Pakua SysManager 1.136.14

[1.136.14] - 2026-10-30
A newer release found after a download no longer makes Install fail with a SHA256 mismatch,
and an update check that times out says so instead of "Check cancelled."
Fixed
- About kept the file downloaded for one release after a later check found a newer one. The
card named the new release, Download stayed hidden because a file was already there, and
Install checked the old file against the new release's published hash and reported "SHA256
mismatch — file may be corrupted" every time, until SysManager was restarted. A check that
finds another release now lets that download go, and a failed download of the old one too,
so Download is offered again. A download that was still running when the newer release was
found says so when it ends instead of offering its file for Install, and an Install that was
still checking its file stops there instead of installing a version the card no longer names.
Present since the About tab gained Download and Install in 0.5.0.
- An update check that GitHub did not answer within 15 seconds read "Check cancelled." and was
not tried again, although the check promises one retry for a failure like that. It is now
tried once more, and if that times out too it says GitHub did not answer in time. Only a
check that was really cancelled still says so. A check that succeeded on its second try no
longer keeps the first try's error.
Verify the download
Get-FileHash .\SysManager-v1.136.14.exe -Algorithm SHA256
Expected SHA256: 16C0FEF2D4C7DB7A913E66FDAC10F4BA64196CC9661D38108DBFCE5C54036960
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.
Code signing policy
This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.
This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Two checks
run on their own when SysManager starts: the version check against the GitHub Releases
API, at most once a day, and the Dashboard's app-updates alert, which asks winget. The
About tab can switch off either. Everything else that uses the network runs only when you
use it. Full
privacy policy.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.136.14.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.136.14.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.