Ghost FTP 1.1.7

Ghost FTP 1.1.7

Privacy-first FTP, FTPS and SFTP desktop client for Windows and Linux.
Release channel: Stable.

Highlights

Native Windows UI and UX

• Fixed helper-window lifecycle so closing Prompt, Settings, Diagnostics, About, Language or DecisionCard surfaces never terminates the main application message loop.
• Unified application-owned modal windows around one DPI-aware owner/modal keyboard contract with Tab, Shift+Tab, Enter and Escape behavior.
• Replaced mixed stock Confirm/Info/Error surfaces with Ghost FTP DecisionCard windows while retaining stock Windows dialogs only as creation-failure fallback.
• Added adaptive DecisionCard heading/body sizing for longer localized and security-sensitive text instead of clipping content into a fixed body area.
• Unified the Windows and Linux desktop Light/Dark palette contract; Classic Light uses restrained neutral surfaces instead of a pure-white workspace.
• Consolidated Windows Settings into one application-owned settings window with inline validation, locale-safe label geometry and standard keyboard navigation.
• Kept Windows icons local to the OS using Segoe Fluent Icons with Segoe MDL2 Assets fallback; no external icon/font runtime was added.

Localization and branding

• Localized OK, Cancel, Yes and No through the active runtime language across the maintained 24-language contract.
• Localized Save Profile privacy/security decisions without changing credential retain/remove or automatic-clear semantics.
• Localized native SSH private-key and local-folder picker titles/filter labels at the time each picker opens.
• Made Ghost FTP the only active runtime, package, support and release-documentation identity; author/publisher identity is intentionally confined to the application About surface.
• Removed publisher branding from Debian/RPM package metadata and generic runtime metadata while preserving the About author attribution.

Linux distribution and verification

• Added canonical generic Linux .tar.gz archives for amd64, arm64 and i386 alongside matching DEBs.
• Production verifies archive structure and byte-for-byte ghostftp executable parity between each generic tar.gz and its matching DEB.
• Expanded the canonical release shape to 12 platform artifacts / 15 public files.
• Added maintained supplemental distro-specific Debian, Ubuntu, Fedora RPM and distro-neutral Portable package construction.
• Added real package-manager install/remove plus installed-GUI smoke verification on Debian 13 amd64, Ubuntu 26.04 LTS amd64 and Fedora 44 x86_64.
• Preserved build/metadata/extraction/byte-parity verification for arm64/aarch64 and i386/i686 without overstating native install coverage.

Security, stability and performance

• Preserved explicit FTPS as the fresh secure default with certificate/hostname validation and no silent secure-to-plain downgrade.
• Preserved SFTP host-key verification/pinning, protected-secret ownership/lifetime rules and privacy-safe diagnostics.
• Preserved rooted local filesystem/transfer activation, path-containment, staged commit/rollback and connection-generation safeguards.
• Kept transfer refresh event-driven so idle timer activity does not rebuild the queue when no transfer events exist.
• Added no telemetry, analytics, advertising, tracking SDK, hidden network service, remote UI runtime or external Go module dependency.

Release contract

The 1.1.7 Stable candidate requires:

• go test -race ./..., go vet ./... and Go formatting checks;
• brand/repository/platform/desktop/dependency/version/localization/security/privacy/documentation/release audits;
• complete Python regression suite;
• Windows x64/x86 Setup + Portable production builds and release-artifact verification;
• Linux amd64/arm64/i386 DEB + tar.gz production builds and byte-parity verification;
• supplemental distro-package build/parity CI;
• Debian 13, Ubuntu 26.04 LTS and Fedora 44 native lifecycle/GUI smoke;
• Authenticode policy verification and private-key pipeline smoke test;
• authentic Windows x64 Portable Main/Site Manager/Settings/About screenshots from the exact final release-prep head;
• exact-head PR CI and exact post-merge main CI;
• exact-main release/ghostftp-v1.1.7 branch validation;
• immutable ghostftp-v1.1.7 Stable GitHub Release with prerelease=false, exact 15-file asset set and GHCR 1.1.7 distribution-bundle publication/read-back.

Release tag

ghostftp-v1.1.7

Public platform packages

Windows:

• Ghost-FTP-1.1.7-Setup-x64.exe — 64-bit Windows installer.
• Ghost-FTP-1.1.7-Setup-x86.exe — 32-bit x86 Windows installer.
• Ghost-FTP-1.1.7-Setup-x32.exe — byte-identical compatibility alias of the x86 installer.
• Ghost-FTP-1.1.7-Portable-x64.exe — portable 64-bit Windows executable.
• Ghost-FTP-1.1.7-Portable-x86.exe — portable 32-bit x86 Windows executable.

Linux:

• Ghost-FTP-1.1.7-Linux-amd64.deb — Debian package for amd64.
• Ghost-FTP-1.1.7-Linux-arm64.deb — Debian package for arm64.
• Ghost-FTP-1.1.7-Linux-i386.deb — Debian package for i386.
• Ghost-FTP-1.1.7-Linux-amd64.tar.gz — package-manager-neutral portable archive for amd64.
• Ghost-FTP-1.1.7-Linux-arm64.tar.gz — package-manager-neutral portable archive for arm64.
• Ghost-FTP-1.1.7-Linux-i386.tar.gz — package-manager-neutral portable archive for i386.
• Ghost-FTP-1.1.7-Linux-multiarch.zip — bundle containing the three verified Debian packages.

GitHub Packages

• Package: ghcr.io/bren-wp/ghost-ftp:1.1.7
• Type: verified OCI distribution bundle, not a runtime container.
• Contents: the same verified release directory under /ghostftp-release/.
• Stable aliases: 1, 1.1, latest.
• The workflow verifies registry readback before completing publication.

Verification files

• SHA256.txt — SHA-256 checksums for every public release file except SHA256.txt itself.
• RELEASE-NOTES.txt — these notes generated from CHANGELOG.md.
• BUILD-METADATA.txt — version, release tag, source commit, signing state and distribution metadata.

Release contract

• 12 platform artifacts.
• 15 public release files total, including the three verification/metadata files.
• Active application platforms: Windows and Linux.
• Local language catalog: 24 selectable languages with English default/fallback.
• Application telemetry: disabled.
• Linux portable archives are structurally verified and their ghostftp executable must be byte-identical to the matching DEB payload before publication.

Signing and trust

The workflow never fabricates publisher identities. Production Authenticode signing is optional: when a protected trusted certificate is configured, Windows artifacts are signed and verified; when it is not configured, the release remains explicitly unsigned and BUILD-METADATA.txt records WINDOWS_AUTHENTICODE=unsigned. Never treat a locally generated or self-signed certificate as a trusted public publisher identity. Always verify SHA256.txt and the official GitHub release location before installation or deployment.

Privacy

Release bundles contain only the explicit verified artifact allow-list. They do not contain saved profiles, FTP/SFTP passwords, private-key passphrases, signing private keys, local application data or user files.

Ghost FTP 1.1.6

Ghost FTP 1.1.6

Privacy-first FTP, FTPS and SFTP desktop client for Windows and Linux.
Release channel: Stable.

Highlights

Filesystem race hardening

• Hardened recursive local deletion against directory/pathname swaps by traversing verified child directories through opened os.Root handles instead of rebuilding mutable pathnames during recursion.
• Added a deterministic regression that swaps the selected delete root after validation and proves content outside the originally opened tree survives.
• Hardened local directory creation so Mkdir is performed relative to an opened base-directory os.Root, preventing a late base pathname replacement from redirecting creation into a different filesystem object.
• Added deterministic path-swap regression coverage proving the new child directory is created under the originally opened base directory.

SFTP trust and remote cleanup integrity

• Bound the SFTP host-key SHA-256 fingerprint directly to the exact public-key blob selected from ssh-keyscan output and compute the OpenSSH-compatible fingerprint in memory.
• Verify that the embedded public-key algorithm matches the algorithm declared by the scanned host-key line before presenting or persisting trust.
• Removed the fingerprint-only temporary key file and second ssh-keygen -lf pathname reopen from the trust decision path.
• Stopped treating spoofable remote diagnostic text such as No such file, does not exist or not found as proof that a staging/rollback object is absent.
• Only successful cleanup or curl's structured REMOTE_FILE_NOT_FOUND exit result can confirm absence; non-zero OpenSSH SFTP cleanup remains fail-closed and blocks automatic retry while remote state is uncertain.
• Added regression coverage for a fixed OpenSSH SHA-256 fingerprint fixture, algorithm mismatch, malformed key blobs, spoofed missing-file text and structured curl not-found handling.

Release discipline and verification

• Kept the release workflow workflow_dispatch-only and preserved the exact-main release/ghostftp-vX.Y.Z canonical publication trigger.
• Preserved the 9 platform artifacts / 12 public files Stable release contract for Windows x64/x86 Setup and Portable plus Linux amd64/arm64/i386 DEB and multiarch bundle.
• Preserved optional production Authenticode with truthful WINDOWS_AUTHENTICODE=signed|unsigned metadata and no generated/self-signed production publisher identity.
• Added no external Go module dependency, telemetry, analytics, advertising, tracking, remote UI runtime or hidden product network service.

Required verification

The 1.1.6 stable candidate must pass before publication:

• go test -race ./...;
• go vet ./...;
• Go formatting checks;
• dependency/repository/platform/desktop/localization/security/privacy/documentation/release audits;
• full Python regression suite;
• Windows x64/x86 Setup + Portable production builds, Setup-x32 alias verification and release artifact verification;
• Linux amd64/arm64/i386 production builds, DEB verification and multiarch packaging contract;
• Authenticode production-policy verification and private-key pipeline smoke test;
• authentic Windows x64 Portable Main/Site Manager/Settings/About capture and visual review on the exact final release-prep head;
• exact-head release-prep PR CI;
• post-merge Core/Windows/Linux verification on the exact main SHA;
• exact-main release/ghostftp-v1.1.6 branch validation;
• immutable ghostftp-v1.1.6 tag, Stable GitHub Release with prerelease=false, exact 12-file asset set and GHCR 1.1.6 distribution-bundle publication/read-back.

Release tag

ghostftp-v1.1.6

Public platform packages

Windows:

• Ghost-FTP-1.1.6-Setup-x64.exe — 64-bit Windows installer.
• Ghost-FTP-1.1.6-Setup-x86.exe — 32-bit x86 Windows installer.
• Ghost-FTP-1.1.6-Setup-x32.exe — byte-identical compatibility alias of the x86 installer.
• Ghost-FTP-1.1.6-Portable-x64.exe — portable 64-bit Windows executable.
• Ghost-FTP-1.1.6-Portable-x86.exe — portable 32-bit x86 Windows executable.

Linux:

• Ghost-FTP-1.1.6-Linux-amd64.deb — Debian package for amd64.
• Ghost-FTP-1.1.6-Linux-arm64.deb — Debian package for arm64.
• Ghost-FTP-1.1.6-Linux-i386.deb — Debian package for i386.
• Ghost-FTP-1.1.6-Linux-multiarch.zip — bundle containing the three verified Debian packages.

GitHub Packages

• Package: ghcr.io/bren-wp/ghost-ftp:1.1.6
• Type: verified OCI distribution bundle, not a runtime container.
• Contents: the same verified release directory under /ghostftp-release/.
• Stable aliases: 1, 1.1, latest.
• The workflow verifies registry readback before completing publication.

Verification files

• SHA256.txt — SHA-256 checksums for every public release file except SHA256.txt itself.
• RELEASE-NOTES.txt — these notes generated from CHANGELOG.md.
• BUILD-METADATA.txt — version, release tag, source commit, signing state and distribution metadata.

Release contract

• 9 platform artifacts.
• 12 public release files total, including the three verification/metadata files.
• Active application platforms: Windows and Linux.
• Local language catalog: 24 selectable languages with English default/fallback.
• Application telemetry: disabled.

Signing and trust

The workflow never fabricates publisher identities. Production Authenticode signing is optional: when a protected trusted certificate is configured, Windows artifacts are signed and verified; when it is not configured, the release remains explicitly unsigned and BUILD-METADATA.txt records WINDOWS_AUTHENTICODE=unsigned. Never treat a locally generated or self-signed certificate as a trusted public publisher identity. Always verify SHA256.txt and the official GitHub release location before installation or deployment.

Privacy

Release bundles contain only the explicit verified artifact allow-list. They do not contain saved profiles, FTP/SFTP passwords, private-key passphrases, signing private keys, local application data or user files.