Ghost FTP 0.99.34 — Windows/Linux transfer integrity and privacy audit (Preview)

Published predecessor: v0.99.33. Published assets and tags must not be rewritten. This edition is source under review until exact-SHA GitHub Actions and release gates succeed.

Windows and Linux correctness fixes

• SFTP download reads the source's reported byte length, synchronizes the staging file to disk, compares the received and persisted byte counts and rechecks source length. An incomplete or changed-length file is refused before the finished staging file could replace the existing local destination.
• SFTP upload now verifies the actual sent byte count against both the originally opened local file and the remote server's reported destination size. A shorter-than-advertised response is an error, not a green Done status.
• FTP and explicit FTPS downloads synchronize staging and require exact received/persisted byte counts; when SIZE is available, remote server length is checked both before and after the transfer. FTP and FTPS uploads verify the sent count.
• Shared Transfer Manager completion no longer fabricates 100% progress from the guessed source size, and an unknown initial size becomes the actual observed byte count. Known-size mismatches are errors.
• Server- or cloud-origin errors may echo temporary credentials. Final transfer diagnostics are now mapped to safe error categories before persistence in the local transfer ledger; neither bearer tokens nor signed URLs should be written as failure text.
• Added Rust regression tests for truncated, oversized and zero-byte transfers, sizes above 4 GiB without allocating huge files, unknown initial size and sensitive error reflection. Repository-wide security source checks require the guards.

Protocol acceptance boundaries

Live local FTP, explicit FTPS and SFTP localhost integration exercises authentication, binary upload/download, boundary sizes, resume/abort and host-key/TLS trust paths. These tests are genuine servers and must pass on the exact release source. HTTP download, WebDAV, object storage and cloud/SaaS adapters are subject to the static code inventory and existing Rust/TypeScript checks but cannot be claimed fully end-to-end tested on real remote accounts without provider credentials and dedicated fixtures. HTTP is intentionally read-only.

All Windows x64 NSIS/MSI/portable and supported Linux x86_64 DEB/RPM/AppImage/native packages must pass real native builds; the full developer release train remains Preview until separately documented platform acceptance gates are met. Windows/Linux packages remain installable without purchased code-signing certificates, while cryptographically signed automatic updates remain signature-verified.

See the cross-platform audit and measured visual baseline.

Shared cross-protocol integrity

All non-Agent downloads (including HTTP/WebDAV/object storage/cloud/SaaS) now have a common last-mile check before local destination replacement: the staging file must be regular, byte length must match the actual transfer counter, and its content is flushed to disk. This reduces partial-file promotion across backends without claiming a remote checksum when no trustworthy source size or hash is available.

Linux installation: choose the correct Ghost FTP package

Platform: Linux x86_64 / amd64. These are package-family labels, not
certifications that every distribution/version has been tested. The native
Windows/Linux build currently runs on an Ubuntu 22.04 x86_64 GitHub runner;
installed-device checks across other distributions remain required.

Replace <VERSION> with the exact published tag number. Verify
GhostFTP-v<VERSION>-SHA256SUMS.txt before executing installers. A SHA-256
checksum only verifies integrity against that manifest; it does not prove
publisher identity or replace a cryptographic code signature.

No native package is currently built for Linux ARM64/aarch64,
32-bit x86, musl-only Alpine, or every NixOS/immutable-container configuration.
Arch Linux, Manjaro, EndeavourOS, Gentoo, elementary OS and others may be
candidates for AppImage/manual installation, but are not certified based
solely on an Ubuntu runner. Check compatible dependencies first; do not force a
Debian RPM/DEB package onto an unrelated distribution. On Wayland systems,
GTK/WebKit or XWayland availability can affect behavior.

Required acceptance before claiming distribution support

For each distribution and version named as tested, record its exact image
version, x86_64 architecture, display protocol (X11/Wayland), WebKitGTK/GTK
versions, GNOME Keyring/KWallet state, and the native binary hash. Verify:

1. Install, first launch, File Manager/Sites/Transfers/Settings/Sync navigation,
   resize at 1290×852 and 480×600, and correct keyboard focus.
2. FTP warning, verified FTPS TLS and SFTP SSH host-key checks on actual
   endpoints; failed identity checks must not connect.
3. Queue retry/cancel, interrupted upload/download preservation, symlink and
   overwrite safety, and shutdown/restart without losing profile metadata.
4. OS-backed credentials with locked and unavailable Secret Service; no
   plaintext fallback or secret-bearing logs.
5. Uninstall and reinstall without silently deleting stored user documents,
   connection profiles, or keys.

Current GitHub Actions Linux QA produces real Xvfb/WebKit screenshots of
seven core workspaces, not mockups. Those captures prove native rendering under
the CI environment; they do not certify a GNOME/KDE/Wayland distro or pixel
parity with all 29 user-supplied Linux design references.

Related: Linux handbook ·
Native desktop build ·
Published releases.

Operational prerequisites for unsigned desktop builds

Running the native binary does not require a purchased signing certificate. Verify the SHA-256 checksum of your package against the matching official release manifest; this validates file integrity, not cryptographic publisher identity. Saved credentials require an unlocked Secret Service provider and the secret-tool client (the DEB declares libsecret-tools, the RPM declares libsecret). An unavailable vault is a blocking error, not a reason to store plaintext passwords. Before upgrading, create an encrypted backup and ensure all transfers are finished. The desktop Updates screen offers the complete GitHub Releases index because signed auto-updates and manually downloadable package editions are independent.