keyforge 0.2.0

[0.2.0]

First release. (0.1.0 was prepared but never tagged; its contents are folded in
below.)

Generate

• Random strings over hex, base32, base64url, alnum, letters, digits, or printable
  ASCII, with an optional literal prefix and an option to drop ambiguous glyphs.
• Passwords, optionally required to mix lowercase, uppercase, digits, and symbols.
• Diceware passphrases from the EFF large wordlist, about 12.9 bits per word.
• Structured identifiers: UUIDv4, UUIDv7, ULID, nanoid, and base32 TOTP seeds.
• Keypairs: ed25519 and RSA 2048/3072/4096 in OpenSSH format, and age identities.
• Every generator reports the entropy it produced and a strength rating.

All randomness comes from the OS CSPRNG and is drawn by rejection sampling, never
byte % n. The test suite includes chi-square tests over the generators plus a
control test that deliberately introduces modulo bias to prove the check detects
it.

Store keys from somewhere else

• keys add <name> stores a credential something else issued — an API key from a
  provider's dashboard, a token you were sent, a keypair you were given. The value
  is read from a prompt that echoes nothing, or from stdin with --stdin for
  multi-line values such as a PEM.
• There is deliberately no flag that takes the value. A secret passed as a
  command-line argument lands in your shell history and in the process list, and
  cannot be taken back out of either.
• keyforge cannot measure the strength of something it did not generate, and says
  so: a pasted key reads ~128 bits (estimated upper bound) rather than borrowing
  the vocabulary used for generated output.

Roll any key, keeping its identity

• keys roll <name> replaces a value while the id, name, creation date, tags, and
  notes stay put. A generated key is reproduced from the recipe now stored
  alongside it, so a key created with --prefix sk_live_ comes back with it.
• The outgoing value is retained — exactly one generation — so you can roll before
  you have finished updating everything that used the old value, instead of after.
  keys prev <name> reads it; --forget drops it.
• keys rotate <name> --every 90 flags a key as overdue once it has gone that long
  without changing. Counted from the last roll, not the last edit, so renaming a
  key does not reset its clock. keys ls --due lists what is overdue.
• keys notifier enable registers a daily check that raises a Windows toast when
  something falls due. It runs as you, needs no elevation, and names the keys that
  are due without ever showing one.

Store and find

• Vault sealed with Windows DPAPI under your login, at
  %APPDATA%\keyforge\vault.bin. Relocatable with --vault or KEYFORGE_VAULT.
• Atomic saves with backup rotation: an interruption can cost the newest save,
  never the vault.
• Fuzzy search over names, tags, and kinds. Neither current nor retired secret
  material is ever indexed.
• Secrets held in buffers that zero on drop, with Debug implemented by hand to
  redact them.

Interfaces

• Full-screen interactive interface (keys with no arguments): search, generate,
  store an existing key, roll, read the previous value, set a reminder, reveal,
  copy, delete. Secrets stay masked until revealed and re-mask after 15 seconds;
  copied secrets clear from the clipboard after 30 seconds. Revealing a current
  secret never reveals the retired one.
• CLI subcommands for everything: new, add, roll, prev, rotate, get,
  ls, search, rm, export, import, notifier, where. Output adapts to
  its destination — a labelled block in a terminal, the bare secret in a pipe.

Installing

• A real installer, keyforge-<version>-setup.exe, is what winget install
  fetches. It installs to your user profile, needs no administrator rights, and
  offers to put keys on your PATH.
• Scoop continues to install the portable zip.
• Uninstalling keeps your vault. The uninstaller asks and defaults to No; a
  silent or automated uninstall never asks and never deletes.
• Nothing is code-signed, so Windows SmartScreen will warn on first run. Every
  release ships SHA256SUMS.txt to check against; see the README for why a
  published hash is preferred to a signing key reachable from CI.

Install

winget install ElJoshua08.KeyForge
# or, for a portable install
scoop bucket add joshua https://github.com/ElJoshua08/scoop-bucket
scoop install keyforge

Or download keyforge-0.2.0-setup.exe below and run it. It installs to your user profile,
needs no administrator rights, and can put keys on your PATH.

Open a new terminal afterwards — one that was already running keeps the
PATH it started with.

About the SmartScreen warning

These files are not code-signed, so Windows shows a blue "Windows protected
your PC" box the first time you run the installer. Click More info, then
Run anyway.

That warning means Windows has not seen this file often enough to vouch for it —
not that anything is wrong with it. A signing certificate would mean keeping a
signing key reachable from CI, and for a tool whose job is holding secrets that
is the worse trade: a compromised runner could then sign anything. Instead every
file here is built by a public workflow from a public tagged commit, and you can
check what you downloaded against the hashes below.

Verify

(Get-FileHash .\keyforge-0.2.0-setup.exe -Algorithm SHA256).Hash.ToLower()

e88dcccea832a1ae30b10e1dcd6b94b44ba2f94b004384fd4635e1480c665b8a  keyforge-0.2.0-setup.exe
60a5170bf5044d87af41dc30f17e39ff1f5787355a9d9d3364b4b90d88bfdc47  keyforge-0.2.0-x86_64-pc-windows-msvc.zip
62e70d15fdd94062c0d753b36720a0f280e84af743a560aff308dfeda853d7b1  keys.exe