SessionSifu 3.5.35 — distribution security and recovery preservation

Distribution security, with recovery preservation

This release hardens installation ownership, update authenticity and release-key exposure without changing capture/preview timers, worker budgets, restore pacing or compositor/layout safeguards.

• Ownership-aware user installations distinguish APT-backed, standalone and legacy copies. The manager offers an explicit ownership choice for historical installations rather than guessing. Startup reconciliation prefers newer system packages and retires removed APT-backed user copies safely.
• --remove-user-install --dry-run previews a fixed program-only allowlist. Actual removal moves program files into a private recoverable backup; sessions, Recall, capsules, settings and currentSession/manualRecovery are not deleted or rewritten.
• External Recall capture/list/delete calls require the live manager connection and asynchronous, bounded caller/rate checks. This is defence-in-depth, not complete isolation from malware controlling the same user's code or bus-name ownership. Existing history remains browsable when recording is disabled.
• New GNOME saves redact recognized command credentials after document ownership resolution. Redacted command placeholders are never launched. Ordinary document arguments and LibreOffice ownership/deduplication behaviour remain covered by regressions. Historical recovery bytes are left intact and may still contain old credentials.
• Build/test jobs have no signing/store secrets. Windows signing uses a separate protected service job with no checkout, dependency installation or PFX fallback. Unprovisioned signing withholds Windows/Chocolatey rather than publishing unsigned production assets.
• Release dependencies are hash-locked; Snap uses a runtime-only hash lock and discloses classic confinement. Snap publishing is separated from its build and protected by the release-tag environment.
• Each platform supplies exact file inventories plus explicitly labelled build-environment dependency inventories. GitHub cryptographic build attestations complement, rather than merely rename, JSON provenance.
• CI's Debian artifact is authoritative. Its legacy raw-channel copy is byte-identical; 3.5.35+ uses the signed v2 feed for restricted immutable-release URLs. Portable updates authenticate a signed inventory before trusting checksums, including support for historical checksum filename prefixes.
• Manifest renewal verifies unchanged package bytes and updates timestamps without rebuilding or disabling expiration. The unused bundled uinput-rule template was removed; installed system rules and configured ydotool behaviour were not changed.
• 44 expired legacy payloads were archived after a validity/rollback grace interval. Current feed targets and unchanged Git history remain available. The archive reduces the current source tree, not historical clone size.

Verification

Local package, settings, ownership/adoption, recoverable uninstall/rollback, symlink rejection, document/LibreOffice recovery, privacy, URL/signature/lifetime, manifest renewal/tampering and SBOM tests passed. The actual GJS authorization helper passed on a disposable private D-Bus using synthetic counters, without real capture or desktop restoration. Cross-platform and Snap build preflight passed before tagging.

The command-filter microbenchmark took approximately 10 ms for 10,000 ordinary argument lists; the 100-window synthetic continuity benchmark showed no slowdown in this run. These measurements do not establish native Wayland stability or quantified battery savings. No real restore, logout or monitor change was performed.

Upgrade and remaining boundaries

Use the signed in-app update or the Debian asset below. Save your work and log out/back in once to activate the updated GNOME extension; no live Shell reload or forced logout is performed. Legacy user installations offer Follow system updates or Keep standalone without changing recovery data.

An isolated signing machine/account and encrypted private-key custody require operator provisioning; this release does not claim those physical controls were created by code. Windows service provisioning, store credentials, PPA publication and Apple notarization are separate from a successful Linux release. See the repository's distribution-security and release-security documentation for the exact trust boundaries.

Verified publication record

• Public release: immutable; all 12 checksum entries, 10 provenance artifact entries and four platform inventories verified after download.
• Debian bytes: 3,838,002; SHA-256 e606c3b9a801a554c30e7399e51fde9298708e2801c04c5a43dc59a7f94223ca.
• Cryptographic build attestation verified against repository tpluharik/SessionSifu, workflow .github/workflows/release.yml, tag refs/tags/v3.5.35, source commit 5000f85c6b06dbe9f43cda5dbbda9f58f1eb8e71 and GitHub-hosted runners.
• Legacy, v2 and portable update indexes are Ed25519 signed; expiry 2026-12-04T15:37:21Z. The installed 3.5.34 client accepted the signed legacy bridge in the compatibility check.
• Snap build passed; protected edge upload failed because its Candid credentials are no longer valid. Windows/Chocolatey were withheld because SignPath is not provisioned. No new PPA upload is claimed.
• The existing update key was used. Isolated/encrypted key custody remains pending operator action, not a completed remediation claim.
• Public post-publication checks passed for the legacy client's signed feed/package download, the v2 client's signed release download, and the portable signed inventory against its downloaded public archive. Legacy delivery is pinned to immutable commit eff2dc9e1b58275315b423cc0514c9694d334e69 to avoid a stalling main-branch raw edge; package bytes and digest are unchanged. No local application upgrade or restore was performed.

Detailed verification record · Distribution security boundaries

SessionSifu 3.5.34 — GNOME 51 compatibility

GNOME 51 compatibility and accurate activation status

• Supports Ubuntu 26.10 / GNOME Shell 51 alongside Ubuntu 26.04 / GNOME 50.
• Replaces removed St.BoxLayout.vertical properties with explicit Clutter orientation.
• Reads GNOME's actual extension runtime state instead of treating the enabled preference as proof that it is running.
• Reports incompatible extensions, startup errors and pending-login updates explicitly. The successful-connected status requires a responding, matching-version integration.
• Retains the previous LibreOffice deduplication, persistent manual recovery and conservative window-restoration safety fixes.

Upgrade

Use Check for Updates in SessionSifu, or install the Debian asset below. When upgrading an extension rejected by GNOME 51, save your work, log out, and log back in once. GNOME caches compatibility metadata for the current login; the installer does not force a logout, bypass extension version validation, or run a session restore.

The in-app stable update is separately authenticated by its Ed25519-signed manifest and SHA-256 digest:

• Version: 3.5.34, extension revision 68.
• Signed update manifest and detached signature.
• In-app Debian payload: 3,829,424 bytes, SHA-256 4305f396ed5906db997f0c73cc91e1c12ac48bbbbfa65bcb17ca22f26686ef95.
• Manifest valid until 2026-11-29T19:23:44Z.

The in-app payload was built and signed locally; CI-built release assets may have different hashes. Use each delivery channel's own verification evidence. Saved sessions, Recall data and manual recovery records are not replaced by the user-local upgrade.

Verification and scope

The local release gate passed settings/activation tests, LibreOffice and restore regressions, window/layout safety checks, security/privacy checks, portable tests, documentation checks and Debian package launch verification. GNOME 51 API inspection and mocked regressions are not a claim of full interactive restore validation after login; no live restore was triggered during this release.

All four platform test jobs and all release build jobs passed. The seven public release-asset checksums, five provenance artifact entries, source commit, SPDX version and Debian version were verified after download.

Publication status

• GitHub release and signed Linux in-app stable update: published and verified.
• Snap: package build succeeded, but the edge upload failed because the configured Candid credentials are no longer valid. Store credentials must be renewed before retrying publication.
• Windows/Chocolatey: withheld because a production-signed Windows asset was not available; the Chocolatey upload steps were skipped.
• PPA: not updated by this GitHub release workflow.

SessionSifu 3.5.33 — LibreOffice recovery fixes

GNOME LibreOffice restore fixes

• Associate document candidates with their individual windows rather than replaying shared process argv or every descriptor into each window. Ambiguous/missing documents are preserved for manual review, not replaced by blank-window launches.
• Track capture generations and durable, hashed manual-only/document-requested dispositions. Superseded records cannot be promoted by a later login after newer records are consumed, and incomplete placement is not permission to reopen an already requested document.
• Deduplicate document requests across restore queues and LibreOffice launchers, reuse confirmed live documents, and protect pending startup transactions without opening extra blank suite windows.
• Defer close/class-migration cleanup until restoration finishes, delete only unchanged records that are no longer current, cancel closing-window saves and handle late save completion while preserving shutdown recovery.

Old records remain recoverable

Original bytes are privately archived in ~/.config/sessionsifu/currentSession/manualRecovery/. Archives are excluded from automatic login recovery and are not automatically purged. Restore previous desktop now includes retained records and archives for explicit, non-consuming manual recovery; this broad action can request older documents too, so review the records first. Named-session selection remains available. Malformed or full replay metadata blocks automatic replay without disabling explicit manual recovery.

Verification and signed update

The full Debian release gate passed, including real-module/fake-window regressions for ownership, repeated logins, suite requests, failed opens, layout-only retention, deferred close cleanup, rewritten records and shutdown. A native GIO test confined to a private temporary folder verified exact archive bytes, owner-only permissions, idempotence and refusal to overwrite changed data.

No live restore, LibreOffice document opening, installation or desktop-setting change was performed. These tests do not establish native compositor/driver stability.

The installed 3.5.32 updater accepted the public 3.5.33 manifest signature and verified the public in-app package checksum.

• Signed in-app package SHA-256: f26ff65d43ee161cd4e483bde8e73f1276e429f9166886ac18470c35107a8c42
• In-app package size: 3,827,186 bytes
• Signed manifest expiry: 28 November 2026, 11:34:09 UTC

GitHub Release assets are separate CI builds: all published checksums, artifact provenance, source commit, SBOM version and Debian version were independently verified. Windows/Chocolatey publication was withheld because production Authenticode signing was unavailable. macOS archives are not Developer ID signed/notarized. The Snap build succeeded, but its Store edge upload failed because the existing Candid credentials have expired; no new Snap Store version is claimed.

After installing the GNOME update on Wayland, log out and back in once to load the new extension. Publication itself does not install it or log you out.

SessionSifu 3.5.32 — Layout restore safeguards

Layout restore safeguards

• Recheck cancellation, window lifetime and monitor generation after asynchronous layout waits, so stale requests cannot resume geometry work.
• Require observed unmaximization after the existing minimum 500 ms settle delay; stop the attempt after two seconds and retain unresolved recovery records.
• Invalidate queued and in-flight layout work on monitor changes, and pause fresh geometry/paired tiling for one second after the last change. Application launches remain permitted, with existing conservative pacing and serial native operations.
• Add isolated real-module/fake-window regressions to the Debian release gate and update installation, restore and performance documentation.

These safeguards were validated with isolated tests, not native Wayland crash reproduction. They do not establish immunity to compositor/driver hangs or attribute the reported 8 October session-wide logouts to SessionSifu.

Downloads and signed in-app update

The GNOME in-app stable channel includes the separately built Debian package and an expiring Ed25519-signed manifest, published together in updates/. The installed 3.5.31 updater accepted the public 3.5.32 signature and verified the public package checksum without installation.

• In-app package SHA-256: 67dfd6a6d60b7e438cfb9dead72ef2418f9798a2103d2ba8631572b515ccddb4
• In-app package size: 3,819,782 bytes
• Signed manifest expiry: 22 November 2026, 08:56:39 UTC

GitHub Release assets are separate CI builds: verify them against the attached SHA256SUMS. SPDX SBOM and build provenance accompany the published assets. Windows/Chocolatey publication was withheld because no production Authenticode signature was available. macOS archives are not Developer ID signed/notarized. The Snap build succeeded, but Snap Store edge publication failed because the existing Candid store credentials have expired; no new Snap Store version is claimed.

After updating the GNOME extension on Wayland, log out and back in once to load the new extension. No automatic logout, installation or desktop-setting change was performed during publication.

SessionSifu 3.5.31 — Conservative restore scheduling

SessionSifu 3.5.31 improves GNOME application/window restore scheduling while retaining the existing compositor safety guards.

• Group named-session records by application and register expected windows before processing each group.
• Avoid fresh-launch delays when reusing a running application; actual app/document launches retain at least eight seconds of spacing.
• Wake readiness on application/window/title signals, with polling fallback and unchanged settle delays.
• Share one bounded final retry pass for unmatched layouts; unresolved records remain saved, and successful late layouts retire only unchanged previous-session records.
• Prepare saved records with at most four asynchronous reads and use transient exact-title/class indexes without changing document-matching policy.
• Refresh durable crash checkpoints inside the serialized compositor queue, including late window callbacks.

Isolated virtual-time regressions show five seconds of spacing for six already-running windows instead of forty. This is not a native-desktop benchmark or a guarantee against compositor/driver hangs. Parallel application startup and shorter native-operation delays remain unchanged.

The full signed Debian build and package-launch validation passed. Historical release assets remain unchanged.

Signed GNOME in-app update

The public stable manifest and Ed25519 signature are published together in updates/. The installed 3.5.30 updater verified and accepted 3.5.31 without installing it.

• Package: updates/sessionsifu_3.5.31_all.deb
• Size: 3,818,326 bytes
• SHA-256: 85cd3157db4f6e17093a3dbb7343a7ef5916e2993bb7744f25ebd931e188e398
• Manifest expiry: 2026-11-21T15:40:11Z

CI-built GitHub Release packages and the offline-signed in-app payload are separate builds: verify release assets against the included SHA256SUMS and the in-app payload against its authenticated manifest. A replaced GNOME extension requires logout/login on Wayland to load its new code.

Windows release archives and Chocolatey publication remain subject to the production Authenticode gate; do not infer Snap Store publication from this tag.

Publication status

The tag-triggered cross-platform release workflow passed. Linux portable, macOS arm64/x64, Debian, marketplace metadata, SPDX SBOM and provenance are published; public asset digests match SHA256SUMS, and the downloaded Debian asset checksum was verified.

The Windows archive and Chocolatey publication were withheld because no production Authenticode signature was produced. The Snap build passed and its workflow artifact was uploaded, but Snap Store edge publication failed because the existing Candid store credentials expired. Renew SNAPCRAFT_STORE_AUTH with fresh store credentials before retrying that channel; GitHub downloads and the signed GNOME in-app channel are unaffected.

SessionSifu 3.5.30 — Paired tiling safety

Paired tiling safety

• Reject crossed, invalid or overflowing geometry before native window resizing, including offset and negative monitor origins.
• Serialize paired resizing and raising through the shared compositor queue; coalesce resize bursts and prevent recursive signals.
• Recheck both windows and their current pair, monitor and workspace before execution. Cancel stale work on close, grab completion, shutdown or extension disable/re-enable.
• Add isolated lifecycle and fault-injection regressions to the mandatory package build.

This release also includes the 3.5.28 autostart duplicate-launch correction and 3.5.29 shutdown/LibreOffice recovery fixes.

Update and verification

The GNOME in-app stable update is published with an Ed25519-signed manifest; its public signature, payload digest and compatibility with the installed updater were independently verified. After installing the update, log out and back in to load the new GNOME extension on Wayland.

GitHub tag assets are separately built by CI and have their own SHA256SUMS, SPDX SBOM and provenance. Windows is withheld because a production Authenticode signature was not available. Snap Store availability is not implied by this GitHub release.

Regression tests passed, but this is not a guarantee against native Mutter or graphics-driver hangs. No restore stress test was run on a live production desktop.

Full changelog: v3.5.27...v3.5.30

v3.5.27

Full Changelog: v3.5.26...v3.5.27

v3.5.26

SessionSifu 3.5.26 reduces background battery and electricity use across GNOME,
Windows, macOS, KDE Plasma and other supported Linux desktops.

• Automatic snapshots now default to 10 minutes, use at least 15 minutes on
  battery and skip unchanged desktop state.
• Privacy Recall uses at least 15 minutes on battery and 30 minutes at 20%
  charge or below. At 10% or below, new Recall moments pause.
• Screenshot capture stops at 20% or below and in power-saver mode. OCR is
  deferred on battery and resumes one newest deferred record in a bounded job
  after AC power returns.
• GNOME caches only focus-affected windows, rate-limits cache passes and reuses
  fresh encrypted preview/OCR data before requesting more compositor work.
• Portable builds use coarse timers and avoid capsule polling or UI rebuilding
  while the relevant view is hidden or unchanged.

Manual saves remain available, stored preferences are preserved, and the power
policy does not change retention or upload data. Session and Recall data remain
local; visual Recall is still disabled by default.

Downloads and checksums: https://github.com/tpluharik/SessionSifu/releases/tag/v3.5.26

v3.5.25

Full Changelog: v3.5.24...v3.5.25

v3.5.24

Full Changelog: v3.5.23...v3.5.24