v0.64.3

Client integrity

manifest_sha256: 539d0907bbd860ade55bec7cb647d896736d7c2fc5969f3e31a2b1b360986dab

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 71: first-sign-in device id + reconnect force-sync by @deeperguard in #174

Full Changelog: v0.64.2...v0.64.3

v0.64.2

Client integrity

manifest_sha256: a75191799eeba9f893a4ef74e329177f71274d198bab3587dd618deb7476d4ca

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 70: no session-expired bounce on silent post-login unlock by @deeperguard in #173

Full Changelog: v0.64.1...v0.64.2

v0.64.1

Client integrity

manifest_sha256: 514c09f27f28417088681695e9f8640ec1d9e1a9dd994281792865c2e9feeb23

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 69: Feature C device-approval UI polish by @deeperguard in #172

Full Changelog: v0.64.0...v0.64.1

v0.64.0

Client integrity

manifest_sha256: 1793bb3395b18b742df930af33710547ecc6f4021db20c9a89cc158402bbd95c

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 68 Feature C: out-of-band device approval for vault start by @deeperguard in #171

Full Changelog: v0.63.2...v0.64.0

v0.63.2

Client integrity

manifest_sha256: 3f40e76be45ca604f38347a8950b01b79380b1c9229e1b8a2d116199c151e157

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 67: release-hash timeouts, retry, and loaded-asset cross-check by @deeperguard in #170

Full Changelog: v0.63.1...v0.63.2

v0.63.1

Client integrity

manifest_sha256: 76a60f20a6344119bd3ccaf0fc8c611f37c36d2c18a0171c039547ba6e8b3ec1

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 66: compute release hash from loaded assets; warn if newer release by @deeperguard in #169

Full Changelog: v0.63.0...v0.63.1

v0.63.0

Client integrity

manifest_sha256: a48499bc76aae8a0c5b8f56dd89458376d83b1b48cb93fc9260c6f12a083e853

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 65 Feature B: client automatic release-hash check by @deeperguard in #168

Full Changelog: v0.62.1...v0.63.0

v0.62.1

Client integrity

manifest_sha256: 605a4d7e53679551a3b99d9144547a56a77dc8970d29c94c266e055ab96bab7c

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Mark v0.62.0 Sigstore-signed for About/verify by @deeperguard in #166
• Round 64: Feature A retest fixes (rollback demo, history, trash labels, unlock race) by @deeperguard in #167

Full Changelog: v0.62.0...v0.62.1

v0.62.0

Client integrity

manifest_sha256: 47147f872b0b19afaac82641c07b5a8b5340356e642f5e6819bf7b5047d9037a

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Round 62: point About/verify at signed release v0.61.1 by @deeperguard in #161
• Fix inaccurate PBKDF2 mentions on marketing page by @deeperguard in #162
• Close L-17, L-19, L-21, and L-22 from the 2026-10-23 security review by @deeperguard in #164
• Round 63 Feature A: sync freshness (rollback / freeze / fork) by @deeperguard in #165

Full Changelog: v0.61.1...v0.62.0

v0.61.1

Client integrity

manifest_sha256: 1cb8f4bb55d91177edbb6e6db9cb9116af03f6a71ff88b4713cbbdc77df3d9fa

Verify:

cosign verify-blob \
  --bundle client-manifest.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deeperguard/Deeperguard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  client-manifest.json

Rebuild from this tag with SOURCE_DATE_EPOCH=0 python3 scripts/build-client-manifest.py --print-hash — the hash must match.

What's Changed

• Install client integrity and release signing workflows by @deeperguard in #160

Full Changelog: v0.61.0...v0.61.1