Skip to content

SSH2FA v1.5.12

Choose a tag to compare

View all tags
@gasvn gasvn released this 04 Aug 14:44
· 19 commits to main since this release
v1.5.12
e2b82c2

简体中文

不再出现莫名其妙的 macOS 密码提示

  • 修复真正根因：开发测试二进制曾意外访问真实登录钥匙串，导致正式 daemon 后续读取凭据时仍可能被 macOS 要求授权。
  • Cargo 测试和开发构建现在默认禁止访问真实 Keychain，避免再次污染用户凭据权限。
  • 升级后会显示一次明确的“迁移已保存的登录”说明；只有用户主动开始迁移才会访问旧凭据。macOS 的确认是旧数据迁移，不是 SSH 登录。
  • 新的 v4 凭据项由稳定签名、固定路径的正式 daemon 创建。迁移成功后，启动、断网重连和应用更新都不应反复要求 Mac 密码。

连接与更新

  • 网络切换、睡眠唤醒和 SSH 短暂失败使用退避重试；同一 2FA 凭据的登录会串行化，避免并发连接重复消耗 TOTP。
  • 已有 ControlMaster 在更新时保持运行；新 daemon 会接管，不强迫用户重新 SSH/2FA。
  • 从 v1.5.12 开始，后续自动更新不再依赖付费 Apple Developer ID。应用会验证项目签发的 Ed25519 清单、版本、build、大小和 SHA-256 后才安装。
  • 更新时先冻结旧 daemon，完成 app 替换后再启动新 daemon，避免移动中的程序触发 Keychain 权限异常。

验证

  • 276 个 macOS 测试通过。
  • 626 个 Rust workspace 测试通过，2 个环境依赖测试按设计跳过，0 失败。
  • Universal Apple Silicon + Intel，build 163。

English

  • Fixes the actual repeated-password-prompt root cause: a Rust test harness had touched the real login Keychain and left a test-binary ACL on saved credentials.
  • Cargo test/development binaries are now blocked from the real Keychain by default.
  • Credential access is gated behind one clearly explained, user-initiated migration into a fresh v4 item owned by the stable packaged daemon.
  • Adds reconnect backoff, per-credential login serialization, safer network recovery, and preservation of live ControlMasters during updates.
  • Starting with v1.5.12, future updates use a project-signed Ed25519 manifest and no longer require a paid Apple Developer membership.

Install / Update

Important bootstrap step: v1.5.11 and earlier do not contain SSH2FA's new Ed25519 update public key. Update to v1.5.12 manually once with Homebrew or the DMG below. After v1.5.12 is installed, future releases can use the secure in-app updater.

brew reinstall --cask ssh2fa \
  && xattr -dr com.apple.quarantine /Applications/SSH2FA.app \
  && open /Applications/SSH2FA.app

New install: brew install --cask gasvn/tap/ssh2fa, then run the same xattr and open commands above.

Universal Apple Silicon + Intel build. Requires macOS 26.

This release uses SSH2FA's stable local signing certificate but is not Apple-notarized. On a first manual install, macOS may require the xattr command above or System Settings → Privacy & Security → Open Anyway.

DMG SHA-256: f5925638d68915dc1d078812bd747027750f50c170092cbf0ea180e949d77d21

Assets 4
Loading