CipherMoth v3.1.0

CipherMoth is now a standalone desktop password manager for macOS, Windows and Linux. Your secrets stay in the dark; Docker remains available.

Added

• Native desktop installers for Apple Silicon/Intel macOS, Windows x64/ARM64 and Linux x64/ARM64, with bundled Python 3.13 and SQLite. No development tools or backend listener.
• Optional GitHub release checks and user-confirmed Tauri updates, with mandatory signatures binding the release version and native architecture. Downloads can be canceled; verified installs lock the vault and preserve its local data.
• DMGs, NSIS installers, AppImages, Debian packages, updater signatures, latest.json, SHA-256 checksums and source provenance in one release. AppImage supports built-in updates; Debian uses manual package updates.
• Native clipboard clearing, automatic locking, private binary IPC and complete encrypted backups using the existing vault format. Passwords, notes, attachments, TOTP, generator, folders, history and Trash are shared with the Docker edition.

Changed

• Production app identity is com.ciphermoth.desktop, with a separate vault from Alpha and Docker. Existing vaults are never moved automatically.
• Updater credentials are restricted to trusted release jobs. Installer signing for Apple/Microsoft verified-publisher status is not provided; OS warnings and managed-device restrictions may apply.
• Preserve explicitly injected empty session stores, enforcing the desktop single-session policy while retaining the server API.
• Wait for saved settings before checking for updates, so a disabled preference is respected after unlocking.

Download the file for your OS and CPU below. macOS: open the DMG and drag CipherMoth to Applications. Windows: run the installer. Linux: use the AppImage or install the .deb. Create a master password on first launch.

These installers have no Apple notarization or Microsoft verified-publisher certificate. Tauri updater signatures are separate and mandatory. See installation and update instructions.

AppImage supports built-in updates; Debian uses package updates. SHA256SUMS and per-target source/build provenance are attached.

Validation: release CI passed on commit a792ed789ba5de71e670397febcb0d675ba5cf67: all six native production packages, installed GUI suites, and 20 real updater checks per target, plus both architectures of the cosign-verified Docker images. Updates were installed between isolated packaged versions and preserved vault contents, attachments and encrypted backups. Public downloads, all six updater signatures, every SHA-256 checksum and the live v3.1.0 no-update result were independently verified after publication. CI does not simulate internet reputation dialogs or organization-specific security policies.

Known upstream dependency advisory: the GTK3 chain includes glib 0.18.5, affected by RUSTSEC-2024-0429. No calls to the affected string-array iterator were found in the checked application/dependency sources; the repository alert remains tracked.