Shkarko SysManager 1.136.59

[1.136.59] - 2026-10-31
SysManager checks the drive it hands the disk check, and the power plan it switches to, more strictly.
Security
- System Health checked the drive letter it hands to chkdsk with ^ and $, which also match
before a final line break, so a drive letter with a line break after it passed. The other checks
of this kind were moved off those anchors in 1.51.14, and this one was missed. It now takes a
letter and a colon and nothing else. This was there since the check was added, in 0.35.11.
- The check on a power plan before SysManager switches to it allowed white space around the plan,
and the plan then went to powercfg as it was written. Each plan it checks is read back from a
file in your user folder: the snapshot Performance Mode's Restore puts back, Gaming Profile's
record of what it changed, and the record of the Ultimate Performance copy. It now takes the 36
characters of a plan and nothing else, and hands powercfg the plan it read from them. This was
there since the check was added, in 1.56.7, and in the Ultimate Performance copy's record since
1.136.40.
- Neither chkdsk nor powercfg is started through a command shell, so a line break could not run a
second command. Both checks now allow only what they say they allow.
Verify the download
Get-FileHash .\SysManager-v1.136.59.exe -Algorithm SHA256
Expected SHA256: 37B80833558C458D3D1B4C3620121AC71E9E8E17912A56C5370CE4DB67CC972E
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.
Code signing policy
This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.
This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Two checks
run on their own when SysManager starts: the version check against the GitHub Releases
API, at most once a day, and the Dashboard's app-updates alert, which asks winget. The
About tab can switch off either. Everything else that uses the network runs only when you
use it. Full
privacy policy.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.136.59.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.136.59.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.