Verify downloads

Verify the download first. SHA256SUMS.txt is attached to this release:

shasum -a 256 -c SHA256SUMS.txt --ignore-missing  # macOS
sha256sum -c SHA256SUMS.txt --ignore-missing      # Linux

macOS

Download OpenSCP-1.1.0-arm64-UNSIGNED.dmg on Apple Silicon or OpenSCP-1.1.0-x86_64-UNSIGNED.dmg on Intel, open it, and drag OpenSCP onto Applications.

OpenSCP is not signed with an Apple Developer ID, so macOS blocks the first launch and reports that it cannot check the app for malicious software. To allow it, open System Settings → Privacy & Security, scroll down to the Security section, click Open Anyway next to the message about OpenSCP, and confirm. On macOS 12 and 13 the same setting lives in System Preferences → Security & Privacy → General. The DMG ships these steps as README.txt.

Linux

AppImage, which runs on most distributions:

chmod +x OpenSCP-1.1.0-x86_64.AppImage
./OpenSCP-1.1.0-x86_64.AppImage

Flatpak bundle:

flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak install --user ./OpenSCP-x86_64.flatpak
flatpak run io.github.luiscuellar31.openscp

Replace x86_64 with aarch64 on ARM64 machines.

Fixes

• release: use tag as release title (17dd185)
• accessibility: limit keyboard focus cues (ec65c0e)
• libssh2: keep full integrity checks for recently changed downloads (66ff2bb)
• libssh2: overwrite uploads with a single posix-rename request (cc06dde)
• remote: reopen the control connection after canceling an SFTP operation (a79b752)
• transfers: skip dependents when a queued prerequisite is canceled (ad575e3)
• ci: restore nightly quality checks (b0f70a7)
• transfers: prevent UAF and race during async disconnect cleanup (eb14f02)
• core: prevent use-after-free during libssh2 disconnect (d63c17b)
• transfers: eliminate dangling stack pointer in BandwidthLimiter (8c65523)
• core: eliminate fork heap allocations via posix_spawnp (f98391a)
• core: support 64-bit offsets for large SFTP uploads and resumes (0f9ed2b)
• core: prevent double close on UniqueFile self-reset (3b77974)
• core: validate SFTP readdir filename bounds and reject embedded nulls (49fa984)
• core: prevent remote SFTP handle leaks on canceled transfers via RAII (bb1fbf0)
• core: prevent dead store elimination and wipe proxy credentials via OPENSSL_cleanse (9543c10)
• security: sanitize credential lifecycle using SecureString in SecretStore (7467f0b)
• core: prevent GCC stringop-overflow in SecureString::assign (cd04cb1)
• ui: synchronize thread pool and TransferManager teardown in MainWindow destructor (198de4c)
• ci: standardize on universal libqt6svg6-dev package across workflows (698dec4)
• build: attach Qt resources to widget library and initialize in UI components (819291d)
• ui: prevent downcast undefined behavior in ToolbarKeyboardNavigation on toolbar teardown (25aaff0)
• tests: suppress uninstrumented Qt6 races in TSan and drain thread pool on teardown (88d934a)
• appimage: publish update metadata and zsync assets (1a062b4)
• tests: resolve nightly clang-tidy findings (629c9b0)
• ci: schedule nightly quality through dev dispatcher (8601c7c)
• sync: prevent accepting stale comparison plans (462d342)
• transfers: keep selected task snapshot alive (57f1671)
• transfers: block symlinked local destination parents (71dd1c7)
• sync: prevent mirror deletions after incomplete scans (f5085aa)
• transfers: protect local move source cleanup (2f2672c)
• sync: cancel superseded comparisons (2599f62)
• local: validate and share rename flow across panes (9f06bb1)
• sftp: replace existing files with legacy libssh2 (a1b7703)
• ci: suppress sync cancellation false positives (4209ed8)
• ci: avoid unresolved sanitizer name on skipped jobs (0fe7da2)
• release: restore Linux artifact builds (9fda2b5)
• release: correct Linux Qt installation and AppImage metadata checks (5c490cb)

Performance

• libssh2: verify Optional integrity without rereading remote files (deb02c7)
• transfers: reuse parent directory and single stat in upload precheck (a4fc89c)
• libssh2: stat downloads through the open handle (19fe652)
• libssh2: pipeline SFTP transfers with buffers up to 2 MiB (f9feb7f)
• ftp: look up single entries with MLST instead of listing the parent (91a8c94)
• ftp: change to the target directory with a single CWD (72e785e)
• webdav: send Basic credentials up front when the server only offers Basic (dc11127)
• webdav: sort listings without lowercasing names per comparison (1900ab1)
• remote: list directories on extra connections during long scans (fe2ede8)
• ui: refresh the remote panel once after a burst of uploads (12e9eb4)
• remote: use one session per connect and connect workers in parallel (62a589e)
• sftp: prefer AES-GCM over chacha20-poly1305 (88b37e0)
• sftp: disable Nagle's algorithm on the SSH socket (d2cc883)
• sftp: prefer chacha20-poly1305 on CPUs without AES instructions (abaf0a9)
• sync: run directories and copies of a sync in parallel (cffa99f)
• transfers: keep the queue mutex out of the per-chunk transfer path (3b2a622)
• transfers: remove queue tasks in one pass instead of one per task (d9aad5c)
• transfers: write the transfer queue off the thread that owns it (8019455)
• transfers: save the queue while transfers report progress (5f8f5f6)
• ui: keep the transfer queue dialog cheap per queue change (ea1de24)
• ui: restore and search selections in a single selection change (a96d1d9)
• sync: compare folders off the dialog's thread and stop repeating walks (589c91b)
• storage: use native moves and configurable download sync (cd5966d)
• transfers: avoid repeated batch and queue scans (1debbf4)

Refactors

• core: remove newConnectionLike() from RemoteClient (9e1c362)
• remove unused transfer and sync query helpers (6ed0908)
• local: share file and directory creation across panes (4ed9209)

Documentation

• core: note that remote checksums may read the whole file (d8254f4)
• add agent guidance and pull request template (232db6b)
• pr: clarify verification commands (9e8a505)
• pr: define required verification checks (860031e)

Maintenance

• clang-format code added in the recent remote and transfer commits (2f41c2c)
• qt: upgrade official artifacts to Qt 6.11.2 (61a254f)
• git: ignore clangd cache (fc815a7)
• core: add UniqueSftpHandle header and lifecycle unit tests (f832ac3)
• format codebase with clang-format and suppress Cppcheck uninit member false positives (8f4fba4)
• release: bump version to 1.1.0 (0625948)
• ci: remove trailing blank line from TSan suppressions (929193b)
• release: build artifacts on main before tagging (0b5ab06)