Why does Windows warn "Windows protected your PC" the first time I run SysManager?

[laurentiu021]

I downloaded the exe from the Releases page and the first time I double-clicked it Windows put up a blue box saying "Windows protected your PC" and "Microsoft Defender SmartScreen prevented an unrecognised app from starting". There was no obvious way to continue — just a Don't run button.

Is that normal, is the download broken, and how do I know the file is actually the one you published rather than something that replaced it?

(Seeding this myself because it is the single most common thing people hit before the app even starts, and the answer belongs somewhere searchable rather than only in the README.)

[laurentiu021]

Normal, and not a sign of anything wrong with the download. But "trust me" is the wrong answer to that box, so here is what it actually means and how to check the file yourself.

Why it appears

SmartScreen is not scanning the file for malware. It is looking the file up by reputation: how many people have run this exact binary, and is it signed by a publisher Windows recognises. A release published minutes ago has been run by nobody and is signed by no one, so it has no reputation to find — and "unrecognised" is the honest thing for Windows to say. Every new release resets it, because the reputation attaches to the exact bytes.

The reason it is unsigned is money and eligibility rather than laziness. A code-signing certificate is a recurring cost, and the free route for open-source projects — the SignPath Foundation — asks for a level of public visibility the project does not have yet. That is a fair bar for a certificate issued in their name. So the warning stays for now, and it will keep appearing until a signed build exists.

Do not just click through it

Instead, check the two things that do not depend on trusting anyone.

1. Is the file intact? Every release ships a matching .sha256 next to the exe:

Get-FileHash .\SysManager-v<version>.exe -Algorithm SHA256

Compare that to the contents of SysManager-v<version>.exe.sha256. This catches a corrupted or truncated download.

2. Where did the file come from? This is the stronger check, and the one worth doing. Each release carries a GitHub build attestation: a signed record, kept in a public transparency log outside this repository, tying those exact bytes to the commit and the workflow that produced them. With the GitHub CLI:

gh attestation verify .\SysManager-v<version>.exe --repo laurentiu021/SystemManager

The difference matters. The .sha256 file is generated in the same job and published onto the same release as the binary it describes, so both come from one source — enough to catch a bad download, not enough to catch a substituted release asset. The attestation is signed by GitHub's infrastructure at build time and logged publicly, so a replaced asset cannot produce a matching one.

If either check fails, do not run the file, and please open an issue.

Getting past the box once you have checked

Click More info, then Run anyway. If your copy of the dialog shows no More info link, the file is still marked as downloaded from the internet: right-click the exe, choose Properties, tick Unblock at the bottom of the General tab, and apply.

An antivirus flagging "unknown publisher" has the same single cause and the same answer.

Longer version in the README, under First launch: Windows will warn you and Verifying the download.