Zero Breach Toolkit 2.0.7

Zero Breach Toolkit 2.0.7 is now the main release. Three fixes, all reported by people using the toolkit; the Honor fix was confirmed on the phone it was reported from. If you're on an older version, updating is recommended.

Fixes

• Mac: one damaged app file no longer stops the out-of-date-program check. If a single app in Applications had a loosely written information file, the whole check stopped with "module error: XML declaration not well-formed" and no installed program was checked at all. That one file is now skipped and every other app is still checked. Reported by Natha.
• Android on Honor phones: Honor's App Market is recognised as an app store. Apps installed from it were all reported as hand-installed, so on one phone 56 of 65 such warnings were ordinary store apps, hiding the ones worth a look. Honor split from Huawei in 2020 and its phones do not carry Huawei's store. Reported by Verchiel666; the fix was contributed by dhruv1220.
• Checking a download is now spelled out properly. The verification steps below now say to import the signing key first, show its fingerprint to compare, and explain GPG's "not certified" warning. The key has always been published with every release, but the earlier wording could not work as written. Reported by Natha.

Your antivirus may flag these programs. Antivirus products often wrongly flag new programs that are not code-signed yet, and some flag these. If you downloaded the file from this page, this is a false alarm and you can ignore it: the code is public, and each program has a public build record you can check. Bitdefender has accepted our report and is removing its detection; we are reporting the others, and we have applied for free code signing. If the file came from anywhere else, do not run it and trust the warning.

Downloads and first-launch steps: see the README. Full list: CHANGELOG.

Verify before running

Each program: gh attestation verify <file> --repo interplains/Zero-Breach-Toolkit.

The checksums are also GPG-signed. Import the signing key first - it is in the asset list below, as archivegenocide-signing-key.asc:

gpg --import archivegenocide-signing-key.asc
gpg --verify SHA256SUMS-programs.txt.asc SHA256SUMS-programs.txt
sha256sum --ignore-missing -c SHA256SUMS-programs.txt

For the single Python file, the same with SHA256SUMS.txt.asc and SHA256SUMS.txt.

Compare the key's fingerprint before you trust it: C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. GPG will also say the key is not certified with a trusted signature - that is normal, and it does not mean the signature is bad; it only means you have not personally signed the key. Full instructions: docs/VERIFYING.md.