Repository navigation
Releases
v0.0.12 — Security fixes
This patch fixes three issues found in a security audit:
schain forgetnow reports cache deletion failures and exits nonzero when any selected vault cannot be cleared. Missing entries remain distinct from backend errors, and other selected vaults are still processed.- Worktree discovery now reads
.git,commondir, andgitdirthrough nonblocking, size-limited regular-file reads. FIFOs, devices, and oversized metadata cannot hang discovery or cause unbounded reads. - Invalid
schain setkeys no longer echo the supplied secret value in error messages.
Regression tests cover partial and total cache deletion failures, backend error classification, unsafe metadata at all three lookup stages, and secret redaction. Local macOS tests and go vet passed; the release workflow also runs the full test suite on macOS and Linux.
Artifacts: macOS ARM64, Linux AMD64, Linux ARM64, and SHA-256 checksums.
v0.0.11 — Security hardening
Security fixes
- Render vault directory names literally in Bash, zsh, and fish prompts and safely quote temporary-directory cleanup paths.
- Save vaults through exclusively created random 0600 temporary files.
- Remove deleted secrets from refreshed environments and validate injected environment entries.
- Verify reciprocal Git worktree registration before borrowing vaults.
- Safely encode macOS Keychain commands; roll back failed Linux cache setup and enforce expiry/TTL bounds.
- Reject overlong passphrase-file input, excessive KDF iterations, oversized vaults, and nonregular vault files.
- Verify installer checksums, use matching release-tag source fallback, and pin CI actions.
- Fix automatic shell reload and require Go 1.26.8 for source builds.
Upgrade notes
Exit and re-enter existing schain shells after upgrading: older shells lack the key inventory required for safe reload. Vault files, including history, are now limited to 16 MiB; passphrase-file first lines are limited to 4096 bytes.
Verification
Linux and macOS CI tests passed. Release binaries are available for Linux amd64/arm64 and macOS arm64 with SHA-256 checksums. Native macOS Keychain operations were not integration-tested; command encoding was checked against Apple's parser source on Linux.
Full Changelog: v0.0.10...v0.0.11