This is the current version. · Released:
Installer files 2.2.0
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | ZIP → Portable | — | — | github.com | VirusTotal |
| ARM64 | ZIP → Portable | — | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
# ZManager CLI 2.2.0 Release Notes
ZManager CLI 2.2.0 adds restart-safe hosted TZAP authentication and certificate recovery, strengthens archive extraction limits, and expands cross-platform release validation.
## Highlights
### Hosted TZAP identity lifecycle
• Added browser-based hosted login with PKCE, loopback callbacks, and durable handoff recovery.
• Bound sessions and hosted device identities to their authenticated user, environment, and service origins.
• Added restart-safe certificate enrollment and renewal reconciliation, plus journaled recovery for local identity catalog writes.
• Kept signing keys in native secret stores while exposing local certificate and contact workflows through the CLI.
### Archive safety and recovery
• Reject extraction paths that would traverse selected or existing symbolic-link ancestors.
• Bound decoded archive intermediates before trusting metadata, with cancellation support.
• Improved nested Debian package payload handling and added coverage for hostile archive and filesystem edge cases.
• Preserve existing outputs and identity catalogs after disk-full or interrupted writes; retry safely after recovery.
### Cross-platform builds and supply-chain checks
• Pin and validate the forensic reader forks used by builds instead of updating unrelated sibling checkouts.
• Add scheduled RustSec and offline identity/package audit workflows.
• Validate macOS archive behavior against native Apple tools and build/test Windows ARM64 with the same Rust toolchain as macOS.
• Keep offline and hosted CLI profiles available as separate release packages.
## Upgrading
This release adds hosted identity and recovery flows without changing the existing archive command interface. Existing offline workflows remain available in the offline package.
