Skip to content

pkvault 0.1.1 (pre-release)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ddyy ddyy released this 17 Jul 22:27
pkvault-v0.1.1
67a9b02

pkvault 0.1.1 — pre-release

First release from the ddyy/pk monorepo (apps/pkvault; full history imported from ddyy/pkvault — pre-move commit SHAs unchanged, old release digests remain valid at the archived repo).

Unlock page digest

Verify the live page before trusting it with key material:

sha256: 4b07e2a8516c40e51f7a02d45f44149c002794112ccb15deca5fc80905873dfe

npm run verify:page -- --expected-sha256 4b07e2a8516c40e51f7a02d45f44149c002794112ccb15deca5fc80905873dfe

Changes

  • Security: the agent no longer releases the identity scalar. The unix socket answers op:"unseal" (file-key unwrap performed inside the agent) and op:"recipient"; op:"identity" is refused. A same-uid process can use the unlocked identity but can no longer silently copy the long-term key.
  • Security: pkvault run strips PKVAULT_IDENTITY / PKVAULT_IDENTITY_FILE from child environments.
  • Fix: export to stdout preserves exact bytes (previously trimEnd()-corrupted trailing whitespace in the final value).
  • npm package now includes web/_headers and wrangler.jsonc (deployment config for the unlock page).
  • CI: GitHub Actions, Node 18 + 22. 218 tests.

Pre-release: not yet audited.

Assets 2
Loading