Blog · 12 November 2026

Opensidian 0.9.3 is out

Opensidian 0.9.3 is out: download it here, and verify your download against the signed SHA256SUMS.

This is a bug-fix release on top of 0.9.2. The downloads are the same five packages for Linux x86_64 (two AppImages, Flatpak, RPM, DEB); there are no new formats.

The first attested release

0.9.3 is the first Opensidian release with build-provenance attestation. Every file has a GitHub artifact attestation (SLSA provenance) showing it was built by this repository's release.yml workflow on GitHub-hosted runners, so you can check where a download came from, not only that it matches SHA256SUMS. Releases are now built on GitHub-hosted Ubuntu runners, every third-party action is pinned to a commit SHA, and nothing is signed in CI. SHA256SUMS is still GPG-signed with the same key as 0.9.2. 0.9.2 and earlier releases have no attestations.

Window dragging on Wayland

Dragging the window by the tab bar on Wayland works every time. Before, every other drag did nothing, because the press handed to the compositor was never released inside the app (#71).

Fixed

Editor: selecting text and typing [[, **, * or another pair character wraps the selection instead of replacing it, and [[ over a selection no longer opens the link suggester (#43). A checked sub-task is struck through only on its text, not across the indent (#45). Moving up or down onto a checklist row puts the cursor at the start of the task text and keeps the checkbox rendered, also inside quotes (#46). ==highlight== text uses the theme's text colour, and the dark-theme highlight matches Obsidian (#47). Rich text dropped from a web page keeps its formatting and links as Markdown (#51).
Files, bookmarks and PDFs: drag a note from the file explorer or Bookmarks onto a pane to open it in a new tab, or onto a pane edge to open it in a split (#40). A PDF opens in a PDF view from the file explorer and Bookmarks, PDF bookmarks get their own menu and a label, and removing one never removes a note with the same name (#44).
Canvas and Excalidraw: Excalidraw boards can be bookmarked (#48), a click on the canvas closes the right-click menu (#49), and Excalidraw follows Opensidian's dark/light mode while keeping its own settings (#50).
Window: after maximizing and un-maximizing, the window returns to its normal size and position. Switching vaults from a sandboxed (Landlock) window closes the old window, also when /proc hides other processes.
Plugins: new native dialogs ask before a vault becomes trusted and before a plugin starts a program or opens a local file. Deny is the default (and what Escape does); the only other answer is Allow once, and you are asked again every time. The program you are asked about is the one that runs: a file swapped or replaced by a symlink while the dialog is open is refused, and the child gets a clean PATH (PR #41, PR #42). Plugin error codes with digits, such as E2BIG, are reported correctly.

Verify your download

Download the files into one directory, then check the signature, the checksums and the build provenance:

gpg --keyserver hkps://keys.openpgp.org --recv-keys A6E69ED6BC4779F3281721484CC1AFDE15B64EA3
gpg --export A6E69ED6BC4779F3281721484CC1AFDE15B64EA3 > opensidian.gpg
gpgv --keyring ./opensidian.gpg SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
gh attestation verify opensidian-0.9.3-x86_64.rpm -R jpzk/opensidian \
  --signer-workflow jpzk/opensidian/.github/workflows/release.yml \
  --deny-self-hosted-runners

Installing the RPM on rpm 6

The RPM itself is not GPG-signed (as in 0.9.2), and rpm 6, for example on Fedora 44, rejects unsigned packages by default. Verify the file as above first, then install it with sudo dnf install webkit2gtk4.1 && sudo rpm -Uvh --nosignature ./opensidian-0.9.3-x86_64.rpm. A signed RPM is planned for the next release.

Full changelog: GitHub release v0.9.3.