SafeKeepVault v1.54

Release Date: October 27, 2026

Build: v1.54 · build 396 · 26c9069 · 2026-10-27

Most PCs now start SafeKeepVault with Secure Boot left on. Earlier changes are in the v1.53 release notes.

🔐 Secure Boot can stay on
The stick's boot loader is now Ubuntu's signed one: a shim signed by Microsoft, then GRUB and the Linux kernel signed by Canonical. A PC with Secure Boot on checks them and starts the stick, so there's no need to change firmware settings first. On Windows PCs with BitLocker, that also avoids the recovery-key prompt that turning Secure Boot off can cause.

Secure Boot checks the boot loader and the kernel, not the rest of the stick. Verify your download with its signature, as always (below).

Some computers still need Secure Boot turned off:

Newer PCs whose firmware trusts only Microsoft's 2023 certificates, and "Secured-core" PCs that ship with Microsoft's third-party certificate switched off. Some offer an option like "Allow Microsoft 3rd Party UEFI CA" instead.
Intel Macs with the T2 chip (2018–2020): Startup Security Utility → No Security, as before. Older Intel Macs have no Secure Boot and start the stick as before.
If a PC refuses the stick ("Secure Boot violation", or no stick in the boot menu), turn Secure Boot off, as before. Details: SECURE_BOOT.md.

💾 Getting it: flash a new stick
The signed boot loader lives on the stick's boot partition, which updating in place never changes. To get it, flash SafeKeep-Release-v1.54.zip onto a stick (back up your vault first, or use a spare stick and restore your seed). A stick you update in place keeps working exactly as now, with Secure Boot off.

🔄 Update in place from v1.47 or later
Copy SafeKeep-Update-v1.54.tar onto your stick's TRANSFER drive.
Boot SafeKeep and unlock your vault.
Open Device Options → Update SafeKeep → Check for update, then Install and Restart now.
Your vault, your vault password and your Transfer Drive are not touched. Before installing, SafeKeep shows the app's SHA-256: it should match the boot.html line of this release's SHA256SUMS. This brings v1.54's version number; the Secure Boot change needs a newly flashed stick (above).

✅ Verifying This Release
The USB image (SafeKeep-Release-v1.54.zip):

Download SafeKeep-Release-v1.54.zip, SHA256SUMS.txt and SHA256SUMS.txt.asc.
Verify the signature: gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt Expect a good signature from Anton anton@safekeepbitcoin.com, key fingerprint A333 EB82 6F70 A79A 736F 0994 8EA7 DD8C EDBA 86C2.
Unzip, then check the image hash: shasum -a 256 -c SHA256SUMS.txt Expected: 5023884cb827769300bf44f681ec5de1d698279b28a8417776a4b1f9220d95ed SafeKeep-Release-v1.54.img
The update file (SafeKeep-Update-v1.54.tar) carries its own signature, which the stick checks before installing.

The app on its own (boot.html; its checksum file is SHA256SUMS, without .txt):

sha256sum -c SHA256SUMS
gh attestation verify boot.html -R Pasalon0404/SafeKeepVault
gpg --verify SHA256SUMS.asc SHA256SUMS
Expected: 8f361adfe2c545461632b1493b4b7a2b3fd61d8d65835e074ece261e1de9e560 boot.html

The boot.html inside the USB image and the update file is byte-for-byte this release's boot.html. See VERIFYING.md for every check.