v0.1.8

linux-vault 0.1.8 – 2026-09-27

This release addresses the findings of an independent security and reliability audit. Upgrading is strongly recommended.

Security

• Plaintext is never deleted on assumption. When a vault folder and <name>.7z exist side by side, the folder is only removed if the archive is verifiably the one linux-vault wrote for that vault. Each vault's archive identity is recorded at lock time. A backup or unrelated file named <name>.7z can no longer cause the vault's contents to be deleted.
• Existing files are never overwritten. create and lock refuse when <name>.7z already exists, and unlock refuses when a non-empty folder already exists at the vault's path.
• Passphrase buffers are wiped. Every internal buffer that carries a passphrase is now zeroed after use, in both the helper and its worker.
• The worker is protected from inspection from its first instruction. The helper binary is installed as execute-only (0711).
• Error messages can't be spoofed by file names. 7-Zip failures are classified from 7-Zip's own output, not from text that includes the vault path.
• CI hardening: GitHub Actions are pinned to commit SHAs, and unneeded permissions are removed.

Fixed

• Upgrading no longer breaks the running helper. After a package upgrade, vault operations and locking at shutdown keep working until the next restart.
• One vault can't stop the service. A vault that can't be reconciled at startup (missing parent folder, undeletable contents, deleted owner, a filesystem without the immutable flag) is logged and marked as needing recovery; the service starts for everyone else.
• Shutdown handles interrupted operations. Vaults stuck mid-lock or mid-unlock are locked at shutdown when their passphrase is held.
• A lock already in progress at shutdown is allowed to finish instead of being killed and repeated.
• A cancelled shutdown no longer leaves the helper refusing every request until restart.
• Relative paths work: lve create Example now resolves against the current directory.
• Exit code 9 (not enough free space) is now returned when the disk fills during lock or unlock.

Added

• Nested vaults are refused. A vault can't be created inside another vault, or around one (Cannot create <name>: it is inside vault <other>., exit code 13). Existing nested vaults keep working, with a warning logged at startup.
• A damaged registry is preserved, not overwritten. If /var/lib/linux-vault/registry.json can't be read, it is moved to registry.json.broken-<timestamp>, and every operation is refused (exit code 14) until an administrator restores or fixes it, deletes registry.damaged, and restarts the helper.
• lve ls shows locked (not immutable) when a vault's archive is on a filesystem that doesn't support the immutable flag, so the archive isn't protected from deletion.

Exit codes

Code	Meaning
3	wrong password
9	not enough free space
11	vault not found
12	vault is empty
13	nested vault
14	registry damaged

Upgrading

Lock any vault that contains files before upgrading. For safety, the running helper is not restarted automatically, so held passphrases aren't lost. To use the new version immediately:

sudo systemctl stop linux-vault-helper
sudo dnf install ./linux-vault-0.1.8-1.fc44.x86_64.rpm

Stopping the helper locks every unlocked vault that contains files.

Known issues

• On Hyprland with focus-follows-mouse, the password prompt doesn't take keyboard focus automatically. Add:
  windowrulev2 = stayfocused, class:^(pinentry-qt)$
• Supported on Fedora Workstation 44 (x86_64) only. Fedora Atomic desktops are not supported.