Shkarko SysManager 1.60.3

[1.60.3] - 2026-08-10
Closes a hole in the update check before it can ever matter: when SysManager starts being
code-signed, an update signed by someone else will be refused instead of accepted.
Fixed
- The update check would have trusted any signature, not just ours. When you install an update from inside the app, the download is verified against the published checksum — that part was and remains the real protection, and it is what catches a tampered file. The app also looks at the file's digital signature. That second check only confirmed a signature existed; it never asked whose. SysManager isn't signed yet, so nothing was exposed — but the moment a signing certificate arrives, the reasonable assumption would be "we sign now, so that check protects us", and it would not have: a file signed by anyone at all, including someone who made their own certificate, would have passed exactly like a genuine build. Now a signature has to belong to the expected publisher and trace back to a trusted authority, or the update is refused. Unsigned builds keep installing normally, so nothing changes for you today.
Verify the download
Get-FileHash .\SysManager-v1.60.3.exe -Algorithm SHA256
Expected SHA256: 30E757866F0DDA7B291C164D697EE25F450426330AF4BD8B95226D1CB4E41B61
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.60.3.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.60.3.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.