Ghost FTP 0.99.68 Preview

Channel: Preview (Windows x64 and Linux x86_64). Verify actual publication and downloads at the canonical GitHub release page. This source note alone is not proof that a release or its assets were published.

Changes from v0.99.67

• Hardened transfer upload filename validation: reject C0/C1 Unicode control characters, including TAB, ESC and DEL, in addition to path separators. Normal non-ASCII filenames continue to be accepted.
• Added a Rust regression covering the prohibited control codepoint ranges and valid multilingual filenames.
• Corrected operational documentation to distinguish the published v0.99.67 Preview from its earlier candidate description. Added a dated erratum instead of modifying existing release assets, hashes or tags.
• Recorded that main lacked branch protection and had no active rulesets on 15 November 2026; enforcement is tracked by Issue #296.
• Introduced the next immutable version train, synchronizing npm, Cargo, Tauri, Windows/Linux Go compatibility tools and updater metadata.

Security and acceptance limits

This Preview does not guarantee server-independent atomic FTP rename/no-overwrite semantics. Remote staging can persist after a failed transfer. Source-file identity checks are not cryptographic checksums. Automatic cloud mutation retries remain conservative where idempotence is uncertain. FTP without TLS is not encrypted; use verified SFTP or explicit FTPS for sensitive transfers.

Full physical 4+ GiB and 1/4/8 parallel transfer fault injection, Windows Credential Manager and Linux Secret Service after reboot/locked storage, complete cloud-provider live acceptance, Windows 10/11 and Linux X11/Wayland installed-app first-frame/accessibility checks, and publisher signing are NOT VERIFIED by source review. Branch protection is OPEN until the GitHub ruleset is actually enabled.

See the scoped audit and native acceptance matrix. A green CI pipeline is automated evidence only; it is not equivalent to full production certification.

Release verification

Automated release publication must be tied to the exact merged main commit with passing source, protocol and Windows/Linux native package checks, actual SHA-256 artifact manifest, version/tag consistency and nonempty packages. See GitHub Actions and the canonical release page for authoritative evidence. No binary artifact, signature or test result is asserted by this Markdown document alone.

Linux installation: choose the correct Ghost FTP package

Platform: Linux x86_64 / amd64. These are package-family labels, not
certifications that every distribution/version has been tested. The native
Windows/Linux build currently runs on an Ubuntu 22.04 x86_64 GitHub runner;
installed-device checks across other distributions remain required.

Replace <VERSION> with the exact published tag number. Verify
GhostFTP-v<VERSION>-SHA256SUMS.txt before executing installers. A SHA-256
checksum only verifies integrity against that manifest; it does not prove
publisher identity or replace a cryptographic code signature.

No native package is currently built for Linux ARM64/aarch64,
32-bit x86, musl-only Alpine, or every NixOS/immutable-container configuration.
Arch Linux, Manjaro, EndeavourOS, Gentoo, elementary OS and others may be
candidates for AppImage/manual installation, but are not certified based
solely on an Ubuntu runner. Check compatible dependencies first; do not force a
Debian RPM/DEB package onto an unrelated distribution. On Wayland systems,
GTK/WebKit or XWayland availability can affect behavior.

Required acceptance before claiming distribution support

For each distribution and version named as tested, record its exact image
version, x86_64 architecture, display protocol (X11/Wayland), WebKitGTK/GTK
versions, GNOME Keyring/KWallet state, and the native binary hash. Verify:

1. Install, first launch, File Manager/Sites/Transfers/Settings/Sync navigation,
   resize at 1290×852 and 480×600, and correct keyboard focus.
2. FTP warning, verified FTPS TLS and SFTP SSH host-key checks on actual
   endpoints; failed identity checks must not connect.
3. Queue retry/cancel, interrupted upload/download preservation, symlink and
   overwrite safety, and shutdown/restart without losing profile metadata.
4. OS-backed credentials with locked and unavailable Secret Service; no
   plaintext fallback or secret-bearing logs.
5. Uninstall and reinstall without silently deleting stored user documents,
   connection profiles, or keys.

Current GitHub Actions Linux QA produces real Xvfb/WebKit screenshots of
seven core workspaces, not mockups. Those captures prove native rendering under
the CI environment; they do not certify a GNOME/KDE/Wayland distro or pixel
parity with all 29 user-supplied Linux design references.

Related: Linux handbook ·
Native desktop build ·
Published releases.

Operational prerequisites for unsigned desktop builds

Running the native binary does not require a purchased signing certificate. Verify the SHA-256 checksum of your package against the matching official release manifest; this validates file integrity, not cryptographic publisher identity. Saved credentials require an unlocked Secret Service provider and the secret-tool client (the DEB declares libsecret-tools, the RPM declares libsecret). An unavailable vault is a blocking error, not a reason to store plaintext passwords. Before upgrading, create an encrypted backup and ensure all transfers are finished. The desktop Updates screen offers the complete GitHub Releases index because signed auto-updates and manually downloadable package editions are independent.