Skip to content

vlt v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Nov 22:34
· 99 commits to main since this release
v0.2.0
c581965

Added

  • One-time codes. A record with a TOTP secret shows its current code, the seconds until it changes, and Copy Code, like an authenticator app. The secret can be the base32 text a site shows or the whole otpauth://totp/… link from its QR code (6–8 digits, a period of 1–300 s, SHA-1, SHA-256 or SHA-512); HOTP and Steam Guard links are refused. A new or changed TOTP secret that can't be read is refused when saving. The TOTP secret lives in the vault with the password, so whoever unlocks the vault has both factors.
  • Check for updates. Help → Check for Updates… (and Check Now in Settings) asks GitHub for the latest release and, if it is newer than this build, shows its notes with Open Release Page. A Settings option, off by default, checks when vlt starts and, once the vault is unlocked, tells you once about each new release. vlt never downloads or installs anything itself. The README has a new Updating vlt section.

Security

  • Dependabot proposes Go module and GitHub Actions updates weekly (each release at least 7 days old), and CI also runs govulncheck every Monday, so a newly published vulnerability is reported without a push.

Fixed

  • Builds report their version from the nearest vX.Y.Z tag only, so another tag can't make a release build look like a development build.

Changed

  • A GitHub release's notes are now its CHANGELOG.md section (they were GitHub's generated list of changes), and a release tag without a dated changelog section fails CI before anything is packaged or published. The README has a Releasing checklist.
  • The license is now BSD 3-Clause (it was MIT). Like MIT, it disclaims all warranty and liability; it also forbids using the copyright holder's name to endorse derived products. Copies of 0.1.0 remain available under MIT.
  • The module path is github.com/heyjdp/vlt and the app ID io.github.heyjdp.vlt (they were the placeholders github.com/yourorg/vlt and io.yourorg.vlt). Fyne keeps settings per app ID, so on its first start vlt carries the vault location, auto-lock timeout and clipboard TTL over from 0.1.0's settings file. On macOS the app's bundle ID changes too. (Gatekeeper asks once more, Open Anyway, as it does for every new download.)
Assets 6
Loading