Skip to content

v3.4.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Sep 15:21
· 6 commits to main since this release
v3.4.3
92cd724
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

rEFInd_GUI v3.4.3

Supply-chain and install-integrity hardening. This release builds on the security-audit remediations shipped in v3.4.2 and makes every release artifact verifiable end to end.

Release integrity

  • Every release artifact now ships a matching .sha256 sidecar (deb, Arch pkg, rpm, src.rpm, and the Windows installer). Verify a download before trusting it, e.g.: 
    sha256sum -c refind-gui_3.4.3_amd64.deb.sha256

Installer (install-rEFInd-GUI.sh)

  • Verifies each release package's SHA-256 before installing it across every path — dnf (Fedora), rpm-ostree (Bazzite), pacman (Arch/CachyOS), and apt (Debian/Ubuntu). Required from v3.4.3 on; v3.4.2 was the transitional exception.
  • Upgrades packages in place instead of removing the working package first, so a failed download/verify never leaves the system with nothing installed.
  • Fails closed when a runtime dependency (xterm) can't be installed, and uses the exact downloaded RPM filename on Bazzite.
  • Refuses to delete ~/rEFInd_GUI unless it is a clean clone of this repository — protects a contributor/development checkout.

Packaging / CI

  • The RPM build now stages both systemd units (Source0 bg + Source1 theme randomizer), fixing a Bad source failure in the rpm release build.
  • The Windows installer build fails closed if ISCC.exe isn't validly Authenticode-signed before building the installer.

Signed release tags (opt-in, inert by default)

  • Groundwork for GPG-signed release tags: the release workflows verify the tag signature when a public key is committed to .github/release-signing-key.asc, and skip with a warning until then. The PKGBUILD/.spec builds do a best-effort git verify-tag when a key and gnupg are present. See SIGNING-TAGS.md.

Notes

  • The Windows installer (rEFInd_GUI-3.4.3-setup.exe) is not yet Authenticode-signed (SignPath setup pending) — verify it with its .sha256 sidecar.
  • Reminder: SteamOS is intentionally refused by this installer — the Steam Deck is served by the sibling SteamDeck_rEFInd project.

Full changelog: v3.4.2...v3.4.3

Assets 12
Loading