Gospel Getter v2.16.2

Gospel Getter 2.16.2 fixes search on a fresh install, and removes six known dependency advisories from the app. 2.6.0 through 2.16.1 can update themselves to it.

Fixed (#91)

• Search works on a fresh install without a restart. On the first launch, the app builds its search index in the background while you start reading. That build could run into the app's first saves (such as your reading position) and fail with "database is locked", and search then stayed unavailable until you restarted the app.
  • Reading and saving no longer wait on each other, and a save waits its turn for the database instead of failing.
  • If building the index ever fails anyway, it's tried again after 1, 2 and 4 seconds before search says it's unavailable. Meanwhile search says it's still being prepared.
  • The first launch's index build is also faster.

Security (#93)

• The Windows app no longer carries the updater's zip library, which had three known advisories (RUSTSEC-2026-0367 to 0369). Updates are the installers themselves, published as they are, so the updater has nothing to unzip.
• The Linux app no longer carries the D-Bus libraries that came with the link opener, which three advisories mark as unmaintained (RUSTSEC-2026-0370 to 0372). The app now opens its links directly, the same way the opener did. The credits, Release notes and the download page still open in your browser as before.
• The two advisories that remain are upstream, in the GTK3 libraries Tauri uses on Linux, with no fix available in Tauri 2 (RUSTSEC-2024-0429, an unsound function in glib that nothing in the app calls, and RUSTSEC-2024-0370, an unmaintained build-time crate). They're accepted, each with its reason and when to revisit it, in the weekly audit workflow (.github/workflows/audit.yml).

Changelog

What changed in each version is in CHANGELOG.md.

Upgrading

• 2.6.0 through 2.16.1 offer this update themselves. They check when they start, or you can use Check now: in 2.7.0 and later it's in ☰ → About Gospel Getter, and in 2.6.0 it's in Settings → Updates.
  • In 2.13.0 and later, Check now shows the update inside About, with Update now. Otherwise choose Update and restart in the banner.
  • This works on the installs that update themselves: the Windows setup.exe and MSI, the AppImage and the .deb.
• 2.5.0 and older can't update themselves. Install 2.16.2 by hand once, from the Downloads below, over your current version. Updates after that can come from inside the app.
• Your data and settings carry over.
  • The first time 2.16.2 opens your database, it switches it to write-ahead logging, so SQLite keeps -wal and -shm files beside gospel_getter.db. They belong with the database.
  • There's no schema change and no data-format change. The app identifier, data location and storage keys are unchanged.
  • No scripture text, bookmark, highlight or note is changed.
• Backups: Export data… still writes data format 3, with nothing new in it. A 2.16.2 backup imports as a 2.16.1 one does.
• Going back to 2.16.1 after upgrading hasn't been tested.

Checked

• Automated tests, in CI on the tagged commit:
  • Rust tests cover the database settings on every connection, a write waiting for the lock instead of failing, the retries, and a search index build running while the reading position, bookmarks, highlights and notes are saved;
  • the updater's config test pins the installers being published as they are, which the updater now relies on; frontend tests cover the links' commands.
• The updater without its zip support was run on Linux, with the app's exact settings: it installed a signed AppImage byte for byte and refused a tampered one. The plugin's own tests pass without it.
• An upgrade from 2.16.1 to 2.16.2 of a copy of a real database switched it to write-ahead logging, passed SQLite's integrity check, and left every user row unchanged.
• The Distribution Artifacts run checked that the AppImage launches and the .deb installs and uninstalls cleanly.
• The Windows self-update from 2.16.1, a fresh install's search, and the links opening in the browser are being checked by hand in #94.

Downloads

File	Platform
Gospel-Getter_amd64.AppImage	Linux (most distros, no install needed)
Gospel-Getter_amd64.deb	Debian / Ubuntu
Gospel-Getter_x64-setup.exe	Windows (NSIS installer, recommended)
Gospel-Getter_x64_en-US.msi	Windows (MSI)
*.sig	Update signatures, one per installer, used by the app's updater
SHA256SUMS	Checksums of the installers and .sig files. Verify with sha256sum -c SHA256SUMS
latest.json	The update manifest the app reads

All installers and signatures were built by the Distribution Artifacts workflow (run 39208797455) from the tagged commit 1004aa6. They were only renamed for this release; the bytes are unchanged.

Caveats

• The Windows installers are not code-signed. SmartScreen will probably warn about an "unknown publisher". Choose "More info → Run anyway". (The update signatures are a separate thing: they let the app check an update came from this project, but Windows doesn't see them.)
• There is no AUR package yet. packaging/PKGBUILD is still a draft. It hasn't been tested with makepkg and has not been published to the AUR.

Gospel Getter v2.16.1

Gospel Getter 2.16.1 lets you Shift-click a verse the selection card covers, and adds a Content Security Policy to the app's window. 2.6.0 through 2.16.0 can update themselves to it.

Fixed (#82)

• Hold Shift to see and click through the selection card. After you click a verse, its card floats over the verses below, which used to block a Shift-click on them. Now, while you hold Shift, the card fades to a faint outline that clicks go through, so a Shift-click reaches the verse underneath and extends the selection as usual.
  • Letting go of Shift brings the card back at once, as does switching to another window.
  • It works in Verses and Flowing, in compare (either column), and with the card docked at the bottom of a short window.
  • Shift does nothing to the card while you're typing (a note, the search box or the palette), while a dialog, the shortcuts sheet or Copy as… is open, or while focus is in the card itself, so Shift+Tab still moves through its buttons.
  • The card doesn't move or resize. The fade is quick, and instant if your system asks for reduced motion.

Security (#83)

• A Content Security Policy for the app's window. It loads only the app's own scripts, styles, fonts and images. Nothing in the page can reach the network; only the app's backend can, for updates, release notes and links. Anything injected into the page, such as a script or an inline style, is blocked.
• It was checked in a release build of the app, through every surface, with no violations.

Changelog

What changed in each version is in CHANGELOG.md.

Upgrading

• 2.6.0 through 2.16.0 offer this update themselves. They check when they start, or you can use Check now: in 2.7.0 and later it's in ☰ → About Gospel Getter, and in 2.6.0 it's in Settings → Updates.
  • In 2.13.0 and later, Check now shows the update inside About, with Update now. Otherwise choose Update and restart in the banner.
  • This works on the installs that update themselves: the Windows setup.exe and MSI, the AppImage and the .deb.
• 2.5.0 and older can't update themselves. Install 2.16.1 by hand once, from the Downloads below, over your current version. Updates after that can come from inside the app.
• Your data and settings carry over.
  • There are no database changes and no data-format change. The app identifier, data location and storage keys are unchanged.
  • No scripture text, bookmark, highlight or note is changed.
• Backups: Export data… still writes data format 3, with nothing new in it. A 2.16.1 backup imports as a 2.16.0 one does.
• Going back to 2.16.0 after upgrading hasn't been tested.

Checked

• The Windows installer from this release's pull request (#84), built from the same source tree as the tagged commit, was checked by hand on Windows, against the Content Security Policy checklist in #83.
• Automated tests:
  • Rust tests pin the policy's key directives, and a markup test finds nothing inline that the policy would block;
  • frontend tests cover the Shift card: Shift down and up, losing focus, a Shift-click under it, every case where Shift leaves it alone, compare, Flowing and every theme.
• In WebKitGTK, which the Linux app uses: the Shift-click through the card was performed with real mouse and keyboard events, and the release build was swept for policy violations.

Downloads

File	Platform
Gospel-Getter_amd64.AppImage	Linux (most distros, no install needed)
Gospel-Getter_amd64.deb	Debian / Ubuntu
Gospel-Getter_x64-setup.exe	Windows (NSIS installer, recommended)
Gospel-Getter_x64_en-US.msi	Windows (MSI)
*.sig	Update signatures, one per installer, used by the app's updater
SHA256SUMS	Checksums of the installers and .sig files. Verify with sha256sum -c SHA256SUMS
latest.json	The update manifest the app reads

All installers and signatures were built by the Distribution Artifacts workflow (run 39076264360) from the tagged commit 07141e5. They were only renamed for this release; the bytes are unchanged.

Caveats

• The Windows installers are not code-signed. SmartScreen will probably warn about an "unknown publisher". Choose "More info → Run anyway". (The update signatures are a separate thing: they let the app check an update came from this project, but Windows doesn't see them.)
• There is no AUR package yet. packaging/PKGBUILD is still a draft. It hasn't been tested with makepkg and has not been published to the AUR.

Gospel Getter v2.16.0

Gospel Getter 2.16.0 adds a command palette, Copy as… and Copy chapter, a keyboard shortcuts sheet and passage history, with fixes and a security update. 2.6.0 through 2.15.0 can update themselves to it.

The palette and copying (#76)

• The search box runs commands. / or Ctrl+K opens the same box as before. As you type, it lists Go to, Commands and Verses, in that order, and each command shows its key, if it has one.

  • Start with > to list commands only, for example >theme.
  • With the box empty, it suggests a few commands.
  • A reference still goes straight there, and anything else still searches the text.

• Copy as… in the selection card, or Ctrl+Shift+C:

  • text with its reference (what Copy and Ctrl+C copy);
  • with verse numbers;
  • a Markdown quote (the KJV's supplied words in italics);
  • plain text.

  The formats change no words. The KJV's margin notes and the BSB's footnotes are left out, as in Copy.

• Copy chapter… at the end of each chapter copies the whole chapter in any of those formats.

• The status line says what was copied.

Keys and history (#77)

• Keyboard shortcuts: ?, or ☰ → Keyboard shortcuts, lists every key the app answers, in one sheet.
• j and k select the next or previous verse; Shift+j and Shift+k extend the selection.
• [ and ] go to the previous or next book, at its first chapter.
• Passage history: Alt+← and Alt+→ go back and forward through the passages you jumped to: from the picker, Random chapter, search, cross-references, the Library and the welcome.
  • Each place comes back where you left it, with its selection and scroll.
  • Turning chapters (←, →, the chapter-end buttons, [ and ]) isn't recorded.
  • It keeps up to 50 places, until the app closes. The palette has Back and Forward too.
• A chapter chosen in the picker, or Random chapter, opens at its top. Choosing the chapter already on screen keeps your place.

Fixes and security (#78)

• Check now gives up after 20 seconds and says GitHub couldn't be reached, instead of waiting on a connection that never answers.
• The cross-references' credit links (OpenBible.info and CC BY 4.0) open in your browser through the app, as Release notes does. The page never opens a web page itself.
• Fixes:
  • Switching compare on or off while a chapter was loading could leave the wrong layout on screen.
  • Check now while the banner was installing an update no longer hides the download's progress; it says the update is already downloading.
  • Quick changes could show a stale bookmark list or highlight marks.
  • An error with no message now says "Something went wrong." instead of leaving a blank status.
  • Import messages cut long names from a file short.
  • A passage that runs far past its chapter's end is no longer checked verse by verse.
• Security: rustls 0.23.46, for RUSTSEC-2026-0346 to 0349, in the updater's connection to GitHub.

Changelog

What changed in each version is now in CHANGELOG.md. From this release on, GitHub keeps the latest release and the one before it; older versions remain as tags.

Upgrading

• 2.6.0 through 2.15.0 offer this update themselves. They check when they start, or you can use Check now: in 2.7.0 and later it's in ☰ → About Gospel Getter, and in 2.6.0 it's in Settings → Updates.
  • In 2.13.0 and later, Check now shows the update inside About, with Update now. Otherwise choose Update and restart in the banner.
  • This works on the installs that update themselves: the Windows setup.exe and MSI, the AppImage and the .deb.
• 2.5.0 and older can't update themselves. Install 2.16.0 by hand once, from the Downloads below, over your current version. Updates after that can come from inside the app.
• Your data and settings carry over.
  • There are no database changes and no data-format change. The app identifier, data location and existing storage keys are unchanged.
  • Passage history is kept in memory only, and isn't saved.
  • No scripture text, bookmark, highlight or note is changed.
• Backups: Export data… still writes data format 3, with nothing new in it. Backups from 2.8.0 through 2.15.0 import into 2.16.0 as before, and a 2.16.0 backup imports into 2.12.0 and later as a 2.15.0 one does.
• Going back to 2.15.0 after upgrading hasn't been tested.

Not yet verified by hand

Automated tests cover the changes:

• Rust tests of the copy formatter (every format, the KJV's markup, unnumbered verses), the credit-link command's fixed list, the import messages' cut strings, and passage bounds;
• frontend tests, against the real backend, of:
  • the palette: its groups, >, keys, disabled commands, and running commands;
  • Copy as… and Copy chapter…;
  • the shortcuts sheet, j/k, Shift+j/k, [ ] and passage history;
  • the update check's timeout, the credit links, and the race fixes.

Screenshots and the keyboard were checked in WebKitGTK, which the Linux app uses. These haven't been checked by hand in the installed apps yet:

• the 2.15.0 → 2.16.0 self-update (Check now on 2.15.0 should find 2.16.0 and show these notes);
• the palette, Copy as…, the clipboard and the shortcuts in WebView2 on Windows;
• Alt+← / Alt+→ and a mouse's back and forward buttons on Windows;
• screen readers with the palette and the shortcuts sheet.

Downloads

File	Platform
Gospel-Getter_amd64.AppImage	Linux (most distros, no install needed)
Gospel-Getter_amd64.deb	Debian / Ubuntu
Gospel-Getter_x64-setup.exe	Windows (NSIS installer, recommended)
Gospel-Getter_x64_en-US.msi	Windows (MSI)
*.sig	Update signatures, one per installer, used by the app's updater
SHA256SUMS	Checksums of the installers and .sig files. Verify with sha256sum -c SHA256SUMS
latest.json	The update manifest the app reads

All installers and signatures were built by the Distribution Artifacts workflow (run 39062559208) from the tagged commit 92f7bfe. They were only renamed for this release; the bytes are unchanged.

Caveats

• The Windows installers are not code-signed. SmartScreen will probably warn about an "unknown publisher". Choose "More info → Run anyway". (The update signatures are a separate thing: they let the app check an update came from this project, but Windows doesn't see them.)
• There is no AUR package yet. packaging/PKGBUILD is still a draft. It hasn't been tested with makepkg and has not been published to the AUR.