isoshelf v0.8.12

Fixed

• Updating by itself no longer tries images it can only check (#78).
  Tails, Clonezilla alternative, MX Linux and the other update-check-only
  images have an update isoshelf can say is out, but no checksum it could
  prove a download with. Automatic updates queued them anyway, and each one
  failed with "this image has no download source yet". Update all on the
  page always skipped them; now both do.

Security

• Every release takes the newest Go patch by itself. isoshelf names only
  Go's 1.27 line now, so a Go security fix reaches the next release without
  anybody remembering to raise a number.
• A weekly audit checks the code and the newest released program for
  known security holes, and newer versions of what isoshelf uses, and keeps
  one issue labeled audit up to date, closing it when all is clear.
• The GitHub Actions steps and the container's Alpine base are brought up to
  date (Alpine 3.21 to 3.24).

isoshelf v0.8.11

Security

• Built with Go 1.27.3. v0.8.10 was built with Go 1.27.1, which has 13
  known security holes that isoshelf's code can reach: in how it serves and
  fetches over HTTP/2, and in the template behind the sign-in page. Go 1.27.3
  fixes all of them. Update if isoshelf answers on a network.
• CI now checks every change, and every Monday, against Go's list of known
  security holes, and GitHub proposes updates to what isoshelf is built with
  as pull requests.

Added

• A Download button on each image (#84, by @paulbmueller): saves the
  file onto the computer you are using, the way to get an image off a NAS
  without fetching it from the project again. Off unless Settings → Images
  → Allow downloads is on, and off means the server refuses too, not just
  that the button is hidden. Only files isoshelf lists can be downloaded.

Fixed

• The download read the folder's records without waiting for a scan that was
  rewriting them, which could stop isoshelf; it waits now. The setting says
  what turning it on means on a network.

isoshelf v0.8.10

Changed

• An MD5 or SHA-1 checksum is treated as weak. A download that matches
  one is still checked, so a damaged file is thrown away, but it is never
  called verified and it never replaces or removes the file you already
  have. Those checksums catch damage, not deliberate changes. isoshelf's
  design always said this; until now the program didn't act on it.

Added

• Checksum files that don't name the file - "SHA256: ", or the
  hash alone - can be read. AnduinOS publishes its checksums this way.

The list of images makes PikaOS, BigLinux and AnduinOS downloadable in a
later update, once copies older than this one no longer matter: they would
treat an MD5 as proof, or fail to read AnduinOS's checksum.

isoshelf v0.8.9

Added

• The list of images can name a checksum file after part of the image's
  own name. Fedora names its checksum after the build (44-1.7), which
  nothing else reports, so its entries have had to be moved to each new
  release by hand (#6).
  With this, a later update to the list lets them follow the newest Fedora
  by themselves. Copies of isoshelf older than this one would refuse a list
  that used it, so the list waits a little before it does.
• A plain disc, for images whose project's logo can't be shown here.
  The list of images starts using it in a later update; until then those
  images show their initials, as they have since the list stopped naming
  their logos.

Removed

• The Ubuntu, Windows, Windows 11, AtlasOS and NiceHash logos no longer ship
  inside isoshelf. The list of images stopped naming them on 2026-09-29.

isoshelf v0.8.8

Changed

• Settings in six groups, with a link to each along the top: This
  folder, Updates, Sign-in and other isoshelfs, The list of images, How it
  looks, and isoshelf itself. On a server the folder used to be listed
  twice; it is listed once now.
• The Archive folds like History, its heading saying how many files
  and how much space they take. Empty archive is inside, so emptying it is
  always a second step.
• Usage and Tools are in the top bar, and every link there opens the
  part of the page it jumps to if that part is folded.

Added

• What's new, beside the version in Settings: that version's release
  notes. When a newer isoshelf is out, its notice links to what that one
  changed too.
• The list of images can mark an image as recognized but not offered in Add
  images. AtlasOS will be the first, in a later update to the list: copies
  of isoshelf older than this one would refuse a list using it.

isoshelf v0.8.7

This release also carries everything in v0.8.6, which was never published
on its own: a Usage section, folded low on the page, showing the last 8
weeks of your folder (what arrived, what left, how often it was read) and
everything about this isoshelf in one place. The v0.8.6 section of
CHANGELOG.md has the details.

Fixed

• isoshelf could crash if the page refreshed while a scan was working out
  checksums. A scan showed the page what it had found before its slow
  part, then went on filling in the same records the page was reading, with
  nothing to keep the two apart. Usually nothing happened; now and then Go
  stopped the program with "concurrent map iteration and map write". The
  page now gets its own copy, and the scan's finished result replaces it
  when the scan ends.

isoshelf v0.8.5

Added

• isoshelf update on the command line
  (#1), for a terminal or
  a scheduled job. It checks the folder, then downloads every update
  isoshelf can, verified exactly as the page does. Say what happens to each
  old file with --keep, --move-aside (to the archive) or --delete -
  there is no default. --only ID updates just those images, --dry-run
  says what it would download and changes nothing, and a pinned file is kept
  whatever the flag says. Updates you dismissed on the page are skipped
  unless you name them with --only.

isoshelf v0.8.4

Added

• Duplicate copies (#57).
  When the same image and version are in the folder twice, the line above
  the list counts them, and clicking the count shows them, each saying which
  file it matches. Make sure reads them and compares, only when you press
  it; Remove this copy… removes one the usual way, archive first.
• A word about sharing, beside the sharing switch and in the README:
  the licenses of the images you share are yours to mind, as with any file
  share.

Fixed

• The container guide named the sharing switch Let other isoshelfs copy
  from this one; it is Share this folder with other isoshelfs.

isoshelf v0.8.3

Added

• Where to find it, for images you download yourself
  (#58): the list of
  images can now say where the file is on a project's download page - "The
  32-bit ISO is MX-23.6_386.iso, in the Xfce folder" - and the image's
  details show it right above the Download page link.

The first notes arrive in a later update to the list of images, not in this
release: copies of isoshelf older than this one refuse a list with a field
they don't know, so the list starts using it once they have had time to
update.

isoshelf v0.8.2

Added

• Dismiss an update (#56)
  for 7, 30 or 90 days, or for good, from the image's details. It stays in
  the list, greyed, saying until when, and sorts with the ones that are up
  to date. It isn't counted as an update, and Update all and updating by
  itself leave it alone. The date holds even if a newer version comes out
  meanwhile. Settings lists everything you've dismissed, with Undo on each
  and Undo all.