SysManager 1.136.13

[1.136.13] - 2026-10-30

The Ookla speed test runs again. Its program is now checked against Ookla's exact release
instead of a signature it never had.

Fixed

• Every Ookla run failed with "Ookla speedtest.exe has no valid Authenticode signature. Binary
  deleted for security." Ookla's 1.2.0 CLI carries no signature at all, so the check rejected
  and deleted the real file each time, and the next run downloaded it again. The check could
  not have caught a changed file anyway, since it read the certificate without checking the
  file against it. SysManager now pins the SHA-256 of Ookla's 1.2.0 zip and of the
  speedtest.exe in it: nothing is extracted from a zip that does not match, and the exe is
  checked before every run, through the handle that keeps it from being changed until the test
  ends. A copy that does not match is deleted, and the next run downloads it again. The tab has
  done this since 0.35.12.
• The run that downloaded the CLI failed after extracting it, because the zip was still open
  when it was deleted, and showed a sharing error with your profile path in it. The zip is now
  closed first, and a zip that cannot be deleted no longer fails the test.
• While SysManager runs as administrator, the Ookla test no longer starts. The CLI is kept in
  a folder your own account can change, and Windows loads a DLL from the program's own folder
  before anywhere else, so an elevated run would have given whatever was put there
  administrator rights. The card says so; the HTTP test is unaffected.
• A run that failed on a missing DLL no longer tries to delete the CLI. The delete never
  worked while the file was held open, and the file it would have removed had just been
  checked byte for byte.

---

Verify the download

Get-FileHash .\SysManager-v1.136.13.exe -Algorithm SHA256

Expected SHA256: D7616AEE553AA36C87B51AE06C10441D07F7418F487F4F28C02A1895F30EFEFD

This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.

Code signing policy

This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.

This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Two checks
run on their own when SysManager starts: the version check against the GitHub Releases
API, at most once a day, and the Dashboard's app-updates alert, which asks winget. The
About tab can switch off either. Everything else that uses the network runs only when you
use it. Full
privacy policy.

Verify where this binary came from

This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:

gh attestation verify .\SysManager-v1.136.13.exe --repo laurentiu021/SystemManager

That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.136.13.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.