| Age | Commit message (Collapse) | Author | Files | Lines |
|
The fork gets its own application ID and name, so it installs next to
upstream's app.passwordstore instead of replacing it, and could be
submitted to F-Droid. Debug builds keep the .debug suffix and are
labelled "HardenedPass Debug". The Kotlin package stays
app.passwordstore: renaming it would be churn with no visible effect.
"GrapheneOS" is kept out of the name because it is that project's
trademark; "Hardened" nods to its vocabulary. README and AGENTS.md
describe the fork's GrapheneOS goal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479,
GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all
fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root
resolution rule keeps every Bouncy Castle module on the catalog version;
before, bcpg 1.77 shipped next to bcprov 1.78.1.
The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by
default, which the old one rejected as "non-standard AEAD". Drop the
NonStandardAEAD error, its bottom sheet and strings, and replace the
mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message
encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message
that the tests now decrypt. The new fixture is a throwaway test key, so
it is allowlisted in .gitleaksignore by fingerprint.
Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so
accepted every key that parsed, including keys with no encryption
subkey. A signing-only key fixture now covers the rejection path.
Also: migrate the removed SelectUserId.firstMatch and deprecated
addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle
META-INF/LICENSE.md in the APK, and move the existing InvalidPackage
lint baseline entries to the bcpkix 1.86 jar.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
* directory structure setting moved to general settings
* Update app/src/main/java/app/passwordstore/util/settings/PreferenceKeys.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: Alexander Grahn <agrahn@users.noreply.github.com>
---------
Signed-off-by: Alexander Grahn <agrahn@users.noreply.github.com>
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
|
|
* add user ID input field (password creation/edit), may fix #1458
* fix: revert change to username label
* refactor: rework FieldItem to drop hard-coded strings
* refactor: drop unnecessary `.apply`
---------
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
* more robust switch actions in pgp settings
* Update app/src/main/java/app/passwordstore/ui/settings/PGPSettings.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
* Update app/src/main/java/app/passwordstore/ui/settings/PGPSettings.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
* Update app/src/main/java/app/passwordstore/ui/settings/PGPSettings.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
* formatting fixed (ktfmtFormat)
---------
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
Fixes #2802
|
|
attack vector (#3136)
prevent app crash upon passphrase cache clearing
|
|
* add checkbox in passphrase dialog to clear cache
* instantiating PasswordDialog via newInstance, passing args as Bundle
* refactor: put checkbox directly in the layout
---------
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
* enabling pgp passphrase cache with authentication
* clear passphrase cache on first autofill decrypt after screen off
---------
Co-authored-by: Alexander Grahn <me@null.org>
|
|
Fixes #3053
|
|
Fixes #2974
Fixes #2963
Fixes #2921
Fixes #2924
Fixes #2653
Fixes #2461
Fixes #2586
Fixes #2179
|
|
|
|
|
|
Fixes #2783
|
|
|
|
|
|
|
|
Currently has horrible UX and is behind an experimental feature flag
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
`remoteBranch` input
|
|
Fixes #2257
|
|
|
|
|
|
* Compile against SDK 33
* autofill-parser: fix warnings for SDK 33 upgrade
* app: fix warnings for SDK 33 upgrade
* Mark all clipboard content as sensitive from crypto activities
* Skip Snackbar on Android 13 and above
* detekt: raise `TooManyFunctions` limit to 15
|
|
* Fix decrypt activity items being editable
* Remove unused resources and re-roll lint baseline
* Make lint mark all warnings as errors
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* autofill-parser: add missing `@RequiresApi` annotations
* app: remove unused strings and sync with Crowdin
* app: remove unused chip_text_color selector
* app: remove unused capitalization_type_values array
* app: add `PendingIntent.FLAG_IMMUTABLE` flag where required
|
|
|
|
|
|
* feat(aps): allow importing TOTP code from an image containing a QR code
Signed-off-by: Aditya <adityawasan55@gmail.com>
* Reorder OTP import options and implement it for V2
* Replace try-catch with runCatching
* Use the correct TextWatcher extension at the right place
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
|
|
* themes: tweak Chip text appearance
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
* app: tweak git server settings UI
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
* app: remove unused resources
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
* CHANGELOG: update for pinning support
* PasswordFragment: support pinning
* PasswordStore: use `PasswordItem#createAuthEnabledIntent`
* PasswordItem: add `createAuthEnabledIntent` API
* DecryptActivity: remove last changed time
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
|
|
* Inform users that GPG key selection is mandatory
Fixes #1342
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
* changelog: sync for 1.13.4 release
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
* changelog: add GPG key selection improvements
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
|