QtPass 2.0.0-rc3

Third release candidate for QtPass 2.0. Please test it and report problems in #1812 or as new issues. Translations continue on Weblate; strings added since rc2 have best-effort fillers that Weblate's reviewers can refine.

Downloads: Windows installer (.exe), macOS (.dmg), Linux AppImage (x86_64, glibc 2.39+), and source archives, each with a detached signature (.asc) and a SLSA build provenance file (.intoto.jsonl). 2.0 needs Qt 6.8 or newer; the 1.8 line (1.8.4) stays available for Qt 5 and older Qt 6.

Worth testing in particular: "Hide password" with entries that hold a PIN, CVV or API key; clipboard autoclear (it now puts the previous clipboard back); a store inside a larger Git repository or with pass.signcommits set; signed .gpg-id stores with the pass backend; the Windows installer; and, as before, the first-run wizard, profiles, re-encryption and the AppImage on Wayland.

Changes since rc2

• "Hide password" hides the other secrets too. Fields named like a PIN,
  CVV, API key, recovery code or passphrase get the eye button, matched as
  whole words; the word list is in Settings ▸ Display
  (#2054, #2092).
• Autoclear puts the previous clipboard back, as pass -c does
  (#2090). Text copied out of a
  shown entry, a revealed password or the password editor now carries the
  same "secret" hints as the copy buttons and is cleared by autoclear too
  (#2117).
• Git stays inside the store, as with pass: a store inside a larger
  repository (dotfiles in the home folder, say) is no longer committed to and
  pushed with it unless Settings ▸ Git says so; inherited GIT_DIR and
  friends are ignored; new folders and .git are private (umask 077 or
  PASSWORD_STORE_UMASK) (#2057,
  #2086, #2091,
  #2102, #2119).
• Commits are signed when the store asks (pass.signcommits), as pass
  does; a commit that cannot be signed fails and says the entry is saved but
  not committed (#2070,
  #2079).
• Signed .gpg-id with the pass backend gets the native backend's
  checks before pass inserts, moves, copies or re-initialises; a signature
  by a revoked key no longer counts; profiles warn when two stores share a
  signing key (#2014,
  #2059, #2084,
  #2087, #2099,
  #2100).
• A shared store cannot exhaust QtPass: decrypted entries stop at 64 MiB,
  huge entries are shown in bounded parts, .gpg-id, .templates, signatures
  and key files are read as regular files with size limits (a FIFO or
  /dev/zero link used to hang the GUI), and names from the store are shown
  as plain text (#2051,
  #2060, #2061,
  #2075).
• Deleting an entry named with glob characters removes only that entry;
  a new folder named link/../x can no longer land outside the store;
  an entry saved into a new folder is encrypted to the nearest folder's
  recipients, as pass does.
• Init refuses a folder outside the store; changed recipients always reach
  the entries or say why not (#2017,
  #2095, #2096).
• The profile box is locked while gpg, git or pass run, and a switch
  cancels a running content search (#2083).
• Content search uses one regular-expression dialect (PCRE) with both
  backends (#2063).
• Child processes start without a controlling terminal, and blocking runs
  have a deadline (#2016,
  #2107, #2110).
• WSL: the signing key, password length and character set now reach pass
  inside WSL (see the upgrade notes).
• Release assets carry SLSA build provenance
  (#1991). Windows signing
  through the SignPath Foundation is wired up
  (#1977) and waits for its
  production certificate; this rc's installer is not code-signed yet.
• The parsers a shared store feeds are fuzzed continuously, also in
  OSS-Fuzz
  (#1978).
• Translations: Weblate updates, and best-effort fillers for the new strings.

Upgrade notes

• "Hide password" hides more. With it on, fields that name a secret
  (PIN, PIN code, PUK, CVV, CVC, secret, token, key, passphrase, password,
  recovery, answer, seed, mnemonic, as whole words) are behind the eye
  button too.
  For only the password, as in 1.8, switch off Settings › Display › "Also
  hide other secrets"; the words next to it can be changed, and "Default"
  puts the set back.
• Autoclear puts the previous clipboard back. As pass -c does, when
  the clipboard autoclear runs, what was on the clipboard before the copy
  comes back instead of an empty clipboard, unless something else was
  copied meanwhile. That text stays in QtPass's memory until then. Settings
  › Clipboard › "Restore the previous clipboard" switches it off.
• Git stops at the store, as with pass. In native Git mode a store
  without a Git repository of its own no longer uses one in a folder above
  it. A store kept inside a larger repository on purpose needs Settings ▸
  Git ▸ "Use a Git repository in a folder above the store", or pull, commit
  and push fail with Git's error that there is no repository. With the
  pass backend nothing changes: pass has always stopped there.
• New store folders and Git's files are private: umask 077, as with
  pass. A store shared through group permissions on one machine needs
  PASSWORD_STORE_UMASK set (for example 007), as pass itself does.
• WSL with a signing key: pass inside WSL now checks the signature.
  QtPass never handed the signing key to pass running in WSL, so pass
  there did not check .gpg-id.sig. It does now: with a signing key set,
  the store needs a signed .gpg-id, and WSL's own GnuPG needs that key
  imported, or pass refuses to save and re-encrypt. The password length
  and character set did not reach WSL either; they do now.
• Qt 6.8 or newer. Qt 5 support ended with 1.8; qmake refuses older Qt
  with a clear message. Packagers building 1.8.x against Qt 5 need the
  1.8 branch for that.
• Ctrl+Q quits. It used to close the window, which with "hide on close"
  meant hiding to the tray; that is Ctrl+W (File ▸ Close window) now. The
  window close button and Alt+F4 behave as before.
• The menu bar is off by default so the window looks as it did. Alt
  shows it for as long as it is used, so Alt+F and the other mnemonics work;
  Ctrl+M, Settings ▸ Show menu bar or the tray menu keep it on, and the
  choice is remembered. On macOS the bar is the system's and always there.
• Settings moved, stored values did not. Clipboard and panel autoclear
  are one number each (0 is "Never"), the two template checkboxes are one
  choice, and "Show menu bar" / "Show process output" are toggles in the
  Settings menu instead of the settings dialog. Existing configuration files
  are read and written with the same keys.
• Generating a GPG key asks for a passphrase. Leaving the fields empty
  used to produce an unprotected private key silently; now OK waits until a
  passphrase is typed twice or "No passphrase" is ticked on purpose.
• A link inside the store is not part of it. A symbolic link or NTFS
  junction found in the store (a shared repository can carry one) is skipped
  by re-encryption and search and refused by show, edit, add, move, copy and
  re-key, with a message; deleting one removes the link. The configured
  store root itself may still be a link. See SECURITY.md.
• Debug output comes from the qtpass logging category in every build:
  QT_LOGGING_RULES="qtpass.debug=true" turns it on, no debug build needed
  (see the FAQ). The #ifdef QT_DEBUG tracing is gone.
• Linux AppImage: new, attached to every release; needs glibc 2.39 or
  newer (Ubuntu 24.04, Debian 13, Fedora 40). It bundles Qt only and uses the
  system's pass, gpg and git.
• Packagers: the AppStream metainfo installs as
  org.qtpass.QtPass.metainfo.xml (was qtpass.appdata.xml); main/main.pro
  installs the desktop file, metainfo, icons and man page; the RPM spec
  follows; the Flatpak manifest drops rename-appdata-file with the 2.0 tag.
• Still true from 1.8: the macOS .dmg is not signed or notarized (see the
  macOS page, #1542)
  and the Windows installer is not code-signed yet (#1643).

The full list of changes is in CHANGELOG.md.