txc 0.8.0

Added

• Supply chain and verification.

  • deny.toml, checked in CI with cargo-deny, bans every HTTP, TLS and
    network-socket crate, allows only permissive licences and crates.io.
  • The protocol and keyholder modules forbid(unsafe_code).
  • Property tests feed arbitrary input to every parser of the folder, the
    local files and people's text, and fuzz/ holds cargo-fuzz targets
    for the same, run a minute each in CI.
  • CI gates: listing and the interface's view decrypt no secret, and a
    thousand entries after a year of edits on two devices stay under 5 MB
    and 500 files, with a quick warm open (160 files, 1.7 MB and about
    30 ms here).
  • Releases carry a CycloneDX SBOM, are built with fixed paths, and a
    second build from another directory must match byte for byte.

• txc vault restore VAULT/ENTRY brings back an entry removed from a
  synced vault in the last 30 days, with the values it had; fields removed on
  their own before it stay removed. txc vault list VAULT --removed lists
  what can come back. After the 30 days a snapshot drops the removed values,
  so they no longer outlive the window.

• Recovery without txc. docs/recovery-without-txc.md gives the whole
  path from two sheets and the card to a backup's contents with a SLIP-39
  tool and age, and scripts/recovery-key.py, written from that
  description and checked against txc in the tests, turns the recovery
  secret into the age key.

• The kit on paper. txc vault recovery print --printer prints the
  sheets and the card with lp straight from memory, after warning that
  network printers keep copies; --pdf FILE writes them to a new file only
  you can read, and status asks you to delete it until it is gone. Each
  sheet carries, in the clear, its root and share marks, and
  txc vault recovery check --root MARK --share MARK confirms a sheet
  belongs to the vault with nothing secret typed.

• Offline backups. txc vault backup --to DIR writes one age file,
  sealed to the vault's recovery key and this device, holding the whole
  vault as documented JSON (txc-backup-v1), removed entries still inside
  their window included, and a signature beside it that backup --verify
  checks. The folder is remembered: while it is there, as a backup drive
  plugged in, a new backup is written on its own once a week, and status
  says when the last one is a month old. txc vault recovery key gives the
  recovery key from two sheets and the card, with no vault needed, so
  age -d -i key.txt BACKUP reads a backup with age alone.

• Recovery without any device. txc vault recovery restore NAME --from OLD --folder NEW reads a vault's folder with two sheets and the card alone
  (the recovery key is a recipient of every control object, so it holds every
  sender key) and rebuilds it as a new vault with new sheets; protected
  entries come back as normal ones until a security key is added.
  txc vault recovery drill does the same without keeping anything, as the
  yearly rehearsal. Sheet checks and drills are dated, and status reminds
  you when one is due, folding several reminders into one line that
  status --all expands.

• txc vault recovery reissue replaces the sheets and the card after one
  was lost or seen. Two current sheets and the card sign a root fact naming
  new root keys, a new recovery recipient and new share commitments, and
  carrying over what the old roots had signed; every device then seals to
  the new recovery recipient and changes its sender key, and a recovery
  package gives the new sheets the history. The old sheets sign nothing and
  read nothing written afterwards.

• Devices, keys and root actions.

  • txc vault device remove flags every entry the removed device could
    read until one of its secrets changes, on any device: status says how
    many, and
    txc vault list VAULT --stale names them.
  • device remove also removes its security keys unless another device
    uses them (--key-lost removes those too). --wipe tells the device to
    wipe its keys when txc next opens the vault there; only a kill from a
    device that adds devices, or from root, counts.
  • txc vault hardware remove KEY removes a lost security key, and
    device list shows the keys.
  • With two sheets and the card, txc vault device promote DEVICE lets a
    device with a security key add devices, device allow DEVICE --more N
    lets it add more, and device remove of such a device revokes it.
  • A security key added to a certificate now counts against the admin's
    allowance, as a new device does.
  • txc vault device forget removes a vault's keys from this device, as
    before a border crossing.

• Setup that suggests. A new passphrase at the terminal comes with a
  suggested one of seven random words, and one that looks weak (under about
  50 bits) gets a word of warning. txc vault init points at a sync folder
  it finds (Dropbox, Syncthing, Nextcloud, Google Drive, OneDrive, iCloud
  Drive) for a synced vault, and --folder makes the last folder of the
  path when its parent exists.

• Exports of protected entries. A synced vault's export asks, one by
  one, whether to include each protected entry, instead of always leaving
  them out; root-grade and operation-only entries are never exported. A
  plaintext export from a device with a security key also asks for the
  passphrase and a touch.

• A quieter status. txc vault status --snooze hides the yellow lines
  shown now for 30 days (a line that changes shows again, and red lines are
  never snoozed); status --all lists them with their date, and how many
  devices and security keys each admin has added of those it may.
  txc vault unlock shows each synced vault's red lines every time and its
  yellow ones at most once a day.

• Swap, X11 and the screen lock. Where swap or the hibernation target is
  not encrypted (Linux: not on dm-crypt, nor zram), protected entries refuse
  to release and status says why; macOS swap is always encrypted, and
  where the system cannot tell, status --all says so. Under X11, where any
  program on the display reads the keys, a passphrase is not asked for at
  the terminal or in the interactive screen unless TXC_VAULT_ALLOW_X11=1
  is set; a passphrase file or a session still works. On Linux the
  interactive screen locks, and ends the session, when the desktop session
  locks. The keyholder locks its memory out of swap where the system's lock
  limit allows.

• Look-alike names and addresses. Entry names that mix Latin with
  Greek, Cyrillic, Armenian or Cherokee letters in one word are marked
  "(mixed scripts)" in lists, show and the interactive screen, and a web
  address whose host has letters beyond ASCII is shown in punycode, as
  https://xn--pple-43d.com for an "аpple.com" with a Cyrillic "а".

• Root-grade entries. txc vault add ENTRY --root-grade seals an entry
  as --protect does, and each release also asks for the passphrase again,
  whatever the session holds; it goes only to a program as a file.

• Two-step rotation. txc vault rotate ENTRY writes a new secret beside
  the old one in a synced vault, both readable; txc vault copy ENTRY --pending gets the new one to set where it is used, and rotate --commit
  makes it current, or --abort keeps the old. status lists a rotation
  until it is finished, so a change that failed halfway loses nothing.

• 2FA codes. A login has a 2FA key field (totp) for the setup key a
  site shows when you turn on two-factor login, or its otpauth:// link,
  and txc vault code ENTRY shows the current six-digit code, as an
  authenticator app would, in either kind of vault (RFC 6238, SHA-1,
  SHA-256 and SHA-512). In the interactive screen, p copies it, and the
  details pane says so beside the key. The key itself is never shown; a
  protected entry's code asks for its security key.

• Checkpoints, staleness and receipts. Opening a synced vault writes a
  checkpoint at least once an hour, dated by the device's clock. When no
  other device has written one for a week, status says so and adding
  devices, approving, promoting and reissuing are refused until the folder
  syncs again; removing a device never waits. Changes that have waited three
  days for objects that never arrived ask, in the checkpoint, for a
  snapshot, which a device that adds devices writes at its next sync. Device
  changes and reissues print a receipt, which txc vault compare --receipt
  checks against the signed history.

• A smaller command surface. The keys, trust and format commands of vaults
  that are not synced (identity, writer, writers, recipients, trust,
  fingerprint, history, upgrade) are grouped under txc vault advanced;
  their old spellings still work but are no longer listed. txc vault create NAME --folder DIR makes another synced vault, device approve also covers
  what device ack did, and status replaces sync.

• txc vault passwd covers synced vaults. It changes the passphrase of the
  identity and of every synced vault the current passphrase opens, keeping
  each vault's second factor, keystore or hardware; --vault NAME changes one.

• Synced vaults. txc vault init --folder DIR creates a vault in a sync
  folder that several devices share: signed, encrypted objects with random
  names, post-quantum from end to end (age mlkem768x25519, composite
  ML-DSA-65 + Ed25519 signatures). txc vault join and txc vault device add | list | remove pair devices through two pasted lines and a six-digit
  code; removing a device keeps it out of everything written afterwards.
  Concurrent edits keep both versions until txc vault resolve.
  txc vault status reads what other devices wrote and shows what needs
  doing, one line each. Keys at rest need
  the passphrase and a second factor from the system keystore. R...

txc 0.7.2

Changed

• The interface asks for the write passphrase on the first change rather than
  at unlock. Asking up front, before knowing whether a session would change
  anything, was surprising; now the first add, edit, delete, star, move or new
  vault opens the prompt, before any form so nothing is lost, and the write key
  is kept for the rest of the session. Locking the vault drops it with the
  identity, so it is asked for again when next needed.

Fixed

• The cursor in the write-passphrase dialog sat in the middle of the field
  label rather than at the start of the input.
• Unlocking in the interface drew the progress window on top of the dialog that
  started it, one window inside another. Only the progress window shows while
  the work runs now.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.7.1

Fixed

• Changing a vault from the full-screen interface could get stuck asking for
  the write passphrase: the prompt was opened by the change itself, then hidden
  behind the change's own form, so adding an entry went nowhere. The interface
  now asks for the write passphrase once, right after the identity is unlocked,
  so later changes go through without stopping. A session that dismisses that
  prompt to read only is offered it again, before any form, the first time it
  changes something.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.7.0

The read/write split. Reading a vault and changing one are now separate
powers, so a device, or an automated job, can be given the ability to read
without the ability to write.

Security

• A vault is now signed by a write key, an Ed25519 key kept apart from the
  identity and protected by its own passphrase. The signature is checked when a
  vault is parsed, before any trust decision, against the writer keys this
  device has pinned. A vault signed by a key you have not pinned does not open,
  and a device that holds only the identity, such as one given
  --passphrase-file, cannot produce a vault that any txc will open. This
  closes the case where a single recipients --add, or a move into a more
  widely shared vault, by anything holding the identity, granted an attacker
  retroactive read access. The write passphrase is never read from
  --passphrase-file.
• Because the check does not rest on trust.json, which a holder of the
  identity can forge, forging the trust record no longer helps: an unsigned or
  wrongly signed vault is still refused.

Added

• txc vault writer prints this device's writer public key and fingerprint.
• txc vault writers lists the pinned writer keys, and --add/--remove
  pin or unpin one (an authorization change, so it needs a terminal or --yes).
  Several keys can be pinned, so two of your devices can both write and a
  colleague's writer can be trusted.
• txc vault writer --rotate replaces the write key with a fresh one and
  re-signs every vault. It unlocks the current write key first, so a holder of
  the identity alone cannot rotate to a key they control, and it keeps the old
  key pinned while re-signing, so a vault is always signed by a pinned key and
  never stops opening, even if the rotation is interrupted. Retire the old key
  with writers --remove once every device has the new one.
• txc vault upgrade [VAULT] re-signs vaults still in the old format.
• txc vault delete <VAULT> removes a whole vault, keeping its last version
  beside it as a single .deleted recovery file and printing the mv that
  restores it. It opens the vault first, so it must be trusted and its
  signature must verify, needs the write key like any change, and confirms by
  the vault's name typed at a terminal or --yes. It refuses rather than
  overwrite an existing recovery file, and clears the vault from the trust
  record and the recent list.
• txc vault grant <entry> --to <recipient> --expires 1h seals one secret to
  another key, and txc vault redeem <file> opens it, so an automated host can
  be given exactly one secret without the identity or a passphrase. --to-file
  bundles a fresh key for the quick local case, at the cost that the file then
  is the secret. A grant is a snapshot and cannot be revoked: rotating the
  secret is the only real revocation, and the expiry is hygiene that redeem
  checks. Issuing a grant is a read, so it needs no write key.
• txc vault init --reader-only provisions a device that can read but never
  write: an identity and an empty writers list, and no write key.
• --write-passphrase-file <PATH>, mirroring --passphrase-file, for a device
  that legitimately writes without a person present. Its help says plainly that
  giving it on a machine where untrusted code runs as you removes the split.

Changed

• txc vault init now also creates the write key, asking for its own
  passphrase, and creates it too on an existing 0.6.0 home that has none. Run it
  once after upgrading.
• The vault file format is now version 2, carrying the writer and the
  signature. This release reads version 1 as well and writes version 2; a
  future release will stop reading version 1. rage -d still opens a vault, as
  the signature is an ordinary field.
• The trust decision log now records a write only when the recipients or the
  writer changed, so routine edits no longer push the genuine decisions out of
  the capped log.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.6.0

Security

• txc vault trust <name> --yes now accepts only a vault that is new to this
  device. It no longer accepts a vault that changed under a name you already
  trust, which an unattended job could previously have been made to pin: anyone
  who knew your public key could drop a same-name vault encrypted to their own
  key into a synced vaults/ directory, and --yes would trust it. Accepting a
  changed vault now needs a person at a terminal, or the fingerprint passed with
  --expect <fingerprint>, verified out of band.

Added

• txc vault fingerprint <name> prints a vault's fingerprint, a short string
  derived from its key, so two devices can confirm out of band that they mean
  the same vault. txc vault trust prints it as well, and accepts it through
  --expect <fingerprint> to trust a changed vault without a prompt.
• txc vault history <name> lists what this device has trusted for a name and
  what each decision replaced.

Fixed

• A vault changed by two devices at the same generation is now refused instead
  of reported as trusted, which previously let one device's version overwrite
  the other's entries without warning. The trust record keeps a digest of the
  bytes it last opened and treats a different vault at the same generation as a
  divergence to be shown and accepted.

Changed

• The device trust record trust.json is written in a new format that also
  stores each vault's digest and a short log of trust decisions. Records written
  by an older txc are read and upgraded in place; a trust.json written by this
  version is not read by an older one, so run the same version on every device
  that shares an identity.
• Hardened the code against latent panics. A strict set of clippy lints now
  guards production code against unchecked indexing, overflowing arithmetic and
  quietly dropped errors, and the few unreachable unwrap/expect sites this
  surfaced are now ordinary errors. There is no change in behaviour on valid
  input.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.5.2

Fixed

• Each entry in the vault list is now shown over two lines, the name on its own
  and the kind and vault below it, so a name is no longer cropped to share the
  row with them. The list is a narrow column, leaving the wider pane beside it
  for reading the selected entry.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.5.1

Added

• txc vault move <entry> <vault> (also mv, and m in the interface) moves
  an entry to another vault, decrypting each secret and sealing it again to
  the destination's keys. The destination is written before the entry is taken
  from the source, so an interrupted move never loses it.

Changed

• The README leads with the project and a one-line install, and the ways to
  install are grouped below rather than spread through it. Only the install
  methods that are published are shown as commands.
• When the key reference along the bottom of the interface is too wide for the
  terminal, it now drops the About key before the vault key, so the vault key
  stays on screen for longer.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.5.0

The vault release: txc now keeps secrets as well as text, in encrypted files
on your own machine.

Added

• txc vault, an encrypted vault for passwords, payment cards, API keys,
  notes and other secrets, kept in local files and built entirely on the age
  format: init, identity, passwd, create, list, add, show,
  favourite, copy, edit, rm, recipients and trust.
• Thirteen kinds of entry, each with the fields that suit it: login, payment
  card, secure note, API key, SSH key, database, server, Wi-Fi network, bank
  account, ID document, software licence, crypto wallet and other secret.
  Each field is plain or secret by definition, and a secret field given as a
  plain --field is refused.
• Favourites, stored in the vault so they follow it to other devices, and a
  list of what was used recently, kept on the device in its own encrypted
  file. txc vault list takes --favourites, --recent, --kind and
  --tag, across every vault.
• "Unlocking..." on the terminal while the passphrase is checked, which takes
  a moment on purpose.
• The identity is an age X25519 key encrypted with a passphrase through scrypt
  at N = 2^18. Each vault is one age file, encrypted to one or more public
  keys, and each secret inside it is sealed again on its own, so browsing a
  vault decrypts no secret and copying opens exactly one.
• Trust records per device, authenticated with a key derived from the
  identity. A vault that is new to the device, rebuilt with another key,
  encrypted to different recipients, or older than the version last opened is
  refused until txc vault trust shows what differs and it is accepted.
• Secrets are never taken as arguments: they are typed without echo,
  generated with --generate, or piped in with --secret-from-stdin. copy
  keeps them out of clipboard history where the system allows, clears the
  clipboard again after 20 seconds if the secret is still there, and never
  falls back to OSC 52. --print writes to a pipe and refuses a terminal.
• Vault files are written atomically and never through a link, and on Unix are
  readable by their owner alone and refused when they are open to other users.
  Keys and secrets are wiped from memory when dropped; on Unix core dumps are
  disabled while the vault is in use, and on Linux the process is also marked
  not dumpable.
• A vault screen in the interactive interface, on F3. Favourites, recently
  used, all items, each kind and each vault are down the left; adding an
  entry starts by choosing its kind and opens that kind's form, with
  generated passwords and PINs and a real editor for notes. A secret can be
  revealed for 15 seconds and a note opened to read; otherwise secrets are
  drawn only as dots or a fixed mask. The passphrase is checked in the
  background behind a spinner, and the vault locks after five minutes without
  a key and when the interface closes.
• Pasting into the interactive interface arrives in one piece, so a multi line
  value no longer presses Enter part of the way through. This needs bracketed
  paste, which the Windows console does not have; there a paste still arrives
  as typing.
• A vault cargo feature, on by default. --no-default-features builds txc
  without the vault and without its dependencies.

Changed

• Unsafe code is denied across the crate, except in the one module that makes
  system calls to harden the process.
• The release binary is about 1.3 MiB larger with the vault built in.
• The cryptography crates are optimised even in development builds, where
  checking a passphrase otherwise took fifteen seconds rather than half of one.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.4.1

Added

• A Command line panel along the bottom, writing the selected operation out in
  two forms: arg spells it out in full, pipe says the same thing as briefly
  as the operation allows. Both follow the options panel and the input, so they
  reproduce what is on screen rather than a generic example. The panel is
  dropped on a terminal shorter than 20 rows, where the panels above need the
  space more.

Fixed

• txc tui no longer hangs when its input is not a terminal. On Windows
  crossterm reads the console the process is attached to rather than the
  standard streams, so under a pipe the interface started and then waited for
  a key that would never arrive. It now reports the same error there as
  everywhere else. This is what left a CI job running for six hours.

Changed

• Every CI and release job has a timeout, so a job that blocks rather than
  fails costs minutes instead of the six hour default.
• The end to end tests kill a txc that has not finished within a minute and
  fail, rather than waiting on it.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.

txc 0.4.0

A documentation release: the library half of txc is now documented in full,
and the whole crate is held to a stricter set of lints.

Added

• Documentation on every public item. The crate root reads as an
  introduction, covering how to run an operation, pass parameters, chain
  operations, walk the catalogue and read the errors back.
• 100 examples, which run as part of cargo test, so they cannot go stale.
• OpFn and ParamKind are re-exported from the crate root, so declaring an
  operation no longer needs the registry module path.
• The dependency audit runs in CI, weekly as well as on every change, since an
  advisory can be published without anything here changing.
• The documentation is built in CI with warnings denied: a broken link would
  otherwise show up only as a mangled page on docs.rs.

Changed

• The crate is linted with clippy::pedantic, plus use_self and
  missing_const_for_fn. What that fixed is invisible from outside, other
  than more functions being const and returning values now being
  #[must_use].
• Reading time in stats is worked out in whole numbers. In floating point,
  205 words came out as 61 seconds rather than 62, because 61.5 is not
  representable and the value landed just below it.

Install

curl -sSf https://raw.githubusercontent.com/vorjdux/txc/main/install.sh | sh

irm https://raw.githubusercontent.com/vorjdux/txc/main/install.ps1 | iex

Every archive is listed in SHA256SUMS.