SysManager 1.130.86

[1.130.86] - 2026-10-23

Installing an update now checks the file again, right before it replaces SysManager, against the checksum that
was verified — so what gets installed is what was checked.

Fixed

• The check and the install were two separate reads of the file. SysManager verified the downloaded build
  against its published checksum, then handed the file to the part that does the replacing, which opened it again
  by name — from a folder your own account can write to — and installed whatever it found there, with
  administrator rights if SysManager had them. Nothing tied the two reads together, so anything that replaced the
  file in between would have been installed unchecked. The verified checksum now travels with the handover: the
  installer opens the file itself, blocks other programs from writing to it, checks it against that checksum, and
  copies from that same open file. A build that does not match, or a handover with no usable checksum, installs
  nothing and says so in the log. The same applies to Go back to the previous version, which now passes the
  checksum it recorded when the copy was made. Since 1.42.11.

---

Verify the download

Get-FileHash .\SysManager-v1.130.86.exe -Algorithm SHA256

Expected SHA256: D2A7DB36EA378AB52075326F866FCC5B868A71AF822B4DA15F8B7B379D6C411B

This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.

Code signing policy

This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.

This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Full
privacy policy.

Verify where this binary came from

This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:

gh attestation verify .\SysManager-v1.130.86.exe --repo laurentiu021/SystemManager

That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.130.86.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.