Stable version
Changelog
Stronger trust and archive integrity
Pinned trust anchor, signing-key backup, XMP sidecar preservation, and hardened integrity checks.
Update
Automatic
Content
Release notes
Added
- Trust anchor pinned to the production signing key: non-compliant updates and archives fail closed.
- Backup and export of the archive signing key, kept in the Mac Keychain.
Improved
- Offsite verification and S3 download now stream instead of buffering the whole archive in memory.
- XMP sidecars are merged rather than clobbering non-managed metadata, preserving your existing annotations.
- Reactive session refresh with controlled backoff, and problematic batches routed to a dead-letter queue.
Fixed
- Cross-volume copies are verified before the move source is deleted.
- Fail-closed on checksum or reconcile errors to prevent cascading deletes.
- Fixity “last run” is stamped only after a successful audit.
- Catalog is snapshotted before pending schema migrations run.