Sækja SysManager 1.136.161

[1.136.161] - 2026-11-09
SysManager no longer runs code that a variable in your environment names before it starts, so another program
running as you cannot use one to run its code when you start SysManager as administrator.
Security
- The .NET runtime loads every assembly a DOTNET_STARTUP_HOOKS variable names and runs it before the app's own
code, and any program running as you can set that variable for the programs you start later, also one you start as
administrator. A single-file exe published the way the release is ran such a hook. SysManager uses none, so startup
hooks are now off, and the runtime ignores the variable.
- SECURITY.md lists running a startup hook among the things SysManager never does, and says what the runtime still
reads from the environment: a profiler named in CORECLR_ or DOTNET_ variables, which nothing inside an app can
turn off, since the runtime loads it before the app's code runs.
- SecurityPromiseTests.TheRuntime_RunsNoStartupHook fails a build whose runtime configuration leaves startup hooks
on, and the release's smoke check starts the exe with a hook named that does not exist, which an exe with hooks on
refuses to start past.
Verify the download
Get-FileHash .\SysManager-v1.136.161.exe -Algorithm SHA256
Expected SHA256: 8998E8BDFED335C1F4B2486EB1874060DE5E1E3D63A201CFB1383D5ACB61B4BB
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.
Code signing policy
This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.
This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Two checks
run on their own when SysManager starts: the version check against the GitHub Releases
API, at most once a day, and the Dashboard's app-updates alert, which asks winget. The
About tab can switch off either. Everything else that uses the network runs only when you
use it. Full
privacy policy.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.136.161.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.136.161.sbom.json, a CycloneDX inventory of
every dependency resolved for this build, and THIRD-PARTY-NOTICES.txt, the
licenses and notices of the open-source components the exe carries, which About
also opens from the exe itself.