PhotoCraft v0.20.2: the first release with signed Linux files

PhotoCraft v0.20.2 came out on 5 November 2026, two days after v0.20.1. Its GitHub release page has no list of changes, only a link comparing it with v0.20.1. That comparison shows five commits. Three are named "Release 0.20.2", and two change the release workflow, the second undoing the first. One of the three sets the version number, and one is empty. The other (f910166) brings in the whole main branch as one commit: together the five touch 460 files and add about 56,800 lines. We compared the trees. Apart from the version number in Cargo.toml and Cargo.lock, v0.20.2 is exactly main as of 4 November 2026, 22:44 UTC, the merge of #11344.

So v0.20.2 already holds 94 of the 219 pull requests that the v0.21.0 release notes list, the ones merged up to #11344. GitHub lists them again under v0.21.0 because they reached the release branch in that one combined commit, not as their own commits. They are described in the v0.21.0 notes. What's new for users is the signed Linux files below. PhotoCraft is still early alpha, so expect rough edges.

Highlights

Signed Linux files. For the first time, the release has a GPG signature for every Linux file and for SHA256SUMS.txt; see below. The change that turned signing on, #11344, only passes the signing key to the release workflow. Before it, the workflow built the Linux packages unsigned.
Code from main as of 4 November. Already in v0.20.2: much of the Crop tool work, several Free Transform fixes, document-independent action recording, the new Batch options and one history step per action played, more mapped Photoshop action events, the Layers panel filters by Color, effect, attribute and smart object status, TIFF Options, the new Lens Flare, the OpenType Numerals submenu, streamed PSD, PSB and EXR import, PSD import limits sized from available RAM, and the option to save a full-size image in .pcraft files.
Not yet in v0.20.2: the Home screen redesign, Bosnian, PDF export with vector text, the toolbar and shortcut changes, the WinTab pen backend, History Options and the new History Brush controls, the Crop Reset button and content-aware crop on the active layer, the removal of the Enable animations preference, and the web build's memory errors. All of these came in v0.21.0.

Signed Linux files

v0.20.2 has 55 release files, up from v0.20.1's 32. The 23 new ones are:

an .asc signature for each AppImage, .AppImage.zsync, .deb, .rpm, Flatpak bundle and Linux tarball, and a .sig for each Arch package (.pkg.tar.zst);
SHA256SUMS.txt.asc, a signature for the checksum list, and release-signing-key.asc, the public key;
an .oci-manifest.json and an .oci.sig for each Flatpak architecture. They describe the OCI image of the build that the release run pushes; you don't need them to install anything.

The key is "ArtCraft Linux Release Signing Key", an ed25519 key created on 3 November 2026, with the fingerprint 2B76 741B 414A AD6C D33E 6312 13A0 05C0 B9D7 C3ED. v0.21.0 uses the same key. To check, download release-signing-key.asc, SHA256SUMS.txt and SHA256SUMS.txt.asc from the same release, then:

gpg --import release-signing-key.asc
gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt

Look for "Good signature" and check that the fingerprint gpg prints is the one above, then check your file against SHA256SUMS.txt. The steps for each package are on /download/linux, and /guides/verify-download covers every platform.

Keep in mind:

The key comes from the same release page as the files. Upstream's README and docs don't mention the signatures or publish the fingerprint, so compare it with a copy from somewhere else, such as this page.
The in-app updater doesn't check these signatures. On Linux it checks a download only against its SHA-256. It checks code signatures only on macOS and Windows (what the updater checks).
Only Linux files are signed this way. Windows and macOS files carry their own code signatures. The FreeBSD tarballs and the web zip have no .asc, but a good signature on SHA256SUMS.txt also covers their checksums.
Releases before v0.20.2 aren't signed.

Web build

The v0.20.2 web build doesn't start as packaged either. We downloaded photocraft-web-0.20.2.zip and checked it: 14,035,038 bytes, matching SHA256SUMS.txt. Its app/photocraft-web.js (179,066 bytes) imports ./snippets/eframe-d31a8450ea12dfc1/inline0.js, but the zip has snippets/ only at its top level, as in v0.17.0 to v0.20.1. On a plain static server the browser gets a 404 for that file and the page stays at "Loading PhotoCraft…". The app is one gzipped part, app/photocraft-web-*.part-aa, of 13,928,280 bytes (13.3 MiB), up from v0.20.1's 13,586,502.

Upstream tracks this in #10017, which is still open; on 5 November a maintainer closed the other four reports as duplicates of it. The fix, #10248, isn't merged. The workaround and the details are on /download/web.

This site's online editor skipped v0.20.2: it stayed on v0.16.0 until 9 November 2026 and now runs v0.21.0; see the v0.21.0 notes.

Breaking changes or things to know

More changed than the release page shows. v0.20.2 isn't a packaging-only release: it carries everything merged to main up to 4 November. If something behaves differently after updating from v0.20.1, look it up in the v0.21.0 notes.
The web build doesn't start as packaged; see Web build above.
Update and Restart on Windows MSI installs. The report that it restarts without installing (#10477) is still open. If it happens, download the MSI from /download/windows and run it once.
Windows 7 and 8: PhotoCraft still needs Windows 10 or later.

How to update

v0.21.0 followed on 6 November, so install that one instead; see the v0.21.0 notes and /download. If you stay on v0.20.2, get it only from the official GitHub release and check it as above. If you are coming from v0.19.0 or earlier, also read the v0.20.1 notes.

Release page: PhotoCraft v0.20.2 on GitHub.