JA4 Spoofer v1.4.0

Added

• New upstream drift check workflow validates BoringSSL, NSS, and OpenSSL
  patches against their pinned base refs.
• scripts/apply_patches.sh supports a dry-run/check mode so patch drift can
  be detected without mutating the local source tree.
• The app now caches IANA registry CSVs locally, making registry-backed screens
  usable when the network is unavailable after an initial fetch.
• App settings now carry a schema_version, and writes use the new atomic file
  helper to avoid partially-written profile/settings files.

Changed

• Release notes now come directly from the matching CHANGELOG.md section.
• CI covers formatting, analysis, Flutter tests, shell linting, coverage
  generation, and golden-test scaffolding.
• shadcn_ui was bumped to 0.54.0.

Fixed

• Launcher output is fully drained before process exit handling, avoiding lost
  logs in the app console.
• App-shell initialization is serialized, and the capture throttle timer is
  cancelled cleanly during disposal.
• TLS ClientHello parsing now rejects invalid TLS version ordering and
  truncated ClientHello data.
• Bundled script extraction logs chmod failures instead of silently ignoring
  permission problems.
• Profile IDs are sanitized before file writes to prevent invalid or unsafe
  profile paths.

---

Install

APT (recommended):

sudo apt update && sudo apt install ja4-spoofer

Direct download:

sudo dpkg -i ja4-spoofer_*.deb
sudo apt-get install -f   # resolves any missing deps

Verify the artifact:

sha256sum -c SHA256SUMS
gpg --verify ja4-spoofer_*.deb.asc ja4-spoofer_*.deb   # if signed

On first launch the app extracts its scripts, configs and patches to
~/.ja4-spoofer/runtime/<version>/. No repository checkout needed.