v0.1.4

This is the second release of the tool. It's ready for use but not perfect, expect some issues.

Security

• Vaults are isolated per user. The registry, held passphrases, and per-vault locks are keyed by user ID and vault name, and ownership is verified before any operation. A vault owned by another user is indistinguishable from one that does not exist (vault not found, exit code 11).
• The vault registry is readable only by root (/var/lib/linux-vault is 0700, registry.json is 0600).
• Ownership checks fail closed: if a vault's owner cannot be confirmed, the operation is refused.
• The helper no longer reads or writes inside home directories. All file work runs in a worker process with the vault owner's identity; the root helper only sets or clears the immutable flag on a file descriptor passed to it.
• Child processes (7-Zip, pinentry) no longer inherit internal file descriptors.
• Vaults owned by root are refused.

Fixed

• Stopping the helper, or shutting down, now locks every unlocked vault that contains files.
• The password prompt now appears in the user's graphical session when started from the sandboxed helper.
• Passphrases are held correctly in a newly started helper.
• A lock that is refused or fails no longer leaves the vault stuck in locking; the state is always taken from what is on disk.
• Shutdown now aborts an unlock that is still extracting, and restores the archive's immutable flag.
• Creating a vault now adds a Nautilus bookmark. Missing bookmarks are restored on the next lock or unlock.
• The open-file check no longer refuses every lock. It is best-effort: a lock is refused only when a vault file is found open.

Changed

• A wrong passphrase prints Wrong password. (exit code 3). 7-Zip's output is logged to the journal at debug level instead of the terminal.
• Locking an empty vault is refused with <name> is empty; nothing to lock. (exit code 12).
• The journal records each 7-Zip invocation (never the passphrase), failed encryption checks, and the shutdown lock sequence.

Known issues

• On Hyprland with focus-follows-mouse, the password prompt does not take keyboard focus automatically. Add a window rule:
  windowrulev2 = stayfocused, class:^(pinentry-qt)$