Tora v1.1.0

Tora v1.1.0

This release focuses on hardening the macOS app around unsafe filesystem input, tightening release packaging, and improving the public GitHub Pages experience.

Highlights

• Added stricter symlink protection for download roots, torrent paths, and deletion targets so torrent-provided paths cannot escape the approved Tora download area through existing symbolic links.
• Hardened persistence loading by rejecting oversized metadata and settings files before decoding.
• Improved libtorrent integration checks and release packaging so release builds include binary verification for bundled app artifacts.
• Added sandbox entitlements for the packaged macOS app, including network access and Downloads folder access.
• Refreshed the GitHub Pages site with a product-first layout, real app screenshot, clearer security messaging, and mobile-safe navigation.

Security and safety

• DownloadPathPolicy now rejects symlinked download directories and symlinked intermediate path components.
• TorrentPathValidator rejects existing symlink path components before accepting torrent-provided file paths.
• DeletionPolicy rejects deletion roots that resolve through symlinks or outside the approved download root.
• Added tests for symlink traversal, sibling-prefix rejection, deletion boundaries, and oversized persistence files.

Release pipeline

• Release packaging now verifies bundled Mach-O binaries and app entitlements before shipping artifacts.
• The release workflow builds libtorrent from source for the configured macOS deployment target before packaging.
• GitHub releases can now use versioned curated release notes when .github/release-notes/<tag>.md exists.

Included artifacts

The release workflow publishes:

• Tora-v1.1.0-macos.zip
• Tora-v1.1.0-macos.zip.sha256
• Tora-v1.1.0-macos.dmg
• Tora-v1.1.0-macos.dmg.sha256