Gabbro v0.1.0-alpha.24

Alpha release: the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Security

• Passkey signing dependencies updated: crypto-bigint 0.7.10 (RUSTSEC-2026-0387) and ctutils 0.4.6 (RUSTSEC-2026-0385) fix timing leaks in constant-time code; tokio 1.54.1 (RUSTSEC-2026-0386), wnaf 0.14.1 (was yanked).

Changed

• New app logo by Mike Manso (all rights reserved, used with permission; see LOGO_LICENSE): green logo in light and dark themes (black/white in high contrast), green launcher icon on Android and Linux, credit on the About screen. Android 8+: icon on a black background in the launcher's shape.
• Unlock screen no longer repeats the vault name under the logo (the vault chooser shows it).
• Linux passkeys: the virtual security key now uses Gabbro's own USB id (0x1209:0x6ABB) instead of a shared test id another device could also use.
• Android passkeys: browser list refreshed; Helium, Netskope and Norton Neo added.
• Crypto stack diagrams no longer pinned to format v11: labelled v11+ with a note that later bumps (v12) change the body schema, not the key path.

Fixed

• High-contrast setting now also switches the logo to black/white (it followed only the system accessibility flag).

Built with Flutter 3.47.1, Rust 1.99.1, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.23

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Added

• Emergency sheet: docs/EMERGENCY_SHEET.pdf, a printable one-pager to fill in by hand (vault, passphrase, YubiKeys, folders) and keep on paper.
• Remembered folders. Export and Import entries each get a Remember box (ticked by default): the folder of the file you pick is remembered, the next file dialog opens there, and on Linux the export path is pre-filled so Export is one tap. Sync settings lists the export and import folders read-only. Untick to forget.
• One-click sync. Sync settings (vault menu): an auto-merge switch (off by default) and a remembered sync folder with a Remember box. With both set, Sync from vault opens the file named as this vault exports (<alias>.gabbro) in that folder and merges it with no picker, no chooser and no review; a YubiKey-protected file still asks for its tap, and a file your passphrase does not open still asks for one. Linux gains a native folder picker (XDG portal); Android reads the folder through its persisted storage grant.

Fixed

• Help: all 16 cards re-shot at the current UI, terse captions, larger caption text; three new cards (Sync settings, Export, Import) and the sync diagram redrawn for the one-tap flow.
• Export: the two-files note now names the real file (<alias>.gabbro), not vault.gabbro.
• Android edge-to-edge (targetSdk 36): the vault list, its sync snackbar and four other screens no longer run under the navigation bar or a landscape side bar. A new inset net renders every screen with faked system bars on phone and tablet, portrait and landscape.

Changed

• Import screen: one file field and a Source dropdown (Gabbro vault, Generic CSV, Google Password Manager, Dashlane, Enpass, Bitwarden) replace the six stacked sections. Changing the type clears the chosen file.
• The import screen's Gabbro section now says a synced copy of this same vault belongs in Sync from vault, not import.
• Import is additive: every entry in the file is added, duplicates included. The "entries skipped" dialog is gone. A Gabbro import whose entry UUID the vault already holds gets a fresh UUID, so sync by UUID stays intact.
• Labels: the vault menu's "Sync from file" is now "Sync from vault"; the import screen's Gabbro button "Sync from vault" is now "Import" (it imports, it does not sync).
• Export: "Include date in filename" now defaults to off, so a repeat export overwrites the previous file instead of adding a dated copy. Turn it on for dated exports.
• flutter_rust_bridge 2.12.0 -> 2.13.0 (bridge regenerated; no behaviour change).

Built with Flutter 3.47.1, Rust 1.98.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.22

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Added

• Passkey provider. Website passkeys (WebAuthn) can now live in the vault, so they sync and back up with everything else. Android: Gabbro registers as a credential provider. Linux: while Gabbro runs, browsers see it as a security key (a virtual FIDO2 device); create and sign-in are approved in an in-app dialog. New Passkey entry type and a Passkey filter chip on the vault list. Vault format v12; v11 vaults still open.
• APT repository for Debian/Mint: add it once, later releases arrive via apt upgrade / Update Manager.
• The .deb and AUR packages now set up /dev/uhid access (udev rule + module load), so Linux passkeys work after install without manual steps; the README covers the same setup for tarball users.
• Linux: when the passkey provider cannot start (uhid module missing, no /dev/uhid access, or a second Gabbro instance), the vault list now says so and points at the README fix — previously passkeys just silently never appeared in the browser. Dismissible per session or permanently.
• Crack-me challenge refreshed to a new v12 vault; the superseded vault was retired.
• Android: privileged-browser list refreshed from Google's reference list (adds Firefox Beta); now re-checked at every release.
• Android: App passkeys toggle (Settings, off by default) lets native apps sign in with passkeys. Turning it on is the informed opt-in to Gabbro's only network use: one fetch per app login of that site's own app-verification file — see the new README section "Verify no telemetry". Off, or with network denied (GrapheneOS), only app sign-ins refuse; browser passkeys never use the network.

Built with Flutter 3.47.0, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.21

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Added

• File attachments on every entry type. Any entry (not just File entries) can now hold up to 3 attached files of up to 25 MB each — add and remove them on the edit screen, save them back to disk from the entry view. Attachments imported from Enpass, previously invisible, now appear and can be recovered; sync names them by filename in every prompt.

Fixed

• Editing an entry no longer silently deletes its attachments. Attachments (today only Enpass imports carry them) were wiped by any edit, and syncing then deleted them on every other device too. They now survive edits untouched.
• Re-importing a file you have already imported no longer duplicates its entries. Every import source now compares what an entry contains, instead of an id most export formats do not carry. Entries the vault already holds are listed as skipped, and an import that adds nothing says so rather than leaving the screen unchanged.
• Serbian: the import screen named a file extension that does not exist. It read .габбро instead of .gabbro, so anyone following it looked for the wrong file.

Removed

• The "Recently used apps" suggestions under a login's Android app ID (Android). Filling that field now means typing the package name, or letting Android's save prompt create the entry with it already set. The list of apps you had tried to log into is no longer kept, and any existing one is deleted on first launch.

Built with Flutter 3.44.8, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.20

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Changed

• The stored text-scale ceiling now matches what the app can show. Renders always capped at 2x (phone) / 3x (tablet); the settings file could still hold up to 8.0 from an older design. A hand-edited value above 3.0 now loads as 3.0.

Fixed

• Three failure messages could be cut off at the largest text size. When enabling biometric unlock, exporting a file, or restoring a synced-over value failed, the explanation appeared in a bottom strip that cut long text off with no way to read the rest. All three now open a dialog that scrolls, so the full reason — including the file path involved — is always readable.

Built with Flutter 3.44.8, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.19

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Fixed

• A link that would not open said nothing, or said the wrong thing. Opening a URL from an entry gave no message at all when it failed, and at the largest text sizes the message shown elsewhere ran off the bottom of the screen. Both now appear in a dialog that scrolls, and a link that is not a web page says so instead of reporting a failure.
• An entry in the vault list at the autofill prompt did nothing (Android). When Gabbro asked for your passphrase to fill or save a login, the list of vaults also offered "Open a vault file…" — tapping it opened nothing and said nothing. It is no longer offered there, and where you have a single vault the list itself is gone, since it could only reselect the vault you were already unlocking. The app's own unlock screen is unchanged.

Changed

• Links open through Gabbro's own code, not the url_launcher plugin: the desktop's handler on Linux, Android's own on Android. Same system browser as before, never an in-app view, one less third-party dependency. Only http and https links are opened now — a stored file://, ftp:// or ssh:// address is refused, since this button means "open a web page".
• File dialogs now talk to the system directly on both platforms, instead of going through the file_picker plugin: the desktop's file portal on Linux, Android's own picker on Android. Same dialogs, two fewer third-party dependencies in the app.
• The app now finds its own data folder instead of asking the path_provider plugin — the same folder as before on both platforms, so nothing moves. This also removes the jni plugin whose C code newer compilers reject, which had broken fresh Linux builds.
• Finnish and Russian passphrases draw on new wordlists, re-sourced for GPL-3.0 compatibility. Both are still 7,776 words, so entropy is unchanged.
• Portuguese passphrases draw on a new wordlist, also re-sourced for GPL-3.0 compatibility. It is 7,776 words and carries no accents, so a passphrase types on any keyboard. The generator now labels it Português (BR), which is what the Portuguese list has always been.
• Passphrases no longer include non-words — surnames in Slovak and Ukrainian, Internet in French. Slovak drops to 6,642 words; add one word to cover the lost entropy.
• In a sync review, the two options no longer swap places between fields. A changed password put your own value first, the field below it put the other device's value first, so the option under your thumb kept changing meaning. The other device's value is now always listed first and pre-selected, for every kind of change — including entries and fields it deleted. Stepping through a review without changing anything now does exactly what Merge automatically does. Any choice you make yourself is still honoured, and Cancel still abandons the whole sync.
• The sync dialog now says what "Merge automatically" does. It offered the choice without explaining it, so it went unused. It now states that the automatic merge takes the other device's value wherever the two differ, and that reviewing starts from those same answers. The two choices carry the same wording for a screen reader, which on Linux reads only a control's name and never the paragraph.
• The folder choice no longer says "unfoldered". In English only, the option to leave an entry out of a folder read "Keep unfoldered" / "Move to unfoldered". It now reads "Keep without folder" / "Move to no folder" — what every other language already said.
• The About screen did not name everything Gabbro ships. Four Rust libraries were missing from the open-source list, one licence was wrong, and one entry named a Rust package while showing a different project's licence. Mozilla's Public Suffix List and two wordlist sources were uncredited. All are listed now, and a test refuses any direct dependency added without attribution.
• The Android app ships two fewer bundled libraries. Apache Tika and Commons IO came in with the old file-picker and are out of the release build, so the download is smaller and there is less third-party code inside it. No change to how picking a file behaves.

Built with Flutter 3.44.8, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.18

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Fixed

• Dialogs cut their question short, then put their buttons off the screen. A dialog gives its buttons a fixed strip and lets the message shrink into whatever is left. On a phone at double text size the message was quietly truncated; at four times it vanished altogether and both buttons sat below the bottom of the screen, so a confirmation could be neither read nor answered. Every dialog now scrolls as a whole, unchanged at normal text size.
• The vault list showed no entries at all at the largest text sizes. On a narrow phone the search box grew with its placeholder until it had taken the whole screen, and the A-Z bar drew itself into a space too small to hold it. The placeholder now stays on one line and the A-Z bar steps aside when it cannot fit, so the entries keep their room.
• Three messages appeared in English whatever your language. The two file-dialog warnings and the notice that changing your passphrase turned biometric unlock off were never translated, so they arrived in English — at the moment something had just failed or a security setting had changed under you. All three are now translated into every language, and a test refuses any string that ships as English everywhere.
• Serbian (Cyrillic) was almost entirely written in Latin script. Choosing Српски gave you the same Latin text as Српски (latinica) — only 85 of 645 strings were actually Cyrillic. All of them are now, so the two Serbian options finally differ. A test refuses any Cyrillic locale that ships Latin-script prose, so this cannot come back.

Changed

• Starting a vault switch and changing your mind is now one tap. Picking another vault in Manage vaults opens its unlock screen over the vault you already had open; a Cancel button in the top-left goes back to it. That corner offered Quit before, which was never the action you wanted there — Quit stays in the vault menu, on Ctrl+Q, and on the first-run and locked screens.

Security

• A vault unlocked through Android autofill never locked itself again (Android). The auto-lock timeout applied only to the app itself: unlocking at an autofill prompt opened the vault with nothing left running to close it, so it stayed open until Android reclaimed the process — and while it was open, any login field on any app or site was filled without asking. A vault opened by autofill is now locked again as soon as that fill or save finishes. A vault you already had open in the app is untouched, and its own auto-lock still governs it.
• A copied password stayed on the clipboard for good if you left the entry screen. The clear timeout only ever ran while that screen stayed open — pressing back, locking or switching vaults cancelled it silently, so the wipe you configured never happened. It now runs to completion wherever you go. An automatic lock (you walked away) wipes it immediately; a lock you ask for yourself leaves it alone, so you can still paste what you just copied. never still means never.
• The vault registry no longer records which vaults need a YubiKey. vaults.jsonc is plain text, so on a shared computer it showed anyone with file access which vaults were passphrase-only. Nothing in the app ever used the value; the line disappears from the file the next time you unlock a vault.
• A failed auto-type could print one character of a password to the terminal (Linux). When the X server rejected a keystroke, Gabbro printed the whole error, including the value the server objected to — which for that request came from the password. The message now names the failure and the request that failed, never the value.

Built with Flutter 3.44.8, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.17

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Added

• Open an exported vault as a vault — no more create-then-import on a second device. Onboarding and the unlock screen's vault list now offer "Open an existing vault file": pick (or type the path of) a .gabbro export, name it, and it appears as a vault of its own, locked until its usual credentials open it. On Android the file is copied into the app's storage; on Linux it is used where it is. A file that is already registered, not a vault, or too old/new for this build is refused with the reason.

• Sync from file no longer asks for a passphrase when your own opens the file. The passphrase the vault was unlocked with is tried first; typing returns only when it does not open the file. A key-protected file asks only for its PIN and a tap of the incoming vault's YubiKey — a typed passphrase returns on fallback, without a second tap. Because a matching passphrase cannot prove the file is the same vault, the apply-choice dialog now says so.

• Desktop keyboard shortcuts (Linux). Ctrl+L locks the vault, Ctrl+Q locks and quits (asking first, the same confirm as the menu item), Ctrl+F focuses search (Ctrl+Shift+F searches all fields), Ctrl+N starts a new entry, Ctrl+M opens the menu, and Esc dismisses dialogs — including a safe cancel (rollback) of the sync review and import-failures flows. A Keyboard shortcuts item in the vault menu opens an in-app reference screen (desktop-only; localized across all 37 languages). No copy shortcut by design — copying a secret stays a deliberate, auto-clearing action.

• Keyboard navigation (Linux). Tab / Shift+Tab move between a screen's regions — search, folders, filters, entry list, details — and the arrow keys move within the focused one. Enter or Space activates, Esc steps back out. The focused region is outlined, so it is always visible where the keyboard is.

• Screen-reader support (Linux, all 37 languages). Every control now says what it is and what it does — the search box, category chips, folder selector and entry rows, and every icon-only button across the app, all of which a reader previously announced as just "button". Each region is named, and the lock-and-quit confirm reads its question.

• Actions that change nothing visible are now spoken (Linux). Copying a secret says so, in the generator and the entry detail pane, including when the clipboard will clear; ticking an entry says how many are selected; deleting the open entry says what replaced it; and Ctrl+Shift+F, Ctrl+M, Ctrl+Q and the new-entry sheet announce themselves.

Removed

• The navigation rail on wide windows. Its Appearance, Security and About destinations are all in the app-bar menu, which is the single route to them now; its "Vault" destination did nothing. The list pane can be dragged wider than before, since the width the rail reserved is free.

Fixed

• Switching to another vault left the previous vault's entries one keypress away. After unlocking a second vault from Manage vaults, pressing Esc went back to the first vault's entry list, which was still on screen with its contents readable, and left the keyboard shortcuts dead there. The vault you switch away from is now closed and its screen removed the moment the new one opens. Cancelling the switch before unlocking still returns you to the vault you had open, as before.
• A vault file replaced outside the app left fingerprint unlock failing forever (Android). The phone still held the old vault's passphrase, and every attempt blamed "check your passphrase". A rejected fingerprint passphrase now turns biometric unlock off and says the file changed; a wrong YubiKey PIN never does.
• One mis-picked file in a restore could destroy the vault it replaced. Restoring from a backup file now asks before anything is written, naming the vault it will replace, and keeps the old vault beside it as a .pre-restore file — so even a confirmed mistake can be undone.
• After restoring a vault from a file, its safety copy still held the old vault. Restoring from that safety copy afterwards would have brought the previous vault back. The safety copy is now refreshed to match the vault you restored.
• After restoring a vault from a file, fingerprint unlock could stop working with no explanation (Android). The phone still held the passphrase of the vault that was replaced, so the fingerprint handed over the wrong one. Restoring now turns fingerprint unlock off and says so, the same as changing your passphrase does.
• At the largest text size there was no way out of the "How should this sync apply?" dialog. Cancel sat in the dialog's button row, which does not scroll, so it was pushed off the bottom of a phone screen; the dialog also ran over the edge in 32 of the 37 languages. All three choices now scroll with the rest of the dialog.
• Creating a vault could overwrite an existing one. Pointing "Create vault" at a .gabbro file that already exists — what you try when you mean to open your vault on a second device — sealed an empty vault over it. Creating now refuses an occupied path; export, restore and saving are unchanged.
• On a wide window at large text the vault list ran off the bottom of the screen. The search box and filter chips grew to fill the height and the entry list was left with no room; the last entries could not be reached. The search box and chips now scroll within the top part of the pane, so the list always keeps its share.
• The two icons in the search box ignored the text size. The search-mode toggle (by title / all fields) and the clear button stayed at their default size while every other icon on the screen grew.
• The new-entry type picker said each entry type twice to a screen reader.
• The folder selector was a 28dp tap target on a wide window — the 48dp minimum was applied to the narrow layout only.
• On a wide window a deleted entry could stay in the list until the window was refocused.
• The APK fingerprint in the README could not be pasted into AppVerifier — the Package: and SHA-256: labels were rejected; it now shows the two bare lines AppVerifier expects.

Built with Flutter 3.44.8, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.16

Alpha release — the cryptographic implementation rust/src/crypto has not yet undergone external review. It is provided as-is, without warranty, as stated in the GPL-3.0.

Added

• Native Linux packages. Arch via the AUR (yay -S gabbro-bin) and Debian/Mint via a signed .deb (sudo apt install ./gabbro_<version>_amd64.deb) — both install system-wide with a menu entry and a gabbro command, resolve their dependencies, and uninstall cleanly. The .deb carries a detached GPG signature like the tarball.

Changed

• The Linux tarball no longer bundles install.sh. The native packages replace it; the tarball is now extract-and-run (use the AUR or .deb for app-menu / PATH integration).
• Release binaries no longer embed the build machine's file paths — build-path hygiene, no behaviour change.

Built with Flutter 3.44.6, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.

Gabbro v0.1.0-alpha.15

Alpha - for invited testers only. The cryptographic implementation has not undergone external review. Do not store passwords you cannot afford to lose.

Security

• VERSION 11 is now the minimum vault format. The X25519 + ML-KEM hybrid layer removed as non-load-bearing at alpha.14 (ADR-018) is now deleted outright, along with the ml-kem and x25519-dalek crates — 11 fewer dependencies. Quantum resistance is unchanged (Argon2id + AES-256-GCM).

Added

• In-app Quit (Linux). A power-icon button on the locked and first-run screens exits immediately; a Quit item in the vault menu confirms ("Lock and quit Gabbro?"), then locks the vault (wiping keys) and exits. For tiling-WM users with no title-bar close. Localized across all 37 languages; Linux-only (Android has system navigation).
• Linux release ships an installer. install.sh (in the tarball) registers Gabbro with the desktop: a .desktop launcher entry plus a gabbro command on your PATH, so it appears in the app menu (Mint) or runs by name (tiling WMs) instead of being launched from the extract folder. Per-user by default (no root); --system and --uninstall supported. Ships a placeholder icon until the final logo lands.
• Linux auto-type now works from a release download. The gabbro-autotype trigger client ships in the tarball, so binding a keyboard shortcut no longer requires building from source. Setup for auto-type (Linux) and autofill (Android): docs/AUTOTYPE_AND_AUTOFILL.md.

Fixed

• Linux auto-type no longer mistypes logins and passwords (e.g. abc.f typed as abc..), especially under load. Each character is now injected on its own keycode instead of one keycode remapped between every keystroke, which let the target app read a stale key and duplicate the previous character while dropping the next.
• High contrast is now genuinely high-contrast on every screen: the alphabet index bar (absent letters, gap marker, greyed chevrons), the sync-review changed-field rows, and the password breakdown no longer render dimmed or low-contrast text. The alphabet-bar gap marker is also no longer announced by screen readers.
• Recovery history: the Revert, Delete and reveal controls ran off the right edge at larger text in most languages, leaving no way to restore or discard a value sync had replaced. They now wrap onto their own line.
• Sync review: a long password, URL or folder name was cut off in the choice buttons, so you picked between two values you could not read. Value choices are now full-width rows that wrap onto as many lines as needed, at every text size.
• Tablet, largest text: the "select an entry" placeholder in the detail pane ran off the bottom of the pane. It now scrolls.

Changed

• A vault older than VERSION 11 is refused, not damaged. The file is left untouched and the app explains it needs upgrading rather than reporting corruption. To upgrade: install alpha.14, open each vault once, then return. See docs/VAULT_UPGRADE_PATH.md.
• Importing a too-old vault now explains it in your own language with a tappable link to the upgrade steps, instead of showing an untranslated error. Matches the unlock screen.
• A vault written by a newer Gabbro build is now explained in your own language ("update Gabbro") with a tappable link, on both unlock and import, instead of an untranslated error citing a meaningless format number. Fail-closed behaviour unchanged.
• Every error a user can trigger — import, export, folder actions, vault load, sync, entry save, passphrase change, recovery history, onboarding, biometric enrolment, backup restore, YubiKey loading — is now shown in your own language, with the technical detail appended for bug reports, instead of an untranslated English error.

Built with Flutter 3.44.6, Rust 1.94.0, AGP 8.11.1, Kotlin 2.2.20, Java 21.