v0.4.1

Highlights

• Help: a blank line now separates the key list from the version line in the help modal.
• Docs: CONTRIBUTING's release section lists the release-notes step and the checks to run after a release (checksums, gh attestation verify on each tarball, an end-to-end install.sh run). The README screenshots show v0.4.

No other user-visible changes since v0.4.0.

What's Changed

• docs: release checklist in CONTRIBUTING, recapture screenshots by @gaius-codius in #128

Full Changelog: v0.4.0...v0.4.1

v0.4.0

Highlights

Installer

• Release provenance is checked. Releases from v0.4.0 on carry a signed build provenance attestation. When the GitHub CLI 2.68 or newer is installed, logged in or not, install.sh runs gh attestation verify against the release workflow and the tag. It refuses a download that fails the check, including when GitHub is unreachable or rate limits it. With no gh or an older one, it says the check was skipped and checks only SHA256SUMS.
• v0.1.0 to v0.3.1 are checked against SHA-256 digests kept in the installer itself.
• https only. WICKET_RELEASES_URL and the new WICKET_API_URL must be https://, and a download redirected away from https is refused.
• Only fetchers that check certificates are used: curl, GNU Wget 1.x, Wget2, or busybox 1.33+ through openssl and not behind http_proxy. Any other wget is refused. ~/.curlrc and ~/.wgetrc can no longer turn the check off.
• Only a plain vX.Y.Z is taken as the latest release.
• Ctrl-C, TERM, HUP and QUIT stop the installer at once, and nothing it started is left running.

FreeRDP clients

• An unsuffixed xfreerdp or sdl-freerdp is offered only when its --version reports FreeRDP 3. A FreeRDP 2 xfreerdp is no longer picked for new or imported profiles, or suggested as the fullscreen fallback. The installer's FreeRDP warning uses the same rule.

Shared folders

• Save and connect refuse dangerous shares, in the TUI and in wicket connect, even in a config written by hand. A share that holds your home folder (~, /home, /), or leads through /proc or /dev/fd, is refused, and the error points at share_home.
• Links inside a share are checked too. FreeRDP follows symlinks inside a shared folder, so a share with a link anywhere in it to one of those places is refused, such as a Wine or Proton prefix whose dosdevices/z: is /. So is a share with a folder that can be entered but not listed.
• Wicket reads at most 100,000 files and folders of a share, and refuses a larger one.
• The TUI keeps drawing while shares are read, once per save or connect, and esc stops waiting on a slow or network share.
• share_home is now documented as also sharing wherever links in home lead, / included. Its behaviour is unchanged.

Import

• Clipboard and folder shares come across. A turned-off clipboard, .rdp drivestoredirect and Remmina shares are imported.
• Some shares are never imported: "all drives", Windows drive letters, the home folder or any folder that holds it (/home, /, a mirror of the root), anything under /proc or /dev/fd, and links that lead to any of those. The summary names each folder left out and why.
• More files import. The server port is kept from .rdp files. A file with no user, or a UPN user plus a domain, now imports. Remmina DOMAIN\user beside a separate domain is split. Bare IPv6 hosts are bracketed.
• Every .rdp key containing password is dropped.
• Control characters and bidi controls from a file are shown as ? in the summary.

Keyring

• A locked keyring is reported as locked, not as a missing or unreachable password. If the unlock prompt is dismissed, refused or left unanswered, connect says so. On a terminal it asks for the password for that connection only. The TUI's password dialog says "A password is saved, but the keyring is locked".
• Saving or deleting a password on a locked keyring now unlocks it first (gnome-keyring refused these outright before). A refused unlock leaves the password unsaved, with a message that says why.
• A newer locked password is never silently replaced by an older readable one.
• Connect says the keyring is unavailable instead of offering to save into it.
• Passwords are capped at 511 bytes, the most FreeRDP reads. A longer saved password is reported, not sent cut short.
• A delete that leaves a matching entry behind now fails instead of reporting success.

Other

• The list view's help shows the running version.
• A size written with a capital X (1920X1080) now connects. A side over 65535, which FreeRDP refuses, is refused when you save, connect or import.

Releases

• A tag that is not a plain vX.Y.Z (such as v0.4.0-rc.1) is published as a prerelease. It never becomes the latest release.

What's Changed

• tui: show the running version on the list view's help by @gaius-codius in #44
• docs: track work in GitHub issues and the project board by @gaius-codius in #61
• config: lowercase the size separator and cap dimensions at 65535 by @gaius-codius in #62
• connect: say the keyring is unavailable instead of asking for a save by @gaius-codius in #63
• secret: cap passwords at 511 bytes to match FreeRDP's stdin reader by @gaius-codius in #68
• ci: race-test rdp and cmd, and build with the Go version from go.mod by @gaius-codius in #69
• import: keep the server port, and files with no user or a UPN plus a domain by @gaius-codius in #65
• tui: build one harness per width in the render sweep by @gaius-codius in #71
• cleanup: staticcheck in CI, README wording, one client lookup in connect by @gaius-codius in #72
• deps: bump the go-modules group across 1 directory with 4 updates by @dependabot[bot] in #73
• rdp: offer an unsuffixed FreeRDP client only when it is FreeRDP 3 by @gaius-codius in #77
• import: keep clipboard and drive shares, escape the summary, split Remmina DOMAIN\user by @gaius-codius in #75
• secret: report a refused unlock as a locked keyring, not a missing password by @gaius-codius in #79
• secret: report a refused unlock instead of an older readable match by @gaius-codius in #81
• import: report shares dropped while planning the import by @gaius-codius in #82
• tui: run the render sweep on macOS and probe clients through LookupClient by @gaius-codius in #84
• install: exit on Ctrl-C or TERM instead of carrying on by @gaius-codius in #85
• importer: report the shares a parser refuses by @gaius-codius in #88
• chore: replace Dependabot with Renovate by @gaius-codius in #89
• install: stop at once on a TERM sent to the script alone by @gaius-codius in #90
• ci: adopt the shared go-ci checks, lint baseline and hooks by @gaius-codius in #93
• install: refuse non-https URLs and verify release provenance by @gaius-codius in #95
• install: stop cleanly on HUP and hangs, refuse odd tags, and test install.sh by @gaius-codius in #97
• secret: unlock a locked keyring to save or delete, and classify lock races by @gaius-codius in #110
• install, release: refuse unchecked TLS, prerelease rc tags, bound stop, close test gaps by @gaius-codius in #112
• importer: refuse home and /proc shares by any name; sandbox and fuzz the importer by @gaius-codius in #115
• rdp: stop the version probe's whole group, read a client that exited on its own by @gaius-codius in #118
• install: stop a watcher before killing it, so its sleep goes too by @gaius-codius in #120
• ci: build releases from a cold cache and drop checkout credentials by @gaius-codius in #119
• config: refuse shares that reach home at save and connect, links included by @gaius-codius in #121
• tui: read shares off the update loop, once per save or connect by @gaius-codius in #124
• docs: locked keyring in the README, installer checks in SECURITY.md by @gaius-codius in #126

Full Changelog: v0.3.1...v0.4.0

v0.3.1

What's Changed

• fix: keyring identity by stable profile UUID (#24) by @gaius-codius in #28
• deps: bump the go-modules group across 1 directory with 2 updates by @dependabot[bot] in #27
• secret: macOS Keychain backend for secret.Store by @gaius-codius in #29
• rdp: recognize Homebrew sdl-freerdp and xfreerdp by @gaius-codius in #31

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• Profile settings: clipboard, multi-monitor, share home folder by @gaius-codius in #16
• AUR: add wicket-bin package and release automation by @gaius-codius in #17
• Keep comments and formatting in config.toml when saving from the TUI by @gaius-codius in #18
• fix: keep local dates and times on full config rewrite by @gaius-codius in #20
• ui: mark live scale and client with on/off dots by @gaius-codius in #21
• Add wicket import for Remmina and Microsoft .rdp files by @gaius-codius in #22
• Selectable folder shares (not only whole $HOME) by @gaius-codius in #26

Full Changelog: v0.1.1...v0.3.0

v0.2.0

What's Changed

• Profile settings: clipboard, multi-monitor, share home folder by @gaius-codius in #16
• AUR: add wicket-bin package and release automation by @gaius-codius in #17
• Keep comments and formatting in config.toml when saving from the TUI by @gaius-codius in #18
• fix: keep local dates and times on full config rewrite by @gaius-codius in #20
• ui: mark live scale and client with on/off dots by @gaius-codius in #21
• Add wicket import for Remmina and Microsoft .rdp files by @gaius-codius in #22
• tui: duplicate a profile from the list with y by @gaius-codius in #23

Full Changelog: v0.1.1...v0.2.0

v0.1.1

What's Changed

• docs: put the edit and help screenshots side by side by @gaius-codius in #9
• ci: build and test with the latest stable Go by @gaius-codius in #10
• deps: bump the go-modules group across 1 directory with 6 updates by @dependabot[bot] in #8

New Contributors

• @dependabot[bot] made their first contribution in #8

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• Own theme, clearer screens, and an on-screen session view by @gaius-codius in #2
• Prepare the repo to go public by @gaius-codius in #3
• tui: make the tests pass without FreeRDP installed by @gaius-codius in #4
• Update CONTRIBUTING.md by @gaius-codius in #6
• release: prebuilt binaries and a curl | sh installer; add Dependabot by @gaius-codius in #7
• ci: bump checkout and setup-go off Node 20 by @gaius-codius in #5

New Contributors

• @gaius-codius made their first contribution in #2

Full Changelog: https://github.com/gaius-codius/wicket/commits/v0.1.0