• v1.1.1 116b57e3d2

    v1.1.1 Stable

    kleb released this 2026-07-27 21:40:10 +02:00 | 53 commits to main since this release

    kBackup v1.1.1

    This production-signed release contains the redesigned embedded web interface.
    The exact tagged source is
    116b57e3d2e0e798a36ed0ec10d782a8c6944f9d.

    Changelog

    • Redesigned the dashboard, repositories, jobs, authentication, and setup
      experiences for clearer operational use.
    • Added light and dark themes with a persistent theme control.
    • Added consistent state indicators, page structure, tables, dialogs, and
      responsive navigation.
    • Added the new kBackup favicon and refreshed visual styling throughout the web
      interface.
    • Kept the existing owner-token authentication and TUI-generated one-time setup
      link behavior.
    • Rebuilt and embedded the new web UI in every shipped daemon and package.

    Signing And Trust

    kBackup uses self-managed release trust rather than a commercial public
    code-signing certificate. Authenticate this exact trust-manifest SHA-256 through
    an independent channel before installing the bundled root:

    405fbb57e597845d2d0f85855bd8df9f5cfad82ec3e54fbdb11cc010fa9dd020
    

    Approved production identities:

    • Authenticode signer certificate SHA-256:
      8edce320469b986ac0ee934bd84b06c98612f6f7e0a8ce228c9a9718ae4960fe
    • RFC 3161 timestamp certificate SHA-256:
      2a19aedf8fa8f61e5851562c354e7d27d0029ad3292510aba8051801675bb3d0
    • OpenPGP signing subkey:
      D1ED1F306D446FB0F7A3C0BD2B3AA6B27E33386A
    • Cosign public key SHA-256:
      2cb49a5331a5d0fb14347469bf2f4063969069f462d52e3b6ea75451462e5a3d

    The complete public bundle is attached as
    kbackup-v1.1.1-public-trust.zip. Private signing material is not included.

    Verification

    Start with BUNDLES-SHA256SUMS, then use the platform archive for complete
    SBOM, provenance, checksum, and Sigstore material:

    sha256sum -c BUNDLES-SHA256SUMS
    cosign verify-blob --key v1/cosign/cosign.pub \
      --bundle SHA256SUMS.linux-amd64.sigstore.json \
      SHA256SUMS.linux-amd64
    

    The DEB and RPM carry native OpenPGP package signatures. The Windows CLI,
    daemon, and installer carry SHA-256 Authenticode signatures and critical RFC
    3161 timestamps. Windows reports them as trusted only after the self-managed
    root and publisher certificates are deliberately enrolled.

    Key convenience-download SHA-256 values:

    kbackup-setup-v1.1.1-x64.exe
    0d2dc8738f7f0834368127ab953d53c758d5748d08c049cf9f84ef550e1c77d8
    
    kbackup_1.1.1_amd64.deb
    b2ad4f68eeed90f673806543b55353dfb9a6c9310db8afc62975dedabb1056dd
    
    kbackup-1.1.1-1.x86_64.rpm
    d071f27463f85dd34e37e8ed2391f58fc94eb8ffc68bb821f6895db6952e7231
    

    The exact signed artifacts passed clean disposable-VM acceptance on Windows 11
    Enterprise 25H2/NTFS first, followed by Debian 13/ext4. Acceptance covered
    signature trust, install and service lifecycle, backup and content-verified
    restore, retention, check/scrub/prune, reboot credential reopen, scheduler
    corruption and repair, notification failure and saturation, owner web setup,
    uninstall data retention, and reinstall/reopen.

    The supported platform and repository boundaries remain those documented in
    docs/support.md.

    Downloads