Pakua SysManager 1.75.17

[1.75.17] - 2026-09-01
The speed test uses a small program from Ookla, downloaded the first time you run it. SysManager already
checked that program's signature before running it; now it also locks the file while it does so, closing a
gap where the file could have been switched for another one in between.
Fixed
- The Ookla speed-test program is locked from the moment it is checked to the moment it finishes. The
program is kept in your own user folder, which anything running under your account can write to. SysManager
checked its digital signature every time before running it — that part was already right — but it checked
the file by name and then started it by name, and in the gap between those two steps the file could have
been replaced. The checked file and the started file would not have been the same one, which is the only
thing a signature check is for. SysManager now holds the file open with changes and deletion blocked from
before the check until after the speed test ends, so the program that was approved is the program that
runs. This matters most when SysManager is running as administrator, where anything it starts inherits
those rights.
- A program that fails the signature check is now actually removed. SysManager refuses to run it either
way, so nothing unsafe was ever started. But the removal was attempted while the file was still locked, so
it quietly failed and the rejected file stayed in the folder, to be rejected again on every later run. The
lock is now released first, so the file really goes.
Verify the download
Get-FileHash .\SysManager-v1.75.17.exe -Algorithm SHA256
Expected SHA256: BE74C442601CFF021977B69E330E37361FB8A6FBA4DB6C901555C805A7D08F86
This build is not code-signed, so Windows will warn on first launch. That is
expected for a small independent app: see what the warning says and what to
click.
Code signing is planned through the SignPath Foundation,
which provides free certificates to open-source projects, with signing performed by
SignPath.io. Until then, the SHA256 above and the build
attestation below are what establish that a download is the genuine build.
Code signing policy
This release is not code-signed. The team roles, release-approval process and
privacy policy required by the SignPath Foundation programme
are documented in advance under Code signing
policy. That
documentation is a prerequisite for applying, not evidence of a certificate. The
attribution line naming SignPath as the signing provider will appear here once a
certificate is actually issued.
This program will not transfer any information to other networked systems unless
specifically requested by the user or the person installing or operating it. Full
privacy policy.
Verify where this binary came from
This exe was built by GitHub Actions from this public source, and the build is
recorded in the Sigstore public transparency log. With the
GitHub CLI:
gh attestation verify .\SysManager-v1.75.17.exe --repo laurentiu021/SystemManager
That proves which commit and workflow produced this exact binary, something the
SHA256 file cannot show, since it is published alongside the exe it describes.
Each release also ships SysManager-v1.75.17.sbom.json, a CycloneDX inventory of
every dependency resolved for this build.