Ghost FTP 0.99.47 Preview — reliable destructive actions and Preview metadata recovery

Author: Brendigo — https://brendigo.com
Previous public release: v0.99.46 Preview (21 real SHA-256-inventoried assets)
Status: Development candidate. Publication requires exact-head Windows/Linux CI plus full post-release verification.

Safer file and server management

• Keep Sites delete confirmations open until the actual native profile/credential removal completes, pinned to the original saved site ID so a refreshed list cannot retarget the deletion. On failure, keep the modal open and show a retryable error.
• Apply the same awaited-confirmation busy state to Find Duplicates, Disk Usage and Snippets deletion.
• Prevent parent Escape from closing Find Duplicates during confirmation or an active deletion.
• Add ongoing code-contract regressions for these destructive operations without changing the backend's authority.

Correct Preview classification, preserving release integrity

• Add explicit workflow_dispatch to the existing immutable Preview metadata workflow. A trusted maintainer can now re-run checksum-pinned metadata repair from the GitHub Actions UI if an external edit changes prerelease after the scheduled checks.
• Preserve the exact previously published tag commit, 21 asset IDs/names/sizes/SHA-256 digests and release bytes. Never call metadata repair a stable signing or notarization service.
• Add a regression test for manually triggered classification recovery.

Retire the discontinued desktop platform

• Remove both legacy SwiftUI and shared Tauri platform-specific application sources and 3 dedicated workflows; delete obsolete installation material and shortcut tests.
• Remove discontinued-platform artifacts from the canonical release inventory and release workflow. Required distribution now contains 15 Windows/Linux and source/checksum assets, with a separate all-or-nothing group of 4 signed-updater assets.
• Keep immutable historical tags, release archives and their SHA-256 evidence unchanged.
• Align runtime window styling, keyboard shortcuts, Rust local-file behavior and quality/dead-code/security audit contracts to the supported desktop platforms.

Unverified acceptance

The 59 concept references remain unverified; installed native UI, large-transfer recovery, actual remote providers, Windows Authenticode, Linux package signing and independently verified upgrade/security acceptance remain separate obligations. Do not assert full pixel-perfect or stable-production certification.

Linux installation: choose the correct Ghost FTP package

Platform: Linux x86_64 / amd64. These are package-family labels, not
certifications that every distribution/version has been tested. The native
Windows/Linux build currently runs on an Ubuntu 22.04 x86_64 GitHub runner;
installed-device checks across other distributions remain required.

Replace <VERSION> with the exact published tag number. Verify
GhostFTP-v<VERSION>-SHA256SUMS.txt before executing installers. A SHA-256
checksum only verifies integrity against that manifest; it does not prove
publisher identity or replace a cryptographic code signature.

No native package is currently built for Linux ARM64/aarch64,
32-bit x86, musl-only Alpine, or every NixOS/immutable-container configuration.
Arch Linux, Manjaro, EndeavourOS, Gentoo, elementary OS and others may be
candidates for AppImage/manual installation, but are not certified based
solely on an Ubuntu runner. Check compatible dependencies first; do not force a
Debian RPM/DEB package onto an unrelated distribution. On Wayland systems,
GTK/WebKit or XWayland availability can affect behavior.

Required acceptance before claiming distribution support

For each distribution and version named as tested, record its exact image
version, x86_64 architecture, display protocol (X11/Wayland), WebKitGTK/GTK
versions, GNOME Keyring/KWallet state, and the native binary hash. Verify:

1. Install, first launch, File Manager/Sites/Transfers/Settings/Sync navigation,
   resize at 1290×852 and 480×600, and correct keyboard focus.
2. FTP warning, verified FTPS TLS and SFTP SSH host-key checks on actual
   endpoints; failed identity checks must not connect.
3. Queue retry/cancel, interrupted upload/download preservation, symlink and
   overwrite safety, and shutdown/restart without losing profile metadata.
4. OS-backed credentials with locked and unavailable Secret Service; no
   plaintext fallback or secret-bearing logs.
5. Uninstall and reinstall without silently deleting stored user documents,
   connection profiles, or keys.

Current GitHub Actions Linux QA produces real Xvfb/WebKit screenshots of
seven core workspaces, not mockups. Those captures prove native rendering under
the CI environment; they do not certify a GNOME/KDE/Wayland distro or pixel
parity with all 29 user-supplied Linux design references.

Related: Linux handbook ·
Native desktop build ·
Published releases.

Operational prerequisites for unsigned desktop builds

Running the native binary does not require a purchased signing certificate. Verify the SHA-256 checksum of your package against the matching official release manifest; this validates file integrity, not cryptographic publisher identity. Saved credentials require an unlocked Secret Service provider and the secret-tool client (the DEB declares libsecret-tools, the RPM declares libsecret). An unavailable vault is a blocking error, not a reason to store plaintext passwords. Before upgrading, create an encrypted backup and ensure all transfers are finished. The desktop Updates screen offers the complete GitHub Releases index because signed auto-updates and manually downloadable package editions are independent.