Ghost FTP 0.99.56 Preview — complete HTTP/cloud download responses

Publisher: BRENDIGO — https://brendigo.com
Predecessor: publicly released v0.99.55 Preview
Branch policy: this is a PR candidate; not published or merged until exact-SHA checks succeed.

Reliability and data integrity

• Require HTTP 200 OK for complete-file downloads over HTTP, WebDAV, Dropbox, OneDrive, Google Drive and Box; an unsolicited 206 Partial Content, 204 No Content, 205 Reset Content or other response cannot silently become a complete local file.

• Refuse a Content-Range header even alongside HTTP 200 when no Range request was sent.

• Check Content-Length and byte counters before each chunk write, preventing oversized server payloads from consuming unbounded disk beyond their declared length.

• Flush and sync downloaded cloud staging files and validate expected vs received vs on-disk sizes before the existing safe staged promotion.

• Add Rust unit tests and a real loopback HTTP response fixture covering unsolicited HTTP 206, oversized streams, truncated bodies and overflow.

• Create a fresh, unpredictable staging filename for each whole-file retry, including FTP/FTPS, object storage and cloud adapters; a failed attempt's .part file is removed before the next attempt.

• Open whole-file staging files with OS-level exclusive create (create_new), preventing accidental truncation of existing files and refusing pre-planted final-component symlinks before any response bytes are written.

• Preserve existing verified-prefix SFTP pause/resume behavior; tests cover separate retry paths, non-clobbering writes and a symlink attack on Unix.

• Enforce Skip/Rename no-overwrite atomically at final promotion, not just when the transfer is queued, so another process or transfer cannot win a race and have its new local file replaced. This applies to FTP/FTPS/SFTP/cloud and Agent downloads; Agent uses full-file staging rather than destination-modifying delta mode for non-overwrite operations.

• Persist the explicit overwrite permission in each credential-free retry descriptor; a legacy descriptor lacking it fails closed to non-overwrite on restart. New regression tests cover collision and backward-compatible recovery.

Remaining limitations

Without a trustworthy remote checksum, HTTP Content-Length validation proves length, not full-file cryptographic identity. Some HTTP responses do not supply a Content-Length; these can only be checked against the number of bytes actually received and synced. Independent cloud account tests, cross-platform installation/upgrade, signing and Stable acceptance remain open. The legacy fixed-pixel release requirement remains retired.

Linux installation: choose the correct Ghost FTP package

Platform: Linux x86_64 / amd64. These are package-family labels, not
certifications that every distribution/version has been tested. The native
Windows/Linux build currently runs on an Ubuntu 22.04 x86_64 GitHub runner;
installed-device checks across other distributions remain required.

Replace <VERSION> with the exact published tag number. Verify
GhostFTP-v<VERSION>-SHA256SUMS.txt before executing installers. A SHA-256
checksum only verifies integrity against that manifest; it does not prove
publisher identity or replace a cryptographic code signature.

No native package is currently built for Linux ARM64/aarch64,
32-bit x86, musl-only Alpine, or every NixOS/immutable-container configuration.
Arch Linux, Manjaro, EndeavourOS, Gentoo, elementary OS and others may be
candidates for AppImage/manual installation, but are not certified based
solely on an Ubuntu runner. Check compatible dependencies first; do not force a
Debian RPM/DEB package onto an unrelated distribution. On Wayland systems,
GTK/WebKit or XWayland availability can affect behavior.

Required acceptance before claiming distribution support

For each distribution and version named as tested, record its exact image
version, x86_64 architecture, display protocol (X11/Wayland), WebKitGTK/GTK
versions, GNOME Keyring/KWallet state, and the native binary hash. Verify:

1. Install, first launch, File Manager/Sites/Transfers/Settings/Sync navigation,
   resize at 1290×852 and 480×600, and correct keyboard focus.
2. FTP warning, verified FTPS TLS and SFTP SSH host-key checks on actual
   endpoints; failed identity checks must not connect.
3. Queue retry/cancel, interrupted upload/download preservation, symlink and
   overwrite safety, and shutdown/restart without losing profile metadata.
4. OS-backed credentials with locked and unavailable Secret Service; no
   plaintext fallback or secret-bearing logs.
5. Uninstall and reinstall without silently deleting stored user documents,
   connection profiles, or keys.

Current GitHub Actions Linux QA produces real Xvfb/WebKit screenshots of
seven core workspaces, not mockups. Those captures prove native rendering under
the CI environment; they do not certify a GNOME/KDE/Wayland distro or pixel
parity with all 29 user-supplied Linux design references.

Related: Linux handbook ·
Native desktop build ·
Published releases.

Operational prerequisites for unsigned desktop builds

Running the native binary does not require a purchased signing certificate. Verify the SHA-256 checksum of your package against the matching official release manifest; this validates file integrity, not cryptographic publisher identity. Saved credentials require an unlocked Secret Service provider and the secret-tool client (the DEB declares libsecret-tools, the RPM declares libsecret). An unavailable vault is a blocking error, not a reason to store plaintext passwords. Before upgrading, create an encrypted backup and ensure all transfers are finished. The desktop Updates screen offers the complete GitHub Releases index because signed auto-updates and manually downloadable package editions are independent.