SysManager 1.88.3

[1.88.3] - 2026-09-10

Windows' own programs no longer show as "Unsigned". Windows signs most of its own components in a
separate catalogue file rather than inside the program itself, and the Signature column was only looking
inside the program — so PowerShell, Command Prompt, the console host and the search box all appeared to
have no signature at all. They are signed, and Windows says so; we just were not asking the right
question. On this machine that moves twelve more programs into Verified, and what is left marked
unsigned is genuinely unsigned.

Fixed

• A signature stored in a Windows catalogue is now read too. The column asks about the signature
  inside the file first and, only when there is none, looks the file up in your PC's catalogues — so a
  program carrying its own signature costs nothing extra.
• Together with the previous fix, the column now confirms 59 of the 82 programs running on a test
  machine, against 1 before either change. The 22 still marked unsigned are ordinary third-party
  programs that really are unsigned, and the single warning left is a genuinely expired certificate.
• Still no network request, for either kind of signature.
• A file the app cannot open — locked, or permission denied — reads as unsigned rather than as a
  problem, the same way anything unparseable already did. "We could not look" must not read as "we
  looked and it failed".

Known limitation

• Opening the Process Manager now takes around three and a half seconds the first time while it checks
  each program, though later refreshes are unaffected because only newly started programs are checked.
  Making the list appear immediately and fill the column in behind it is the next change on this tab.

---

Verify the download

Get-FileHash .\SysManager-v1.88.3.exe -Algorithm SHA256

Expected SHA256: ACE01F94B5DF358865B06F0D0D549F3D6C62BFEF6DB2A1FCAE6989BBA0A7AD57

This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.

Code signing policy

This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.

This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Full
privacy policy.

Verify where this binary came from

This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:

gh attestation verify .\SysManager-v1.88.3.exe --repo laurentiu021/SystemManager

That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.88.3.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.