A catalog file, ending in .cat, records cryptographic hashes for every file in a driver package and carries a digital signature, letting Windows confirm the package is unaltered and identify who published it.
In practice
When a package is staged, Windows recalculates the hash of each file and compares it with the catalog. If a single byte of a driver binary was changed after signing, the comparison fails and Windows refuses to treat the package as properly signed.
Common confusion
A catalog is not an inventory for people to read; it is a verification tool. Its signature confirms origin and integrity, not quality or suitability for a specific computer. A perfectly signed package can still be the wrong one for your model.
Why it matters to readers
Catalogs are the reason modified or repackaged drivers from unofficial sources frequently fail to install on current Windows. The requirement protects readers from tampered code reaching the kernel.
A closer look
One catalog can cover every file in a package, or a large package may include several catalogs. When Windows reports that a package has an invalid signature, the cause is frequently a file altered or swapped after the catalog was signed. Reference packages from maker websites and Windows Update are delivered with matching catalogs, so this problem is rare when sticking to those sources.
