Merge branch 'release/1.19.3'

remove dependency-check from release-check workflow
Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>
2026-09-21 15:34:27 +00:00 · 2026-06-29 13:52:10 +02:00 · 2026-06-29 13:50:24 +02:00 · 2026-06-29 13:39:27 +02:00 · 2026-06-25 13:16:17 +02:00 · 2026-06-25 13:11:11 +02:00
7 changed files with 25 additions and 54 deletions
@@ -78,7 +78,7 @@ jobs:
          local-dir: ./upload/
  allowlist-avast:
    name: Anti Virus Allowlisting Avast
-    runs-on: ubuntu-slim
+    runs-on: ubuntu
    needs: download-file
    if: inputs.avast
    steps:
@@ -6,7 +6,7 @@ on:

 jobs:
  notify:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu
    steps:
      - name: Notify about DEB build
        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0
@@ -102,7 +102,7 @@ jobs:
    name: Notify for winget-release
    if: needs.get-asset-urls.outputs.is-windows-release == 'true' && needs.check-release.outputs.release-kind == 'stable'
    needs: [check-release, get-asset-urls]
-    runs-on: ubuntu-slim
+    runs-on: ubuntu
    steps:
      - name: Slack Notification
        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0
@@ -48,19 +48,4 @@ jobs:
          if ! grep -q "<release date=\".*\" version=\"${{ steps.validate-pom-version.outputs.semVerStr }}\">" dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml; then
            echo "Release not set in dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml"
            exit 1
-          fi
-      - name: Cache NVD DB
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ~/.m2/repository/org/owasp/dependency-check-data/
-          key: dependency-check-${{ github.run_id }}
-          restore-keys: |
-            dependency-check
-        env:
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
-      - name: Run org.owasp:dependency-check plugin
-        id: dependency-check
-        continue-on-error: true
-        run: ./mvnw -B verify -Pdependency-check -DskipTests
-        env:
-          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+          fi
@@ -82,7 +82,7 @@ jobs:
        include:
          - arch: x64
            os: windows-latest
-            java-dist: 'zulu' #cannot use temurin, see https://github.com/cryptomator/cryptomator/issues/3824#issuecomment-2829827427
+            java-dist: 'temurin'
            java-version: '26.0.1+8'
            java-package: 'jdk'
    steps:
@@ -229,22 +229,23 @@ jobs:
        uses: ./.github/actions/win-sign-action
        with:
          base-dir: ${{ github.workspace }}\appdir
+          file-extensions: 'exe,dll'
          recursive: true
          append-signature: true
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - name: Sign DLLs with Actalis CodeSigner
-        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
+      - name: Sign Scripts with Azure Trusted Signing
+        if: inputs.sign || github.event_name == 'schedule'
+        uses: ./.github/actions/win-sign-action
        with:
-          base-dir: 'appdir'
-          file-extensions: 'dll,exe,ps1'
-          recursive: true
-          sign-description: 'Cryptomator'
-          sign-url: 'https://cryptomator.org'
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
+          base-dir: ${{ github.workspace }}\appdir\Cryptomator
+          file-extensions: 'ps1'
+          recursive: false
+          append-signature: false  # Powershell scripts cannot be signed in append mode, see #4260
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Replace DLLs inside jars with signed ones
        shell: pwsh
        run: |
@@ -347,7 +348,7 @@ jobs:
          - arch: x64
            os: windows-latest
            executable-suffix: x64
-            java-dist: 'zulu'
+            java-dist: 'temurin'
            java-version: '26.0.1+8'
            java-package: 'jdk'
    steps:
@@ -429,16 +430,6 @@ jobs:
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - name: Sign burn engine with Actalis CodeSigner
-        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
-        with:
-          base-dir: 'tmp'
-          file-extensions: 'exe'
-          sign-description: 'Cryptomator Bundle Installer'
-          sign-url: 'https://cryptomator.org'
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
      - name: Reattach signed burn engine to installer
        if: inputs.sign || github.event_name == 'schedule'
        shell: pwsh
@@ -456,16 +447,6 @@ jobs:
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - name: Sign installer with Actalis CodeSigner
-        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
-        with:
-          base-dir: 'installer'
-          file-extensions: 'exe'
-          sign-description: 'Cryptomator Bundle Installer'
-          sign-url: 'https://cryptomator.org'
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
      - id: sha256sum
        run: |
          read -ra CMD_OUTPUT < <(sha256sum installer/Cryptomator-*.exe)
@@ -8,8 +8,7 @@ The changelog starts with version 1.19.0.
 Changes to prior versions can be found on the [Github release page](https://github.com/cryptomator/cryptomator/releases).


-## [Unreleased](https://github.com/cryptomator/cryptomator/compare/1.19.2...HEAD)
-
+## [1.19.3](https://github.com/cryptomator/cryptomator/releases/1.19.3) - 2026-06-29
 ### Added
 * New error dialog if importing a vault fails ([#4243](https://github.com/cryptomator/cryptomator/pull/4243))

@@ -24,6 +23,9 @@ Changes to prior versions can be found on the [Github release page](https://gith
 * Refactored release pipeline to allow immutable releases ([#4205](https://github.com/cryptomator/cryptomator/pull/4205))
 * Updated to JDK 26.0.1 ([#4244](https://github.com/cryptomator/cryptomator/pull/4244))
 * Updated to JavaFX 25.0.3 ([#4255](https://github.com/cryptomator/cryptomator/pull/4255))
+* Drop signing with Actalis issued certificate ([#4169](https://github.com/cryptomator/cryptomator/pull/4169), [#4262](https://github.com/cryptomator/cryptomator/pull/4262))
+* Fix dagger binding graph issues ([#4147](https://github.com/cryptomator/cryptomator/pull/4147))
+* Added flatpak build to CI ([#4199](https://github.com/cryptomator/cryptomator/pull/4199))
 * Updated dependencies:
  - `org.cryptomator:webdav-nio-adapter` from 3.0.1 to 3.0.2
  - `org.cryptomator:integrations-api` from 1.8.0 to 1.9.0
@@ -84,6 +84,9 @@
 	</content_rating>

 	<releases>
+		<release date="2026-06-29" version="1.19.3">
+			<url type="details">https://github.com/cryptomator/cryptomator/releases/1.19.3</url>
+		</release>
 		<release date="2026-03-20" version="1.19.2">
 			<url type="details">https://github.com/cryptomator/cryptomator/releases/1.19.2</url>
 		</release>
@@ -3,7 +3,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.cryptomator</groupId>
 	<artifactId>cryptomator</artifactId>
-	<version>1.20.0-SNAPSHOT</version>
+	<version>1.19.3</version>
 	<name>Cryptomator Desktop App</name>

 	<organization>
Author	SHA1	Message	Date
Armin Schrenk	fc76f5f83f	Merge branch 'release/1.19.3'	2026-06-29 13:52:10 +02:00
Armin Schrenk	bfc8542551	remove dependency-check from release-check workflow Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-29 13:50:24 +02:00
Armin Schrenk	24a20911f1	finalize 1.19.3 Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-29 13:39:27 +02:00
Armin Schrenk	b681c26d72	Replace some slim runners by regular ones Slim ubuntu runners don't have docker, thus failing executing certain actions. (i.e. https://github.com/rtCamp/action-slack-notify/issues/240) Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 13:16:17 +02:00
Armin Schrenk	34f5c06795	[skip ci] Update changelog Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 13:11:11 +02:00
Armin Schrenk	f4928fd981	prepare 1.19.3 Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 11:23:48 +02:00
Armin SchrenkandGitHub	f748bfd953	replace zulu by temurin (#4263 ) Closes #4242 Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 11:13:18 +02:00
Armin SchrenkandGitHub	cb689946ed	Merge pull request #4262 from cryptomator/feature/4260-fix-unsigned-ps1 Sign Powershell scripts (again)	2026-06-25 10:21:47 +02:00
Armin Schrenk	38bdf6d0e4	cleanup workflow Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 10:14:42 +02:00
Armin Schrenk	409209fd89	[skip ci] update changelog Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 10:09:48 +02:00
Armin Schrenk	1fd44ff651	for scripts, do not append signature Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 01:10:10 +02:00
Armin Schrenk	9bb19b0130	extra sign steps for ps1 Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 00:51:46 +02:00
Armin Schrenk	1b5319f706	check ps1 scripts after signing Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>	2026-06-25 00:31:19 +02:00
Armin Schrenk	33b4aa5ba3	Revert "Revert #4169 and fix ps1 files not signed" This reverts commit `1879c6fa77`.	2026-06-25 00:23:58 +02:00