Skip to content

Apassy 0.4.1

Choose a tag to compare

View all tags
@wydrox wydrox released this 12 Oct 06:54
· 229 commits to main since this release
v0.4.1
921a4a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

One version, 0.4.1, for the Mac app, the iPhone app, and the browser extension. Signed and notarized Mac packaging, optimized iPhone packaging, and native Mac passkey registration and sign-in have passed. Newly created Mac passkeys are immediately available to sign in without an AutoFill refresh. Acceptance on a physical iPhone and of the browser extension from the Chrome Web Store is still open (status and checks).

Upgrade notes

  • Make an encrypted backup first. Then update every Mac and iPhone that shares the vault through a folder, iCloud Drive, or the relay.
  • The new apps migrate schema 16 to schema 17 when you unlock the vault. Older apps cannot open or sync the upgraded vault.

Added

  • An agent that can see credentials can ask for process access at its first use (ADR 0024). The owner sees the folder, effective secret delivery, and declaration, then chooses "Allow once" or access in that folder and its subfolders. Production credentials still ask at each run.

  • The iPhone app adds the free personal iCloud Drive sync path beside team relay sync. It opens the Mac's encrypted .apassy file, keeps an offline local vault, and merges changes in both directions through coordinated snapshots. Sync settings identify the source and can restore file access. Companion approval pairing remains separate.

  • The Apassy app for the iPhone holds your vault, like a second Mac (ADR 0023). Add the iPhone with "Add a device…" on the Mac: scan the QR code, compare the two safety words, confirm on the Mac with Touch ID, and type the passphrase on the iPhone. The vault syncs both ways through the Apassy relay. The app has Home (favorites, recently changed, kinds), Items, Search, item details, new and edited items, the password generator (random, memorable, PIN), Watchtower (weak, reused, and old passwords, conflict copies), Face ID unlock, auto-lock, and Settings. Each reveal, copy, one-time code, or large type of a secret needs Face ID or the passphrase; a copy stays on the iPhone and expires after 60 seconds. Password AutoFill fills logins and one-time codes in Safari and apps after Face ID. The companion of ADR 0020 is the Approvals tab. The app is in TestFlight.

  • The vault core of the iPhone app (ios/ApassyCore) runs the same vault and relay sync code as the Mac (contract docs/contracts/ios-core-v1.md). scripts/build-ios-core.sh builds it, and scripts/ios-testflight.sh archives and uploads the app.

  • Passkeys (WebAuthn, ES256) and one-time codes (RFC 6238 TOTP) in the vault, the iPhone core, the Mac app, and the browser extension. Acceptance on a physical iPhone and with the store build of the extension is open (guide, iPhone core contract).

    • A login can hold one passkey. The iPhone core has the calls passkey_list, passkey_assert, passkey_register, passkey_import, and passkey_remove. Sign-in and registration need a fresh owner check. The key never appears in an item, a reveal, a list, or an agent read.
    • Codes accept SHA-1, SHA-256, and SHA-512, 6 to 8 digits, and a period of 15 to 120 seconds. HOTP and Steam codes are not supported. A field with a custom title counts as a code when its value is an otpauth://totp link.
    • The iPhone AutoFill suggests passkeys and codes beside passwords. A login that has only a passkey offers no password.
    • Credential Exchange on iOS 26 moves logins, TOTP, and ES256 passkeys to and from other apps. Each import and export needs its own owner check. A paused export continues only in the vault where it started. The history says "prepared", which does not prove that the other app finished.
    • The Mac item page shows the passkey without its key and offers "Remove passkey". The browser extension can sign in with a passkey and fill a code after a separate permission. The browser guard verifies Helium and Google Chrome stable. It refuses extension-loader and remote-debugging switches. Acceptance with the signed app in a normal browser is open.
    • docs/operations/passkeys-and-codes.md has an acceptance checklist that keeps local tests, signed builds, and real devices apart.

Changed

  • "Add a Mac…" in Settings > General > Sync is "Add a device…". It shows the device link as a QR code for the iPhone, and as text for another Mac.
  • The vault schema is 17 (it was 16). Update every Mac and iPhone that shares a vault. A build of schema 17 migrates a vault of schema 16 and reads a copy of schema 16. A build of schema 16 cannot open a vault of schema 17 or read a copy of it. Make a backup before you upgrade. Local tests cover schema 17 uploads over a copy of schema 16 on the relay, in the iCloud core, and in a folder. Device acceptance remains open.
  • A login with a passkey needs no password. Removing the passkey keeps the login only when it has a non-empty password. Otherwise it deletes the whole login, and the screen says so first.
  • A Mac build without both provisioning profiles has no AutoFill extension. With both valid profiles and APASSY_REQUIRE_PROVIDER=1, the build script can include passwords, codes, and passkeys. The signed Mac CI build of source 82c641d passed its provider tests and notarization. Native Helium registration and sign-in passed with the same provider in an isolated signed test app.
  • The Mac editor hides a visible detail that has an OTP label or looks like a setup key, also when you save it without a change.

Fixed

  • Passkey registration and sign-in set both backup flags required by Apple's credential provider API. The Mac provider validates the attestation data and required flags before returning a credential to macOS. These flags do not confirm that a backup of the vault exists.

Security

  • Automatic process bindings refuse OTP setup-key labels and otpauth://totp values. An owner can explicitly bind a setup key after the field-specific warning and check.
  • First-use access cannot be saved for the filesystem root, HOME, its ancestors, or their filesystem aliases. These folders offer "Allow once" only. Displayed paths remove invisible format characters, and the Touch ID consent fits the native prompt limit.
  • A passkey key stays in the encrypted vault. Generic reads, item details, and agent reads do not return it. Only the owner-approved Credential Exchange export returns it, straight to the system.
  • Each passkey sign-in, registration, import, removal, and export asks for a fresh owner check. The seed of a one-time code never appears in a row, a list, an identity, or an error.
  • The agent catalog hides legacy visible TOTP setup keys, and the decision log masks their stored values. An explicit setup-key variable grant names the field and warns that programs can make codes. Its owner proof names the field, variable, delivery mode, and setup-key status. Automatic batch binding refuses setup keys.
  • The iPhone core writes each answer into one buffer of exact size and erases it when it is freed. A serializer that changes size gives an error and no grown copy of a secret.

Download the signed and notarized macOS app from https://apassy.wyderka.cc/download/Apassy.dmg.

Full changelog: https://apassy.wyderka.cc/changelog

Assets 2
Loading