v1.7.2

Release v1.7.2

Bug fixes from pass.

All release tags are signed, and release packages (tar.gz and zip) are
also signed. Always check signatures prior using this software.

Changes

Bug fixes

• Fix test suite on OS X
• Add compatibility with GnuPG 2.2.19
• Uniformly use the $GPG variable
• Do the correct thing with subkeys when reencrypting

Installing

Verify signature, then run make install as a privileged user:

wget -O passh-v1.7.2.tar.gz https://github.com/HacKanCuBa/passh/archive/v1.7.2.tar.gz
wget https://github.com/HacKanCuBa/passh/releases/download/v1.7.2/passh-v1.7.2.tar.gz.sig
gpg --verify passh-v1.7.2.tar.gz.sig 
tar -xf passh-v1.7.2.tar.gz
cd passh-v1.7.2
sudo make install

If you don't want to sudo make install, you can simply copy src/password-store.sh to /usr/bin/passh. Optionally, check completion helpers in src/completion and man page at man/passh.1.

Hashes

Tar file

Blake2b:  ca6885ce26aa55f22bac3b68a11e17978bf08a33be5d9ade8b2721452da1152dce1c942929fe32e262e8cfd6eaeab0de90c75b3170b3ea8bd20390be1d4275c2
SHA2-512: f8c91440228a102b8f746c494d9adb19bb6359d999af0dc981626631cd309c3d808e3ed9b3dabd0285e3da392eedf983ea7b1523d547f7461761f0a866f8ab22

Zip file

Blake2b:  3d0077e8cb1dd9658f44cb6d7a0bbca6d833427dcf6ff355bde4db1803379323bf64219f22c22fecc579abfb7d6184993ca8b874750102d09d956342d5e0aea2
SHA2-512: 32241fe55dd57201c0a9893724b170119ab6f75c2e43847ee9a9db0050aafc7be9be210096d5363d2699559e73b2b54138d336a74452d511c5d4371668f32c10

v1.7.1

Release v1.7.1

First passh release.

All release tags are signed, and release packages (tar.gz and zip) are
also signed. Always check signatures prior using this software.

Changes

Features

Everything from pass v1.7.0:

• Extensions: pass can now load user-defined extensions from a system
  directory or a user directory. There's already a nice ecosystem of
  extensions being built, even at this early stage. See the pass man
  page for more information.

• Signatures: there is now an option to enforce signatures of the
  .gpg-id file and extensions using an environment variable.

• QRCodes: generate and show have now learned the --qrcode/-q switch.
  Note to package maintainers: this adds a dependency on the popular
  qrencode package.

• Password generation: rather than use pwgen, we now use /dev/urandom
  more directly, which results in more assured password security, as
  well as customizable character sets, via an environment variable.
  See the pass man page for more information on this customization.
  Package maintainers: you may now drop the dependency on pwgen.

• Importers: there now are several more importers.

• Selectable clipping: you can now specify which line you wish to copy
  to the clipboard or display with a qrcode when using -c or -q.

• Git discovery: The PASSWORD_STORE_GIT environment variable has been
  removed, and instead pass will automatically choose the git
  repository closest to the file being modified (but not out of the
  actual password store itself). This should help people who like to
  nest git repos for different organizations.

Plus:

• Extensions: now even internal commands can be overriden, i.e. an
  extension can be named init and will be used instead of passh's
  init command. Help is shown from extensions when passh help
  is issued. Some new helper functions for developers.

• Manual: added KNOWN LIMITATIONS section to explain about potential
  metadata leakage.

Bug fixes

• None

Note To Distros

• Drop the dependency of pwgen.
• Add the dependency of qrencode.
• The Makefile now does the right thing with DESTDIR, so you might want to
  double check that your package recipe does the right thing.
• The semantics for auto-detection of bash completion has changed, with new
  environment variables for such things. See INSTALL for details.

Installing

Verify signature, then run make install as a privileged user:

wget -O passh-1.7.1.tar.gz https://github.com/HacKanCuBa/passh/archive/v1.7.1.tar.gz
wget https://github.com/HacKanCuBa/passh/releases/download/v1.7.1/passh-1.7.1.tar.gz.sig
gpg --verify passh-*.sig 
tar -xf passh-*.tar.gz
cd passh-*
sudo make install

If you don't want to sudo make install, you can simply copy src/password-store.sh to /usr/bin/passh. Optionally, check completion helpers in src/completion and man page at man/passh.1.

Hashes

Tar file

Blake2b:  cb0b392cc41fd79ab2f7750b574aca5dbf3f1f0f09024b45dcd2a43613af8a495c8baa02a4a2474ef79949b9efb43287d5318dec80e96fce313fb3fd27f1e7a8
SHA2-512: fdd30df9bda86e5e2020457bd9720911fc89b63f2cb4bf765c71d6ac6e4e9a930bc999c5ad29b127b7e7c61d7335b27d585d827c6e2646f669320024e37ac9e3

Zip file

Blake2b:  22c56709df4cdfd0bda8b6adf9ad797948acc741316a4d36f9e742e6fa8ad714cd7761c009e3d3d488c67b202e0319e1b43e7b8da19b751142e0ce8b4d54c309
SHA2-512: f8473ddd70bc0f6a9b92e0b1b82636f67a3028e59f8f1b4c0ad1f80663bc7a604c5a735685c68c32975e62b1ac5980b311f1e70e7fe484cef9dbfcf6d7216d30

v1.7.0 (pass)

Release v1.7.0 (pass)

This is the latest pass release, before forking it into passh.

Changes

Features

• Extensions: pass can now load user-defined extensions from a system
  directory or a user directory. There's already a nice ecosystem of
  extensions being built, even at this early stage. See the pass man page for
  more information.

• Signatures: there is now an option to enforce signatures of the .gpg-id file
  and extensions using an environment variable.

• QRCodes: generate and show have now learned the --qrcode/-q switch. Note to
  package maintainers: this adds a dependency on the popular qrencode package.

• Password generation: rather than use pwgen, we now use /dev/urandom more
  directly, which results in more assured password security, as well as
  customizable character sets, via an environment variable. See the pass man
  page for more information on this customization. Package maintainers: you
  may now drop the dependency on pwgen.

• Importers: there now are several more importers. More and more folks are
  moving to pass!

• Selectable clipping: you can now specify which line you wish to copy to the
  clipboard or display with a qrcode when using -c or -q.

• Git discovery: The PASSWORD_STORE_GIT environment variable has been removed,
  and instead pass will automatically choose the git repository closest to the
  file being modified (but not out of the actual password store itself). This
  should help people who like to nest git repos for different organizations.

Bug fixes

Too many to count.

Installing

Debian/Ubuntu

sudo apt install pass

Fedora / RHEL

sudo yum install pass

openSUSE

sudo zypper in password-store

Gentoo

emerge -av pass

Arch

pacman -S pass

Macintosh

The password store is available through the Homebrew package manager:

brew install pass
echo "source /usr/local/etc/bash_completion.d/password-store" >> ~/.bashrc

FreeBSD

portmaster -d sysutils/password-store

From repository

Pass repository: wget -O pass-1.7.0.tar.gz https://git.zx2c4.com/password-store/snapshot/password-store-1.7.tar.gz

This repository: wget -O pass-1.7.0.tar.gz https://github.com/HacKanCuBa/passh/archive/1.7.0.tar.gz

Run make install as a privileged user:

tar -xf pass-*.tar.gz
cd pass-*
sudo make install

If you don't want to sudo make install, you can simply copy src/password-store.sh to /usr/bin/pass. Optionally, check completion helpers in src/completion and man page at man/pass.1.

Note To Distros

• Drop the dependency of pwgen.
• Add the dependency of qrencode.
• The Makefile now does the right thing with DESTDIR, so you might want to
  double check that your package recipe does the right thing.
• The semantics for auto-detection of bash completion has changed, with new
  environment variables for such things. See INSTALL for details.