfelder ,

Thanks for reaching out and for providing the details.

I’ve checked the Sourcetree installer (version 3.4.26) and can confirm that it is digitally signed by Atlassian Pty Ltd. You can see this by right-clicking the installer, selecting Properties → Digital Signatures, and reviewing the signature information — it shows Atlassian Pty Ltd as the signer, using the sha1 digest algorithm.

The absence of a timestamp (“Not available”) can sometimes cause certain security tools to flag the file as unsigned, even though it is signed. This doesn’t mean the signature is invalid — just that the timestamp wasn’t embedded during signing.

If your security department needs additional assurance, they can verify the signature validity directly with Windows by:

Opening the file’s Properties → Digital Signatures tab.

Selecting the signature and clicking Details → View Certificate → Details → Verify.

Best regards,
Reetika

[Tinker Fadoua]

Welcome to the Atlassian Community @Werner Grünenfelder !

I am requesting Atlassian's assistance since they are the only ones who can answer your question. The will get back to you within 2 business days.

Best,

Fadoua