Skip to content

v0.23.17

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 14:39
· 42 commits to main since this release
v0.23.17
bd57548

What's Changed

Fixed

  • "Search from vault root" now works for Bitwarden, 1Password, Passbolt and pass, not only KeePass (issue #353) — with root search on, the whole-vault fallback is meant to match an entry titled by the connection's name or host. On these four backends it never did: the connect path, and the connection editor's Load password from vault and Test credential resolution buttons, all read through a plain retrieve(key), which hands the backend no name or host. The fallback therefore searched for one title only, the internal rustconn/{name} key, which no user writes. The reporter's log shows it: bw list items --search rustconn/hanfile03 came back empty and the lookup ended. dispatch_vault_op now has a VaultOp::RetrieveFor { name, host } that calls retrieve_identity, and the connect path and both editor buttons use it. A backend with root search off ignores the aliases, so its reads are unchanged. The editor's load button also stops building each backend itself and goes through dispatch_vault_op, as the test button already did. Its Bitwarden unlock now runs under the shared vault lock, and its retrieve gets the per-backend budget the rest of the app uses (45 s for the CLI-backed vaults, 10 s for local ones) instead of a flat 10 s. (rustconn/src/vault_ops.rs, rustconn/src/state/mod.rs, rustconn/src/dialogs/connection/dialog/passwords.rs)
  • Root search no longer lets a write touch an entry RustConn did not create (issue #353) — on Bitwarden, 1Password and Passbolt, store and delete located the existing entry through the same lookup reads use, which with root search on also matches a bare title anywhere in the vault. So a save could overwrite and rename an entry the user kept outside RustConn, and a delete could remove it (Passbolt permanently). Writes now look only for RustConn's own RustConn: {key} entry; root search widens reads only, as its setting says. (rustconn-core/src/secret/bitwarden.rs, rustconn-core/src/secret/onepassword.rs, rustconn-core/src/secret/passbolt.rs)
  • KeePass: the connection editor's Load password from vault and Test credential resolution buttons now search from root as a connect does (issue #353) — the reporter's KeePass connection resolved on connect through root search, but both buttons said the password was missing. They read only the RustConn/ scoped entry and never checked kdbx_root_search. A new KeePassStatus::get_password_from_kdbx_scoped_then_root does the scoped read, then the root search with the same candidates the connect path uses (lookup key, host, name); a database that cannot be read is reported, not treated as a miss. (rustconn-core/src/secret/status.rs, rustconn/src/dialogs/connection/dialog/passwords.rs)
  • Group passwords: the group dialogs' Load password from vault button and an inherited connect now search from root too (issue #353) — the New Group dialog built each backend itself with a plain retrieve on group:{name}, a key nothing writes. The Edit Group dialog, the GUI's non-KeePass Inherit path and the core CredentialResolver Inherit path passed the group's UUID with no name. With root search on, none of them could match an entry titled by the group's name. The KeePass Inherit connect path already could. All of them now pass the group name. The New Group dialog goes through dispatch_vault_op. KeePass reads in both dialogs use get_password_from_kdbx_scoped_then_root. The two timeout constants only the removed inline dispatch blocks used are gone. (rustconn/src/window/connection_dialogs.rs, rustconn/src/window/edit_group.rs, rustconn/src/state/mod.rs, rustconn-core/src/secret/resolver.rs, rustconn/src/vault_ops.rs)
  • rustconn-cli secret get/set/delete now use the vault keys the GUI uses (issue #353) — for every backend except KeePass, the CLI read and wrote {name} ({protocol}), and the connection UUID for a 1Password store and for Passbolt. The GUI saves and resolves under rustconn/{name}, or RustConn/{group path}/{name} ({protocol}) for the system keyring. So secret get never found a password saved from the GUI, and a connect never found one saved with secret set. The key functions (generate_store_key*, vault_keys_for_connection) moved from the GUI into rustconn-core, and the CLI uses them. get reads the GUI's key first, root search included, then the GUI's older keys and the old CLI key; delete removes all of them. Because rustconn/{name} carries no group or protocol, same-named connections share it in the GUI as well; set and delete now name the other connections they affect on stderr (not for KeePass, whose entry path carries the group and protocol). A root-search match on an entry RustConn did not create is now logged at info level, naming the entry, so a wrong match can be traced. secret get also passes the connection's name and host, so it honours root search on these backends as it already did for KeePass. (rustconn-core/src/secret/store_key.rs, rustconn/src/vault_ops.rs, rustconn-cli/src/commands/secret.rs)
  • Bitwarden no longer unlocks twice when a connect starts during the startup unlock (issue #353) — the startup unlock runs on its own thread, outside the vault-op lock. A connect made while it was still running started a second bw status / bw unlock / bw sync alongside it. Every step appeared twice in the reporter's logs, and each bw call takes seconds. auto_unlock now runs one caller at a time, so the second one waits; if the first stored a session, the second takes the fast path, otherwise it repeats the checks on its own. The startup unlock is now bounded to 30 s, like the connect path's, so it cannot hold the connects behind it indefinitely. (rustconn-core/src/secret/bitwarden.rs, rustconn/src/app.rs)

Documentation

  • CLI reference and user guide — docs/CLI_REFERENCE.md describes the keys secret get/set/delete use and that secret get honours root search on every backend that has it; docs/USER_GUIDE.md gives the system keyring's hierarchical key format. (docs/CLI_REFERENCE.md, docs/USER_GUIDE.md)

Dependencies

  • Updated: tokio 1.53.3 → 1.54.0, rustls-webpki 0.103.15 → 0.103.16, crc32fast 1.5.2 → 1.5.3, typed-path 0.12.3 → 0.12.4. All semver-compatible; tokio is a direct dependency (minor bump), the rest are transitive patch bumps. No security advisories affected (cargo deny check advisories clean), and cargo outdated --root-deps-only reports every direct dependency current. CLI download versions all current (TigerVNC pinned at 1.16.2, confirmed latest upstream; kubectl/Tailscale/Teleport/Boundary/Hoop.dev/Bitwarden/1Password auto-resolve and were reachable); the RustCrypto release-candidate family and the out-of-range majors remain held back, pinned transitively by the sspi/picky-krb stack exactly as in 0.23.1–0.23.16. The Flatpak/Flathub manifests are in sync and current (GNOME runtime 51, FreeRDP 3.32.2, cJSON 1.7.19, OpenH264 2.6.0, each confirmed as the latest upstream release).

Installation

Flatpak (Recommended)

flatpak install flathub io.github.totoshko88.RustConn

Snap

sudo snap install rustconn

Debian/Ubuntu (.deb from this release)

sudo dpkg -i rustconn_0.23.17_amd64.deb
sudo apt-get install -f  # Install dependencies if needed

Fedora (.rpm from this release)

sudo dnf install rustconn-0.23.17-1.fc44.x86_64.rpm

AppImage

chmod +x RustConn-0.23.17-x86_64.AppImage
./RustConn-0.23.17-x86_64.AppImage

macOS (Homebrew)

brew tap totoshko88/rustconn
brew install rustconn
open $(brew --prefix)/opt/rustconn/RustConn.app

All dependencies (GTK4, libadwaita, VTE, Adwaita icons) are installed automatically.
Requires macOS 13 (Ventura) or later.

OBS Repositories

Packages available at: https://build.opensuse.org/package/show/home:totoshko88:rustconn/rustconn

# Debian 13 (Trixie)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 24.04 LTS (Noble)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 26.04 LTS (Resolute)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Fedora 44
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_44/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# Fedora 43
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_43/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# openSUSE Tumbleweed
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Tumbleweed/ rustconn
sudo zypper ref && sudo zypper in rustconn

# openSUSE Leap 16.0
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Leap_16.0/ rustconn
sudo zypper ref && sudo zypper in rustconn

Arch Linux (AUR)

yay -S rustconn

FreeBSD (Ports)

pkg install rustconn

Full installation guide: https://github.com/totoshko88/RustConn/blob/main/docs/INSTALL.md

Verifying your download

Every binary on this release (deb, rpm, AppImage, Flatpak) is covered two ways.

Plain checksums — download SHA256SUMS alongside the asset, then:

sha256sum -c SHA256SUMS

Signed build provenance (SLSA, via Sigstore) — proves the file was built by this
workflow from this commit:

gh attestation verify RustConn-0.23.17-x86_64.AppImage --repo totoshko88/RustConn

(The snap is signed by the Snap Store; the macOS build is delivered via the Homebrew tap.)

Assets 10
Loading