Ghost FTP v0.99.63 Preview — safe file transfers and persistent profiles

BRENDIGO · https://brendigo.com
Development version: 0.99.63 Preview · Previous published: v0.99.62 · Target: 14 November 2026

What changed

• Recursive upload integrity: symlinks and special files are rejected before any remote directory is created or queued. A symlink to a local private file or external folder is never silently included in an upload.
• Remote folder errors: if a remote server rejects mkdir, the folder-upload planner accepts it only when listing that existing folder succeeds. Permission and network failures are no longer ignored.
• Download staging: failed exclusive temporary-file creation cannot cause cleanup of the pre-existing file/symlink. Failed transfers can clean up their own regular temporary files without deleting linked targets.
• Saved connections visible at startup: the desktop now invokes loadProfiles() after mounting the app, fetching saved profiles from Rust even when the user has not opened Site Manager or imported a connection. Errors are surfaced to the user. Added a static contract test to prevent startup hydration from disappearing.
• Saved connection profiles: added restart persistence tests for connection IDs, hosts, protocol, remote path, auto-connect, favorites, groups and sorting order; saved password/passphrase values remain stored separately in the operating-system vault, not in profiles.json.
• Crash recovery: if a process exits after moving the old profiles.json to a private predecessor snapshot, but before the new primary is installed, the application can load that predecessor read-only rather than discarding it in favor of a stale backup. User-assisted repair is required before further saves.
• Quality: Rust regression tests and static source guards for these scenarios; no schema migrations, credential reset or destructive profile modifications.

Acceptance requirements

Release only after current-HEAD Rust format, check/test/Clippy, frontend production build, whole-source security/dead-code audits, Windows security regression, real FTP/explicit FTPS/SFTP E2E, Windows/Linux native package builds, and immutable Preview release governance all pass. Additional manual validation with real cloud providers and installed-machine updates remains necessary; Preview is not a signed Stable release.

Do not delete existing profiles, saved authentication, configuration, stored downloads or published v0.99.62 artifacts.

Linux installation: choose the correct Ghost FTP package

Platform: Linux x86_64 / amd64. These are package-family labels, not
certifications that every distribution/version has been tested. The native
Windows/Linux build currently runs on an Ubuntu 22.04 x86_64 GitHub runner;
installed-device checks across other distributions remain required.

Replace <VERSION> with the exact published tag number. Verify
GhostFTP-v<VERSION>-SHA256SUMS.txt before executing installers. A SHA-256
checksum only verifies integrity against that manifest; it does not prove
publisher identity or replace a cryptographic code signature.

No native package is currently built for Linux ARM64/aarch64,
32-bit x86, musl-only Alpine, or every NixOS/immutable-container configuration.
Arch Linux, Manjaro, EndeavourOS, Gentoo, elementary OS and others may be
candidates for AppImage/manual installation, but are not certified based
solely on an Ubuntu runner. Check compatible dependencies first; do not force a
Debian RPM/DEB package onto an unrelated distribution. On Wayland systems,
GTK/WebKit or XWayland availability can affect behavior.

Required acceptance before claiming distribution support

For each distribution and version named as tested, record its exact image
version, x86_64 architecture, display protocol (X11/Wayland), WebKitGTK/GTK
versions, GNOME Keyring/KWallet state, and the native binary hash. Verify:

1. Install, first launch, File Manager/Sites/Transfers/Settings/Sync navigation,
   resize at 1290×852 and 480×600, and correct keyboard focus.
2. FTP warning, verified FTPS TLS and SFTP SSH host-key checks on actual
   endpoints; failed identity checks must not connect.
3. Queue retry/cancel, interrupted upload/download preservation, symlink and
   overwrite safety, and shutdown/restart without losing profile metadata.
4. OS-backed credentials with locked and unavailable Secret Service; no
   plaintext fallback or secret-bearing logs.
5. Uninstall and reinstall without silently deleting stored user documents,
   connection profiles, or keys.

Current GitHub Actions Linux QA produces real Xvfb/WebKit screenshots of
seven core workspaces, not mockups. Those captures prove native rendering under
the CI environment; they do not certify a GNOME/KDE/Wayland distro or pixel
parity with all 29 user-supplied Linux design references.

Related: Linux handbook ·
Native desktop build ·
Published releases.

Operational prerequisites for unsigned desktop builds

Running the native binary does not require a purchased signing certificate. Verify the SHA-256 checksum of your package against the matching official release manifest; this validates file integrity, not cryptographic publisher identity. Saved credentials require an unlocked Secret Service provider and the secret-tool client (the DEB declares libsecret-tools, the RPM declares libsecret). An unavailable vault is a blocking error, not a reason to store plaintext passwords. Before upgrading, create an encrypted backup and ensure all transfers are finished. The desktop Updates screen offers the complete GitHub Releases index because signed auto-updates and manually downloadable package editions are independent.