Materialize 3D 0.2.1

Materialize 3D 0.2.1

Source release notes. Version 0.2.1 checks the printer's certificate, updates libraries with known security problems, and fixes bugs found after 0.2.0. It adds no features. The Releases page reports distribution status. Publication requires an attached software acceptance record for the exact final DMG. These source notes define changes and gates, not completed acceptance results.

Who should update

• Everyone on the 0.2.0 Mac app. The local MQTT connection now refuses a device whose certificate does not pass the Bambu root and printer serial checks. File upload over FTPS does not check the certificate yet. The app and its bundled CAD runtime replace library versions that have published security advisories.
• Anyone who runs Materialize 3D from source on Linux. Credentials now survive a reboot, but you must enter them again once. See Linux credentials move to the Secret Service.

Security updates

The app checks the printer's certificate

In 0.2.0, the local MQTT connection to the printer accepted any TLS certificate. Any device on your network could pose as the printer and receive the LAN access code and every print command. In 0.2.1, the app accepts the printer only when its certificate chains to Bambu's printer root certificates and names the printer's serial number (#66). The cloud connection does not change.

• The saved serial number must match the certificate exactly. A serial saved in lowercase or with a trailing space now fails to connect with an error. Such a configuration already listened on a topic the printer never uses.
• Tests check public certificate samples from a P2S and from the older printers that use BBL CA. H2D, H2S, and X1E chains have no sample. A printer whose chain the app does not cover fails to connect with an error.
• File upload to the printer over FTPS still accepts any certificate. Issue #65 tracks the fix.

Library updates

Library	0.2.0	0.2.1	Where it runs	What the update fixes
zip (Rust)	2.4.2	9.1.3	The app, when it reads and writes 3MF packages	Three advisories. One is critical: a crafted archive can show different file names and contents to different readers (GHSA-m665-v7pm-7grj). The others let a crafted archive crash the process that extracts it, or skip the check on an encrypted entry.
rumqttc (Rust)	0.24.0	0.25.1	The app, when it connects to a printer	Printer connections now use rustls 0.23.46 and rustls-webpki 0.103.15 instead of rustls 0.22.4 and rustls-webpki 0.102.8. rustls 0.23.46 also fixes four rustls advisories, one of them medium.
Pillow (Python)	12.3.0	13.0.0	The bundled CAD runtime	41 advisories: 5 critical, 23 high, and 13 medium. Most are memory errors and denial of service in image decoders.
certifi (Python)	2026.7.22	2026.10.23	The bundled CAD runtime	Stops trusting the emSign ECC Root CA - G3 root. Eight intermediate certificates under that root have compromised keys (GHSA-6q48-6c7w-9gw2).
Vitest	3.2.4	4.1.12	Development only. The app does not include it.	A path traversal that lets the test server read any file (GHSA-82fw-gwwq-j7x9).

The new zip writes the same bytes as before. A test compares three sign packages against stored hashes, and it passes on zip 9.1.3.

Known items that stay in 0.2.1:

• rumqttc 0.25.1 still compiles in rustls-webpki 0.102.8. Printer connections do not use it to check certificates. Its four alerts are dismissed as not used.
• Alerts for rand 0.7 and glib are dismissed as tolerable risk.

Fixes

• Printer setup. First-run setup now saves the printer address, serial number, and access code that you enter. In 0.2.0 it sent empty values and called a command that did not exist, so setup failed.
• Print history. Saved prints appear again after a restart, and successful prints show their Success badge. If the app cannot read the history, it shows an error instead of an empty list.
• Launch crash. The app no longer crashes at launch when auto-connect is on and a default printer is saved.
• Test isolation. For developers, the Rust tests no longer overwrite the real print queue file.

Linux credentials move to the Secret Service

Materialize 3D has no Linux release build. This section applies only when you build and run it from source on Linux. On macOS, credentials stay in the Keychain and nothing changes.

Linux builds now store API keys, printer access codes, and the MCP token in the Secret Service. Earlier builds kept them in the kernel keyutils keyring, which empties at every reboot.

• You need a session D-Bus and an unlocked Secret Service provider, such as GNOME Keyring, KWallet, or KeePassXC. Without one, every save or read of a credential fails with an error.
• After you update, enter your API keys and printer access codes again. The app does not copy old keyutils entries. Saved printer configurations stay.
• If you use the MCP endpoint, the app creates a new token. Give the new token to each agent that connects.

Requirements and limits

Requirements are the same as 0.2.0. The 0.2.0 release notes list them: Apple Silicon with macOS 26.0 or later, Bambu Studio 02.08.02.61, an OpenAI or Anthropic API key, and a Bambu Lab P2S with a 0.4 mm nozzle. The app database keeps the same schema, so an update keeps your signs, parts, approvals, and history.

Required publication evidence

Before publication, the release owner must complete the release procedure and attach its software acceptance record to the release. The record must cover every item in the 0.2.0 evidence list for the final 0.2.1 DMG. The release body and the record must identify the exact tagged source commit and the final DMG checksum. Keep those values out of tracked source.

The CAD runtime changed in this release. The arm64 runtime must come from the tagged commit's CAD runtime workflow run, or from a rebuild that matches the new cad-runtime/pins-arm64.json. The 0.2.0 runtime fails the build script's pin check.

Physical acceptance remains pending until Ossie records an actual print and inspection. Only Ossie decides to print.

Installation

Download Materialize-3D-0.2.1-macos-arm64.dmg, its .sha256 file, and the software acceptance record from the published release. Follow the Mac install guide. Compare the downloaded DMG's full checksum with both the checksum file and the record. Stop on a mismatch or missing evidence.

shasum -a 256 ~/Downloads/Materialize-3D-0.2.1-macos-arm64.dmg

To update from 0.2.0, quit the app and replace it in Applications with the 0.2.1 app. Your data and Keychain items stay.

Release build

• Source: tag v0.2.1, commit 05819dff63c7dcbe911ba822fe95e41c9ef85026
• Materialize-3D-0.2.1-macos-arm64.dmg SHA-256: 826bd29414cd188c76fb6a8ce0ac7a3e6d89c6fc3d4f9744b7ce5075a1a01ebd
• Signed with Developer ID (team 8A4Y276VK7), notarized, and stapled.
• software-acceptance.md records the scripted install checks, which passed. The installed GUI checklist with OpenAI, human approval, and native Save was not run for this release. The approved P2S acceptance exports are not attached. Physical print acceptance is pending.