Pakua SysManager 1.136.160

[1.136.160] - 2026-11-09
The exe carries the licenses and notices of the open-source code inside it, and About opens them.
Fixed
- The exe carries code under the MIT, Apache 2.0, Mozilla Public 2.0 and GNU Lesser General Public 3.0 licenses, and
the .NET runtime, and those licenses ask for their notices and texts to go with every copy. None of them did: the
release published the exe, its SHA256 and the SBOM, which names the components but carries no notices, and About
offered only SysManager's own license. THIRD-PARTY-NOTICES.txt now lists every package whose code the exe
carries, 43 of them, with its license, copyright, project and, for the MPL and LGPL components, where their source
is, followed by each license's text and the notices the packages and the runtime carry themselves. It is written
from the app's restore graph by tools/ThirdPartyNotices.cs, which stops at a package whose license it has no text
for. (#2856)
- The exe embeds that file, and Open-source components on About opens it in Notepad, from a copy written to
SysManager's folder, so it opens without a network. Where Notepad is not installed, an optional feature on Windows
11, it opens on GitHub at this version's tag instead, and About says so.
- The release writes the file again from its own restore before it publishes, so the exe embeds the notices of exactly
what it is built from, and publishes it beside the exe and the SBOM.
- The README said publish.ps1 passes ContinuousIntegrationBuild and Deterministic; since 1.136.130 they come
from Directory.Build.props for every Release build, and the README says so.
- Tests fail a pull request whose notices leave out a package the exe carries, name one it no longer does, or give one
another license, and check the exe carries the committed file and About's button opens it, or GitHub when Notepad
will not start. The checks that read every text file in the repository read tools too, and the one for the old
terms leaves alone another project's branch in a link to its GitHub repository, which the notices quote word for
word; a link to this repository is still checked.
Verify the download
Get-FileHash .\SysManager-v1.136.160.exe -Algorithm SHA256
Expected SHA256: 6E5C415CC4EAC852D7373D560CE2861319177868E4E34B3FAEF7F88C25E25A56
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.
Code signing policy
This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.
This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Two checks
run on their own when SysManager starts: the version check against the GitHub Releases
API, at most once a day, and the Dashboard's app-updates alert, which asks winget. The
About tab can switch off either. Everything else that uses the network runs only when you
use it. Full
privacy policy.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.136.160.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.136.160.sbom.json, a CycloneDX inventory of
every dependency resolved for this build, and THIRD-PARTY-NOTICES.txt, the
licenses and notices of the open-source components the exe carries, which About
also opens from the exe itself.