| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
The version and certificate are no secrets, so they are copied without the
sensitive flag that hid them in the clipboard preview. Rows that leave for the
browser now show an icon saying so.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Version with build number, documentation and project links, Ko-fi, the privacy
statement, the certificate this copy was really signed with, and the licenses.
Debug builds also show the git commit, since a test build can share its version
with a release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
|
Activities extend FragmentActivity, window themes derive from the platform's
Material theme and night mode uses UiModeManager. APSTheme colors the system
bars, which DynamicColors did through the window theme. AppCompat stays in the
APK through zxing.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
|
The project targets GrapheneOS, which only runs current Android. Android 12
gives the platform night mode API and removes the fingerprint dialog path that
needs AppCompat. Devices below it stay on 0.2.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The detached HEAD error sent users to "Settings > Git utils", a screen
the Compose settings no longer have. Every locale now names Settings >
Repository > Local Git config & utilities, and the English quotes are
escaped so they show. The git configuration screen's title reuses that
translated row label instead of an untranslatable English string.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Nothing uses preference, recyclerview, recyclerview-selection,
fastscroll or modernandroidpreferences since the Compose screens
replaced the Views, nor view binding. fragment-ktx stays as the pin
that keeps androidx.fragment at 1.8.4. The preference widget override,
the multiselect attribute, the toolbar and bottom sheet styles and the
lint ignores for deleted layouts go. Lint checks unused ids again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The picker decides which entry fills the requesting app, so it drops
touches under another app's overlay, as the publisher warning does.
The entry view now uses cachesPassphrase too, so the cache rule lives in
one place, and the publisher warning's app name gets its closing quote.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
AutofillDecryptActivity shows the no keys dialog and the entry view's
passphrase dialog in Compose over its transparent FLAG_SECURE window.
The flow starts once, on the first window focus, instead of on every
onStart: Android 14 evicts a screen lock prompt shown before the
activity is on top, and a restart showed a second passphrase dialog.
After a key import it restarts on the next focus. Dismissing the no
keys dialog now finishes instead of leaving an invisible window.
Rotation and resizing no longer recreate the activity; other
recreations cancel the fill.
The passphrase is now cached only after a successful screen lock
prompt, as the entry view does: a passphrase typed after a cancelled
or unavailable prompt was cached whenever the cache feature was on.
PasswordDialog, its layout, dimens.xml and requireKeysExist lose their
last user and go.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
AutofillPublisherChangedActivity draws the warning with the shared
theme. Keep Autofill disabled is now the primary button, and the
Possible phishing attempt title replaces the logo. Re-enabling still
takes two taps (Advanced information first) and still clears the
app's matches before returning the prepared fill response; every other
way out fills nothing. Touches that reach the warning through another
app's window are now dropped (filterTouchesWhenObscured on the decor
view), so an overlay cannot trick the user into re-enabling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
AutofillFilterView draws the picker with the shared theme: origin
header, search field, entry rows in a grouped surface and the three
switches, over the same SearchableRepositoryViewModel search. Rows
name the origin identifier and show the account and folders below it.
The first tap wins, so a double tap no longer starts two decryptions.
PasswordViewHolder, the RecyclerView adapter, the two layouts, their
drawables, the multiselect color and their lint baseline entries go.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Compose settings, git config, commit log and proxy screens replace
SettingsActivity with its six preference providers, GitConfigActivity
with TextInputDialog, GitLogActivity with its adapter and GitLogModel,
and ProxySelectorActivity, with their layouts and manifest entries.
The dead OpenKeystore key ID row goes with its string, the Android 14
platform bug summary and normal_margin lose their last users, and the
setup intent loses the two starts only Settings used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Author name and email, HEAD status, commit log, abort rebase, hard
reset and gc. The hard reset now warns and prefills the current branch;
a finished reset or gc stays on the screen with a snackbar, and a
failed operation keeps the screen too. The commit log is read off the
main thread. BreakOutOfDetached's not-rebasing dialog no longer
finishes the calling activity.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Host, port, user name and password. An invalid host or port blocks the
save, an emptied port is cleared, the proxy applies at once, and the
screen is FLAG_SECURE while the saved password is on it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The categories and one screen per category, with the old rows over the
same keys. Screen lock gated switches store their value only after a
successful prompt. Clearing a saved HTTPS password or SSH passphrase,
which never removed anything, now asks and removes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Compose list shows folders and entries in separate groups, so the
files first and type independent sort orders did nothing visible. They
are removed; a stored one migrates to folders first, and any unknown
value reads as folders first instead of throwing. The OpenKeychain SSH
key ID, which nothing reads any more, is removed once.
GitSettings wrote the proxy user name to the proxy preferences but read
it from the main settings, so ProxyUtils never authenticated.
Adds the pure parts of the settings port: proxy port parsing, HEAD
status and the commit log.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Compose welcome, git server, SSH key, key generation and PGP keys
screens replace OnboardingActivity with its fragments,
GitServerConfigActivity with BasicBottomSheet, SshKeyImportActivity,
SshKeyGenActivity, ShowSshKeyFragment, PGPKeyImportActivity and
PGPKeyListActivity with KeyList and PGPKeyListViewModel, their layouts
and manifest entries, and ui:compose's APSAppBar. Resources only they
used are removed too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
One screen for managing keys, choosing the key of a new local store
and importing the key a store needs. Rows show user ID and key ID;
the import keeps the old success, replace and failure dialogs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The SSH key screen shows the key's state and, for a generated key, the
public key with copy and share, and imports a key file after the old
replace confirmation. The generation screen ports the old one; the
key is generated in the ViewModel after the screen lock prompt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The welcome screen merges the old welcome and repository type screens.
The git server screen serves clone and edit: the old URL checks as
dialogs, authentication mode buttons, the SSH key's state with Manage,
the host key reset, and a clone that keeps the screen on failure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
- PGP key import reads at most 1 MiB (bounded read, buffer zeroed) and
refuses larger files with a new message.
- SshKeyViewModel catches any Exception from import and generation
(CancellationException rethrown) instead of a short list, so an
unexpected provider or sshj error no longer crashes the app.
- Pending PGP key bytes are zeroed in a finally block, also on
cancellation during addKey after a replace, and an earlier pending
pick is zeroed before a new one takes its place.
- PGPKeyManager never replaces a stored secret key with a public-only
key of the same ID, with or without replace (KeyDowngradeException);
the setup ViewModel shows a localized message for it. Unit test added.
- storeRecipients strips '#' comments and a trailing '!' as pass reads
.gpg-id; tests added.
- GitServerViewModel.clearStore returns the failure when the store
folder cannot be emptied, so the clone does not start; the plan's
Task 3 call site reports it.
- readGpgId opens the file with NOFOLLOW_LINKS and reads at most
64 KiB + 1 bytes, refusing more.
- SshKey.import writes the new private key to a temp file and moves it
over atomically before dropping the old key's Keystore entry, public
key and passphrase, so an I/O error keeps the old key.
- KeyUtils.isSecretKey notes (ponytail) that GnuPG stub and smartcard
keyrings count as secret.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Git server (URL, mode, clone state, the after-clone key check), SSH
key (import and generation off the main thread, outcome kept across
recreation) and PGP keys (rows with key IDs, import with the replace
question, delete by key ID, creation of a local store).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Compose editor, generator sheet, OTP dialog and folder picker
replace PasswordCreationActivity, the generator and manual OTP dialog
fragments, SelectFolderActivity with its fragment and adapter, their
layouts and menus, and upstream's unused EditPasswordScreen with the
PasswordField it used. flowbinding and swiperefreshlayout had no other
users. BasePGPActivity keeps what autofill decryption still needs.
Also drops two stale SshKey baseline entries, the snackbar FAB anchor
whose view is gone, and resources only the deleted files used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Stateless editor: name, folder breadcrumbs with Change, password with
reveal and generator, username, extra content and the OTP actions. The
generator sheet has random and diceware tabs with the old options; the
manual OTP dialog and the sheet are FLAG_SECURE.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
- Run the save's write, original delete, autofill and history updates
under NonCancellable so a recreated activity cannot leave a half
done rename.
- fsync the temporary file before the atomic move.
- Move dialog: refuse targets outside the store (symlinks) and moving
a folder into itself or a descendant, with a toast.
- Folder picker: do not navigate into a new folder whose mkdirs failed;
show a toast (new string, en and it).
- Normalize entryFile so "./" and "a/../b" give the same keys as the
list; covered in EditorModelTest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
A dialog with breadcrumbs, subfolder rows and New folder replaces the
legacy folder picker activity for the list's move action; the editor will
share it. New folder reuses the list's name dialog and checks. A second
tap on Select no longer moves twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Header with avatar, name and folder; password, username and one-time
code with a countdown bar in the first group; extra fields in the second.
FieldRow can start revealed (the "Show the password" setting) and shows
masked values in JetBrains Mono, as the old screen did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Compose list replaces it. The autofill inline suggestion's
attribution intent now opens LaunchActivity, behind the biometric gate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Folders are back stack entries (ListRoute(path)), so back goes up one
level. MainActivity extends BaseGitActivity for pull to sync and the
commits after move, rename and delete.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The autofill setup dialog, the publisher-changed warning and the
biometric setting still told users to look for "Password Store", which
is not what the app is called in the autofill service list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Italian strings were largely machine-translated: "commit" became
"conferma" (confirm), pull and push became "trascina" and "spingi" or
"premi" (drag, push a button), rebase became "ricollocare", the store
became "negozio" (a shop), "pretend" became "pretendere" (a false
friend), and one string showed "/0" instead of "/". Autofill had five
different spellings.
Rewrite those, keep Git terms in English (remote, branch, push, pull,
rebase, merge, commit, detached HEAD, fast-forward), use "compilazione
automatica" as Android's Italian settings do, make "repository"
masculine throughout, replace the "Sei pregato di" calque with plain
imperatives, name the app HardenedPass, and translate the 52 strings
that fell back to English.
Also drop the "TODO: Add a recovery method" that the merge-failure
message showed users, in English and every locale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Filling OTPs from SMS used Play Services' SMS User Consent API, removed
with the nonFree flavor; since then AutofillSmsActivity was a stub that
never offered the dataset. Delete it, its manifest entry, the dataset
builders in both response builders, its drawable and string.
AutofillAction.FillOtpFromSms stays in autofill-parser: it is public,
metalava-checked API and harmless for a client that never fills it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
CryptoRepository.encrypt looked up every .gpg-id recipient and dropped
the ones it could not find, so an entry saved on a device that lacked
one recipient's key was encrypted to the others only. With a store
shared between a phone key and a smartcard key, entries created on the
phone could no longer be decrypted with the smartcard alone.
Fail with the lookup error instead (KeyNotFoundException names the
key), so the user imports the missing public key and saves again.
PasswordCreationActivity also ignored the Result of encrypt and wrote
the output buffer regardless: on any encryption failure it wrote an
empty .gpg file, overwriting the entry when editing, and committed it.
Show the error and leave the file untouched.
CryptoRepositoryTest covers both the missing-recipient failure and the
all-present success path, with keys generated by PGPainless (added as
an app test dependency).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The fork gets its own application ID and name, so it installs next to
upstream's app.passwordstore instead of replacing it, and could be
submitted to F-Droid. Debug builds keep the .debug suffix and are
labelled "HardenedPass Debug". The Kotlin package stays
app.passwordstore: renaming it would be churn with no visible effect.
"GrapheneOS" is kept out of the name because it is that project's
trademark; "Hardened" nods to its vocabulary. README and AGENTS.md
describe the fork's GrapheneOS goal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479,
GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all
fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root
resolution rule keeps every Bouncy Castle module on the catalog version;
before, bcpg 1.77 shipped next to bcprov 1.78.1.
The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by
default, which the old one rejected as "non-standard AEAD". Drop the
NonStandardAEAD error, its bottom sheet and strings, and replace the
mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message
encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message
that the tests now decrypt. The new fixture is a throwaway test key, so
it is allowlisted in .gitleaksignore by fingerprint.
Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so
accepted every key that parsed, including keys with no encryption
subkey. A signing-only key fixture now covers the rejection path.
Also: migrate the removed SelectUserId.firstMatch and deprecated
addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle
META-INF/LICENSE.md in the APK, and move the existing InvalidPackage
lint baseline entries to the bcpkix 1.86 jar.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
* directory structure setting moved to general settings
* Update app/src/main/java/app/passwordstore/util/settings/PreferenceKeys.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: Alexander Grahn <agrahn@users.noreply.github.com>
---------
Signed-off-by: Alexander Grahn <agrahn@users.noreply.github.com>
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
|
|
* add user ID input field (password creation/edit), may fix #1458
* fix: revert change to username label
* refactor: rework FieldItem to drop hard-coded strings
* refactor: drop unnecessary `.apply`
---------
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
* more robust switch actions in pgp settings
* Update app/src/main/java/app/passwordstore/ui/settings/PGPSettings.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
* Update app/src/main/java/app/passwordstore/ui/settings/PGPSettings.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
* Update app/src/main/java/app/passwordstore/ui/settings/PGPSettings.kt
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
* formatting fixed (ktfmtFormat)
---------
Signed-off-by: agrahn <agrahn@users.noreply.github.com>
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
Fixes #2802
|
|
attack vector (#3136)
prevent app crash upon passphrase cache clearing
|
|
* add checkbox in passphrase dialog to clear cache
* instantiating PasswordDialog via newInstance, passing args as Bundle
* refactor: put checkbox directly in the layout
---------
Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
|
|
* enabling pgp passphrase cache with authentication
* clear passphrase cache on first autofill decrypt after screen off
---------
Co-authored-by: Alexander Grahn <me@null.org>
|
|
Fixes #3053
|
|
Fixes #2974
Fixes #2963
Fixes #2921
Fixes #2924
Fixes #2653
Fixes #2461
Fixes #2586
Fixes #2179
|
|
|
|
|
|
Fixes #2783
|
