RemoteFlow 0.2.6

RemoteFlow 0.2.6 is the first release you can install on Linux, and it carries a dependency security fix that affects every platform.

Highlights

A Debian package for Linux. remoteflow_0.2.6_amd64.deb installs to /opt/remoteflow, puts remoteflow on your PATH, and registers a launcher entry and icons, so RemoteFlow shows up in your application menu like anything else you installed. Uninstalling keeps your connections, settings and host keys — everything RemoteFlow writes follows the XDG base directory spec and lives under $HOME, which dpkg never touches. Remote Desktop stays Windows-only; an RDP connection on Linux points you at FreeRDP or Remmina.

SSH.NET moves to 2026.0.0, which fixes GHSA-q939-rpr3-3284 (HIGH): ScpClient's recursive download let server-controlled filenames escape the destination directory. RemoteFlow has never referenced ScpClient — SFTP is the only file transfer path — so the vulnerability was not reachable here. It is still worth updating for.

Two test suites that had been lying. Six tests asserted Windows path semantics through the host's path APIs and failed on Linux and macOS. Separately, 63 of 270 Windows UI tests were failing as a single race rather than 63 bugs: Avalonia's RoutedEvent.Register writes into a plain Dictionary, so two threads running a type initialiser at once corrupt it. Nothing in the application changed for either.

Nothing about how RemoteFlow behaves on Windows is different in this release.

Downloads

Linux

File	What it is
remoteflow_0.2.6_amd64.deb	Debian/Ubuntu package for Intel and AMD machines.
remoteflow_0.2.6_arm64.deb	Debian/Ubuntu package for ARM machines.
RemoteFlow-0.2.6-linux-x64.tar.gz	Portable build, any distribution.
RemoteFlow-0.2.6-linux-arm64.tar.gz	Portable build for ARM machines.

sudo apt install ./remoteflow_0.2.6_amd64.deb

Use apt rather than dpkg -i so dependencies are resolved rather than merely reported. On other distributions, unpack the tarball and see docs/building.md for the desktop entry.

The Linux artefacts are built on a maintainer's machine, not by CI, so they carry none of the guarantees the Windows jobs provide. The amd64 package was installed and launched before release; arm64 was compiled but never run.

Windows

File	What it is
RemoteFlow-0.2.6-win-x64.zip	Portable build for Intel and AMD machines.
RemoteFlow-0.2.6-win-arm64.zip	Portable build for ARM machines.
RemoteFlow-0.2.6-win-x64-setup.exe	Per-user installer for x64.
RemoteFlow-0.2.6-win-arm64-setup.exe	Per-user installer for ARM64.

The zips are self-contained: they run on a clean Windows with no .NET runtime installed. The installers are per-user, need no elevation, and leave your connections and settings in place when you uninstall unless you ask for them to be removed. Each was built and launched on a runner of its own architecture.

Verifying your download

checksums.txt lists the SHA-256 of all eight files.

sha256sum --check --ignore-missing checksums.txt

On Windows without sha256sum:

Get-FileHash .\RemoteFlow-0.2.6-win-x64.zip -Algorithm SHA256

These builds are not code-signed, and the .deb carries no GPG signature. Windows SmartScreen will warn that the publisher is unknown. That is expected and is not a sign of a corrupted download; the checksum is how you tell the difference. A checksum proves the file arrived intact, not who built it.

---

Full changelog: v0.2.5...v0.2.6