Pakua SysManager 1.136.6

[1.136.6] - 2026-10-30
The temp sweeps no longer delete whatever folder TMP or TEMP name. They clean your own
AppData\Local\Temp and Windows\Temp, nothing else.
Fixed
- Deep Cleanup's Temporary files took the user's temp folder from Path.GetTempPath(), which reads
TMP, and Quick Cleanup, Quick Tune-Up, Scheduled Maintenance and --cleanup read TEMP. Both
variables live in HKCU\Environment, so the user, any program running as the user, and the
Environment Variables tab can point them anywhere without administrator rights. With TMP set to
D:\ or to Documents, the scan reported that tree as "Temporary files" and Clean deleted what it
held, and an elevated run let a value any unelevated program can write decide what an
administrator process deleted. The sweeps now take AppData\Local\Temp under the account's own
profile folder, which neither variable changes; a TEMP or TMP moved anywhere else is left alone,
and Deep Cleanup's description and Quick Cleanup's note say so. Deep Cleanup and Quick Cleanup
also used to read two different variables, so they could measure and delete two different
folders; they now share one root.
Verify the download
Get-FileHash .\SysManager-v1.136.6.exe -Algorithm SHA256
Expected SHA256: 73586E4339D0EE46C5DBB273DDA66026129D30D0EC19422DE2E63DF37F431AF5
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.
Code signing policy
This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.
This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Two checks
run on their own when SysManager starts: the version check against the GitHub Releases
API, at most once a day, and the Dashboard's app-updates alert, which asks winget. The
About tab can switch off either. Everything else that uses the network runs only when you
use it. Full
privacy policy.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.136.6.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.136.6.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.