gmacFTP 0.2.4

gmacFTP 0.2.4 restores reliable in-app update installation and strengthens design/demo isolation on Apple Silicon Macs.

Highlights:

• Keeps the downloaded update staged under a .part.dmg filename so Apple Stapler recognizes the file as a disk image and can validate its notarization ticket.
• Retains strict verification of the GitHub release digest and size, Developer ID signature, Apple team, bundle identifier, and stapled notarization ticket before installation.
• Isolates design/demo launches from saved profiles, preferences, favorites, sync state, and real local paths; only built-in example data is displayed.
• Adds regression coverage for both the updater staging filename and demo profile isolation.

One-time upgrade note: versions through 0.2.3 execute the older updater validation code before installing a new release. Install 0.2.4 once from this signed DMG or with Homebrew; in-app updating works normally again for subsequent versions.

Requirements: Apple Silicon (arm64), macOS 11 or newer.

The DMG is signed with an Apple Developer ID, notarized by Apple, and includes an Applications shortcut. A separate SHA-256 file is attached for independent verification.

SHA-256: 9d4f8d0cda2ea23f8fc06a830a136f9be970158de97f113dd4d0f539310a3ae4

Homebrew: brew install --cask gmac-pl/gmacftp/gmacftp

gmacFTP 0.2.3

gmacFTP 0.2.3 is a reliability and FTP compatibility update for Apple Silicon Macs.

Highlights:

• Recovers eligible passwords from older encrypted iCloud vaults after an upgrade, with an explicit trust confirmation and no password disclosure.
• Reopens the recovery flow when an affected server is selected after recovery was deferred, instead of showing a misleading missing-credential error.
• Converts only unambiguous host/account mappings; ambiguous entries remain unchanged for safe manual re-entry.
• Makes explicitly enabled plaintext FTP connect directly, while FTPS remains the default and never silently downgrades after a TLS failure.
• Keeps plaintext and TLS connection settings internally consistent.

Requirements: Apple Silicon (arm64), macOS 11 or newer.

The DMG is signed with an Apple Developer ID, notarized by Apple, and includes an Applications shortcut. A separate SHA-256 file is attached for independent verification.

Homebrew: brew install --cask gmac-pl/gmacftp/gmacftp

gmacFTP 0.2.2 — Apple Silicon UI stabilization

This release completes the UI and release-stabilization milestone for gmacFTP.

• Refines icon geometry, sidebar hierarchy, protocol badges, hit targets, toolbar emphasis, and EN/PL layout in light and dark themes.
• Adds deterministic coverage for nine real UI scenarios plus physical-pointer regressions for sidebar and updater actions.
• Verifies clean migration from representative 0.0.x, 0.1.x, and 0.2.x settings and connection data.
• Improves transfer recovery after sleep, wake, network loss, and network restoration without discarding queued or resumable work.
• Preserves private crash-symbol dSYM files locally while stripping them from the public app and DMG.
• Updates the README with current privacy-safe demo screenshots.

The public build now targets Apple Silicon only (arm64) and requires macOS 11 or newer. Intel users should remain on 0.2.1; the source still retains an explicit x86_64 build override for compatibility experiments.

The distributed DMG is signed with Apple Developer ID, notarized by Apple, stapled, and verified by Gatekeeper. The release passed 188 automated tests, nine UI render scenarios, warning-free Clippy, dependency auditing, source/history secret scanning, a mounted-DMG privacy scan, and a smoke test of the exact notarized artifact.

SHA-256 (gmacFTP-0.2.2.dmg):

1a50e18efc58520941b57b292ba6b7539ecba5743eeb10200a045d4181557925

gmacFTP 0.2.1 — Mouse input hotfix

This is a critical input hotfix for 0.2.0.

• Restores physical mouse clicks for custom toolbar buttons, connected and saved server rows,
  dialog actions, toggles, connection management, and the remaining custom controls. Keyboard and
  VoiceOver activation were unaffected.
• Adds a pointer-delivery regression test that reproduces the 0.2.0 failure and prevents it from
  returning.
• Verified in the running signed build across the toolbar, connection manager, sidebar session
  switching, dialogs, toggles, file controls, and the native macOS menu.
• Universal for Apple Silicon and Intel, Developer ID signed, Apple-notarized, and compatible with
  macOS 11 or newer.
• 177 automated tests pass; Clippy, dependency auditing, source/history scanning, and mounted-DMG
  privacy checks are clean for the distributed macOS targets.

Users of 0.2.0 should update to 0.2.1.

SHA-256 (gmacFTP-0.2.1.dmg):
195941faa8cef89cbb9dfd336f651e3e72f1fa8aa125b72a5ab63221469a40c1

gmacFTP 0.1.1

gmacFTP 0.1.1 is the fully synchronized public build of the performance, security, and workflow milestone for the native macOS FTP, FTPS, and SFTP client written in Rust with Slint.

Changes since 0.1.0:

• Updated ureq to 3.3, sha2 to 0.11, directories to 6, and roxmltree to 0.21
• Hardened the updater so every redirect must remain HTTPS and on the explicit GitHub host allowlist
• Corrected Homebrew installation documentation

This release includes the complete 0.1 feature set: native multi-selection, reliable resumable batch transfers, reusable FTP/SFTP sessions, pipelined SFTP I/O, folder synchronization with mandatory dry run, protected remote editing, file operations, and modern SFTP authentication.

Verification:

• 93 automated tests, formatting, Clippy, release build, dependency audit, and secret scan passed
• Signed with Apple Developer ID
• Notarized and stapled by Apple
• Accepted by macOS Gatekeeper
• SHA-256: 24bf2efb9c90911ad96bc727f81b5e7292e3cda383fff5fe12fa923fbae0a68a

Requires macOS 11 or later on Apple silicon.

gmacFTP 0.1.0

gmacFTP 0.1.0 is a major performance, security, and workflow milestone for the native macOS FTP, FTPS, and SFTP client written in Rust with Slint.

Highlights:

• System-style Shift range selection, Command individual selection, and Select All
• Reliable multi-file transfers with clear error details, skip or abort decisions, retry, resume, and per-transfer cancellation
• Reusable FTP/SFTP sessions, pipelined SFTP I/O, bounded queues, and configurable concurrent connections
• Folder upload/download sync with exclusions, mandatory dry run, and a safety re-scan
• Create, rename, permissions, recursive delete preflight, and protected remote editing
• SFTP passwords, Ed25519/ECDSA private keys, and SSH Agent authentication
• Faster local and remote listings with cached asynchronous folder statistics

Security and release verification:

• Full test suite, Clippy, formatting, dependency audit, and secret-history scan completed
• Signed with Apple Developer ID
• Notarized and stapled by Apple
• Accepted by macOS Gatekeeper
• SHA-256: 8c586a804648961e3e4d0952736a700b368580083a3aa297009b2961c43bb436

Requires macOS 11 or later on Apple silicon.

gmacFTP 0.0.20 — multi-selection and resilient batch transfers

What’s new

• Finder-style multi-selection: Command-A, Shift-click/Shift-arrow ranges, and Command-click for arbitrary files and folders.
• Copy mixed file/folder selections together with Enter, the transfer arrows, or in-app drag and drop.
• Multiple overwrite conflicts are queued safely instead of replacing one another.
• A bad, locked, or unreadable file pauses a multi-file FTP/FTPS/SFTP batch before the next item: skip and continue, or stop only that batch.
• Single-file failures now show a clear modal with the file name and concrete error.

Security and verification

• Public-only build; personal configuration is not loaded or included.
• Signed with Apple Developer ID (Team ID SY4HQ4PWVU), Hardened Runtime enabled.
• Apple notarization accepted with 0 issues; ticket stapled and Gatekeeper verified.
• SHA-256: dcfaf615385b05ab5d4d52fa2da31df7c99613f6475bb0f065e339e60662f466
• 73 automated tests, Clippy, release build, and RustSec audit passed.

Install

Download the DMG, open it, and drag gmacFTP to Applications, or use:

brew install --cask gmac-pl/gmacftp/gmacftp

Requires macOS 11 or newer on Apple Silicon.

gmacFTP 0.0.19

Security and data-integrity release following a full code, dependency, build, and release audit.

• Vault key changes are transactional. Switching iCloud synchronization no longer deletes the
  working Keychain master key before the replacement has been stored and read back. Keychain access
  errors are distinct from a genuinely missing key, so a transient denial cannot generate a
  replacement key and strand an existing vault.
• Credentials are scoped to the complete endpoint. Protocol, normalized host, effective port,
  and username form the credential identity. Existing local (host, user) records migrate once
  from an exact saved-endpoint allowlist before cloud metadata is read, without sharing a password
  with a newly imported service on the same host.
• Folder operations stay inside the selected tree. Local uploads and copies no longer follow
  symlinks; cycles, descendant copies, excessive depth, and excessive entry counts fail safely.
  Remote drag staging is private and removed when the drag finishes or fails.
• Hostile-server input is bounded before allocation. FTP and SFTP directory entries are consumed
  incrementally. SFTP requests have operation deadlines, and FTP passive data connections are pinned
  to the control peer instead of trusting a server-supplied PASV address.
• TLS exceptions are endpoint-specific. Accepting a self-signed FTPS certificate for one saved
  server no longer disables certificate verification for other servers.
• Synchronized state is validated before adoption. Sync files have strict size and type limits;
  encrypted vault data is authenticated before it can replace an existing local vault, and
  plaintext connection metadata cannot sync weaker transport settings. Wrapped-key/KDF data uses
  an explicit version and parameters while retaining compatible legacy reads.
• The updater verifies publisher identity. It requires the exact GitHub asset, GitHub's byte
  count and SHA-256 digest, a Developer ID signature from Team ID SY4HQ4PWVU, the expected DMG
  signing identifier, and a stapled Apple notarization ticket before Finder opens the image.
• Release tooling fails closed. Strict builds accept only the intended Developer ID team,
  validate the provisioning profile and bundle identifier, sign the DMG itself, require successful
  notarization, and emit a SHA-256 file. CI actions are commit-pinned with read-only permissions.
• Security dependency refresh. FTP/FTPS now uses suppaftp 10.0.0 with wire logging disabled,
  SFTP uses russh 0.62.2, and memmap2 0.9.11 replaces the vulnerable 0.9.10 release.
• Importer fixes. FileZilla base64 passwords are decoded, implicit FTPS records are no longer
  silently treated as explicit FTPS, and import input is bounded.

gmacFTP 0.0.18

Security hardening release.

• FTPS fails closed unless plaintext FTP is deliberately enabled for that one legacy connection.
• New SFTP host keys require explicit fingerprint confirmation; changed keys fail closed.
• Transfer paths, network timeouts, recursive listing limits, credential migration, imports and diagnostics are hardened.

The included DMG is signed with Apple Developer ID and notarized by Apple. See CHANGELOG.md for the complete list.

gmacFTP 0.0.17

A bugfix release. Folder downloads from an FTP/SFTP server were broken; this also tightens the path-containment guard that caused it.

• Folder downloads work again. Dragging a folder (or using the arrow button) from a remote pane to a local pane no longer failed with downloaded 0 file(s); skipped N unsafe path(s). The write-boundary containment guard canonicalized the destination folder path, but that folder does not exist until the first file is written — so canonicalize returned NotFound and every file was silently skipped. The guard now resolves the nearest existing ancestor instead, so a not-yet-created destination root is tolerated (single-file downloads were always unaffected).
• Folder downloads no longer error-loop on session-limited FTP servers. Each file in a folder download opens its own FTP session, and shared-hosting servers that cap concurrent sessions would answer the next connect with 421 Too many connections — which, across a large folder, cascaded into a rapid storm of errors. Downloads now retry with escalating backoff (up to ~8 s) when the server is briefly over its session limit, so the previous file's slot has time to release.
• Arbitrarily large folders stream through a small queue (backpressure). A folder download no longer pre-loads every file into a fixed-size queue — that capped at a few hundred files and failed the rest with transfer queue full. The folder loop now streams jobs into the transfer engine one at a time, waiting when the queue is full, so a 10 000-file download flows through with bounded memory and nothing is dropped.
• No more per-file pane flicker during a folder transfer. The remote/local panes used to re-list (and recalculate folder sizes) after every single file finished. They now refresh once, at the end of the whole batch.
• Transfer UI polish. The compact bottom bar now shows the name of the file currently copying (it used to freeze on the initial label during a fast batch). The transfer panel summary leads with overall progress ("127 / 283 done · …"), the header pill shows done/total with proper padding, and the toolbar Transfers button carries a pending-count badge that opens the panel on click.
• Folders now ask before overwriting. Copying a folder whose name already exists at the destination used to merge silently (only single files prompted). Folders now go through the same overwrite dialog — Overwrite merges into the existing folder, Save-as-new renames, Cancel aborts. (Per-file prompts inside a large folder are intentionally not added — a 300-file folder would mean 300 dialogs.)
• Path-containment guard hardened (defense-in-depth). The same guard now rejects any .. traversal component outright, and the lenient canonicalization no longer silently drops a trailing .. (which Path::file_name() hides). No remote exploit was reachable — sanitize_local_rel already strips .. from server-controlled names — but the write-boundary backstop is now self-sufficient rather than relying on the primary defense.
• Clippy is now clean under -D warnings. Factored the three complex static types into aliases, gave try_enqueue a real error type (QueueFull), made the transfer-thread-local a const initializer, and fixed a handful of redundant-closure / unnecessary-ownership lints. The ten wide internal-helper signatures (AppCtx-style argument lists) are explicitly allowed — they are deliberate and noted as known in ci.yml. Pure code-quality; no behavior change.

Verified: release build + 29 unit/integration tests + cargo clippy -D warnings + cargo fmt --check all green.