bren-wp/Ghost-FTP ghostftp-v1.1.6

Ghost FTP 1.1.6

on GitHub

Ghost FTP 1.1.6

Privacy-first FTP, FTPS and SFTP desktop client for Windows and Linux.
Release channel: Stable.

Highlights

Filesystem race hardening

• Hardened recursive local deletion against directory/pathname swaps by traversing verified child directories through opened os.Root handles instead of rebuilding mutable pathnames during recursion.
• Added a deterministic regression that swaps the selected delete root after validation and proves content outside the originally opened tree survives.
• Hardened local directory creation so Mkdir is performed relative to an opened base-directory os.Root, preventing a late base pathname replacement from redirecting creation into a different filesystem object.
• Added deterministic path-swap regression coverage proving the new child directory is created under the originally opened base directory.

SFTP trust and remote cleanup integrity

• Bound the SFTP host-key SHA-256 fingerprint directly to the exact public-key blob selected from ssh-keyscan output and compute the OpenSSH-compatible fingerprint in memory.
• Verify that the embedded public-key algorithm matches the algorithm declared by the scanned host-key line before presenting or persisting trust.
• Removed the fingerprint-only temporary key file and second ssh-keygen -lf pathname reopen from the trust decision path.
• Stopped treating spoofable remote diagnostic text such as No such file, does not exist or not found as proof that a staging/rollback object is absent.
• Only successful cleanup or curl's structured REMOTE_FILE_NOT_FOUND exit result can confirm absence; non-zero OpenSSH SFTP cleanup remains fail-closed and blocks automatic retry while remote state is uncertain.
• Added regression coverage for a fixed OpenSSH SHA-256 fingerprint fixture, algorithm mismatch, malformed key blobs, spoofed missing-file text and structured curl not-found handling.

Release discipline and verification

• Kept the release workflow workflow_dispatch-only and preserved the exact-main release/ghostftp-vX.Y.Z canonical publication trigger.
• Preserved the 9 platform artifacts / 12 public files Stable release contract for Windows x64/x86 Setup and Portable plus Linux amd64/arm64/i386 DEB and multiarch bundle.
• Preserved optional production Authenticode with truthful WINDOWS_AUTHENTICODE=signed|unsigned metadata and no generated/self-signed production publisher identity.
• Added no external Go module dependency, telemetry, analytics, advertising, tracking, remote UI runtime or hidden product network service.

Required verification

The 1.1.6 stable candidate must pass before publication:

• go test -race ./...;
• go vet ./...;
• Go formatting checks;
• dependency/repository/platform/desktop/localization/security/privacy/documentation/release audits;
• full Python regression suite;
• Windows x64/x86 Setup + Portable production builds, Setup-x32 alias verification and release artifact verification;
• Linux amd64/arm64/i386 production builds, DEB verification and multiarch packaging contract;
• Authenticode production-policy verification and private-key pipeline smoke test;
• authentic Windows x64 Portable Main/Site Manager/Settings/About capture and visual review on the exact final release-prep head;
• exact-head release-prep PR CI;
• post-merge Core/Windows/Linux verification on the exact main SHA;
• exact-main release/ghostftp-v1.1.6 branch validation;
• immutable ghostftp-v1.1.6 tag, Stable GitHub Release with prerelease=false, exact 12-file asset set and GHCR 1.1.6 distribution-bundle publication/read-back.

Release tag

ghostftp-v1.1.6

Public platform packages

Windows:

• Ghost-FTP-1.1.6-Setup-x64.exe — 64-bit Windows installer.
• Ghost-FTP-1.1.6-Setup-x86.exe — 32-bit x86 Windows installer.
• Ghost-FTP-1.1.6-Setup-x32.exe — byte-identical compatibility alias of the x86 installer.
• Ghost-FTP-1.1.6-Portable-x64.exe — portable 64-bit Windows executable.
• Ghost-FTP-1.1.6-Portable-x86.exe — portable 32-bit x86 Windows executable.

Linux:

• Ghost-FTP-1.1.6-Linux-amd64.deb — Debian package for amd64.
• Ghost-FTP-1.1.6-Linux-arm64.deb — Debian package for arm64.
• Ghost-FTP-1.1.6-Linux-i386.deb — Debian package for i386.
• Ghost-FTP-1.1.6-Linux-multiarch.zip — bundle containing the three verified Debian packages.

GitHub Packages

• Package: ghcr.io/bren-wp/ghost-ftp:1.1.6
• Type: verified OCI distribution bundle, not a runtime container.
• Contents: the same verified release directory under /ghostftp-release/.
• Stable aliases: 1, 1.1, latest.
• The workflow verifies registry readback before completing publication.

Verification files

• SHA256.txt — SHA-256 checksums for every public release file except SHA256.txt itself.
• RELEASE-NOTES.txt — these notes generated from CHANGELOG.md.
• BUILD-METADATA.txt — version, release tag, source commit, signing state and distribution metadata.

Release contract

• 9 platform artifacts.
• 12 public release files total, including the three verification/metadata files.
• Active application platforms: Windows and Linux.
• Local language catalog: 24 selectable languages with English default/fallback.
• Application telemetry: disabled.

Signing and trust

The workflow never fabricates publisher identities. Production Authenticode signing is optional: when a protected trusted certificate is configured, Windows artifacts are signed and verified; when it is not configured, the release remains explicitly unsigned and BUILD-METADATA.txt records WINDOWS_AUTHENTICODE=unsigned. Never treat a locally generated or self-signed certificate as a trusted public publisher identity. Always verify SHA256.txt and the official GitHub release location before installation or deployment.

Privacy

Release bundles contain only the explicit verified artifact allow-list. They do not contain saved profiles, FTP/SFTP passwords, private-key passphrases, signing private keys, local application data or user files.