Ghost FTP 0.16.0

Release status: development

Release date: 26 September 2026

0.16.0 advances together with real release and security work; it is not a version-only change.

Security and reliability

• Upgrades the SSH transport from legacy russh 0.45 to russh 0.63.3.
• Removes the separate legacy russh-keys dependency and uses russh integrated key APIs.
• Retains strict known_hosts verification and fail-closed handling.
• Refuses SSH host certificates until Ghost FTP has an explicit trusted-CA policy.
• Preserves key-file, keychain, ssh-agent, password and keyboard-interactive authentication paths.
• Keeps the Rust dependency graph reproducible through a Cargo-generated committed lockfile.

Release pipeline

• Keeps a verified mapping for the 14 actually published legacy releases.
• Historical release mutation remains audit-only while GitHub blocks historical tag-ref writes for the available App token.
• Adds an exact-main-SHA Windows hardening release gate.
• Future release gate lookup uses workflow file identifiers instead of fragile display names.
• Future versions use canonical semantic-version names rather than RC naming.

Required gates

The exact release SHA must pass Quality, Windows hardening, real FTP/FTPS/SFTP E2E, Android signature/installability checks, and Windows/Linux native packaging.