rcmd/keeporg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4ffc434b1ba621ed5767f06f534bf3861e568055
keeporg/packaging/deb/server/changelog
T
ReactorcoremeltdownandClaude Opus 5.5 4ffc434b1b Keep server data in an encrypted database, and harden every part 
Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-02 15:38:32 +01:00

143 lines
6.9 KiB
Plaintext
Raw Blame History

keeporgd (0.12.0) unstable; urgency=medium
* Security hardening after an audit. Single sign-on: a device is approved
only by an explicit Approve in the browser that started the sign-in;
the round trip is bound to that browser by a cookie and uses PKCE;
identities are never linked to accounts by username, by verified email
only when link_verified_email is set, never to administrators; existing
accounts link from their Account page. Sign-in: per-address and
per-account attempt limits (429), password hashing outside the store
lock, uniform timing, one-time codes good once, starting two-factor
needs the password. Merge vaults: bounds on KDF parameters, payload
size and XML shape; pushes checked before storing; at most two merges
at once. A version is written in the same transaction as its metadata.
Tokens in URLs only on the event stream; streams end on revocation.
CSP, frame-ancestors, no-store and HSTS on every response; sign-in form
CSRF. 404 for databases without access. New trusted_proxies /
KEEPORG_TRUSTED_PROXIES.
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 15:26:52 +0100
keeporgd (0.11.0) unstable; urgency=medium
* The server keeps its data in SQLite (the default, a file in the data
directory) or PostgreSQL (database setting, KEEPORG_DATABASE_URL or
-database), every row encrypted with AES-256-GCM under a key derived
from the master key and named by an HMAC, the KDBX versions included.
The master key is now required to start, and a different key is
refused. A data directory from 0.10 or earlier is imported on first
start and its old files set aside. Several servers may share one
PostgreSQL database. -reset-admin no longer needs the server stopped.
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 13:59:24 +0100
keeporgd (0.10.0) unstable; urgency=medium
* New Account page in the web interface: every signed-in browser and
client with a button to sign each out, or all but the current one;
two-factor setup, replacement and removal; the password form, moved
from the vault page. Matching API: GET and DELETE
/api/v1/auth/sessions, DELETE /api/v1/auth/totp. Replacing or removing
an active second factor now needs the password and a current code.
Administrators can sign a user out everywhere.
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 13:27:12 +0100
keeporgd (0.9.0) unstable; urgency=medium
* A client starting a browser sign-in may pass return_url, a keeporg:
URL, and the approval page then links back to it, after a password or
single sign-on alike. The Android app uses it to come back from the
browser.
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 13:11:01 +0100
keeporgd (0.8.0) unstable; urgency=medium
* The public base URL can be set with the KEEPORG_EXTERNAL_URL
environment variable. It overrides external_url in the configuration
file; -url overrides it.
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 12:37:29 +0100
keeporgd (0.7.0) unstable; urgency=medium
* Deleting a database now requires the caller's own account password
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 12:54:05 +0100
keeporgd (0.6.0) unstable; urgency=medium
* Add the administration pages: groups and their members, accounts,
invites and vault grants from a browser
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 12:28:50 +0100
keeporgd (0.5.0) unstable; urgency=medium
* Single sign-on now works from the web interface. The link on the
sign-in page started a flow that only a waiting client could finish, so
it always failed; a browser sign-in now ends in a session cookie.
* New endpoint for changing an account password. It requires the current
password, and the one-time code when a second factor is enrolled, and
revokes that account's other sessions.
* New keeporgd -reset-admin, for when the password printed at first start
was not kept. It prints a new one, clears any second factor on that
account and revokes its sessions. The server must be stopped first.
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 10:45:31 +0100
keeporgd (0.4.0) unstable; urgency=medium
* Read the master key from the file named by KEEPORG_MASTER_KEY_FILE, the
convention compose, swarm and Kubernetes use for a provisioned secret.
The file may hold base64 or exactly 32 raw bytes.
* Neither master-key environment variable is ever created by the server:
a secret that failed to mount is reported at startup and vault creation
is refused, rather than replaced with a new key that would open none of
the existing vaults. Only the configured master_key_file is created on
first run.
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 09:42:50 +0100
keeporgd (0.3.0) unstable; urgency=medium
* Container image: a scratch-based image of about 9 MB holding the static
binary and a CA bundle, running as an unprivileged user. It has no
shell, so HEALTHCHECK runs the binary's own -healthcheck probe.
* New -master-key-file flag, so a mounted secret can be used without a
configuration file.
* At startup the server now reports whether the master key still opens the
stored vault keys. A container restarted without its key would otherwise
discover this one failed merge at a time.
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 09:15:50 +0100
keeporgd (0.2.0) unstable; urgency=medium
* Server-side merging. A vault the server can open has its two concurrent
saves folded together in memory, by KeePass's own synchronization rules,
instead of one being refused. The losing version of an edited entry is
kept in that entry's history.
* New vault creation: a web interface at /web, and `keeporg vault -create`,
both of which build the KDBX file and set its password.
* Vault keys are stored encrypted under a master key in
/etc/keeporg/master.key, created on first start. Back it up separately
from /var/lib/keeporg.
* The KDBX 4 codec, its merge engine, and the ChaCha20, BLAKE2b and Argon2
it needs are part of the package; they carry no new dependencies.
-- tiredsysadmin <rcmd@garage.rcmd.space> Thu, 29 Oct 2026 17:28:45 +0100
keeporgd (0.1.0) unstable; urgency=medium
* First release.
* keeporgd: synchronization server with nested group access control,
invite-link and OIDC registration, built-in TOTP second factor,
versioned KDBX blobs and server-sent update notifications.
* keeporg: desktop client that mirrors assigned databases as ordinary
.kdbx files, pushes every save and applies remote changes, with
server-wins, client-wins and manual merge strategies.
-- tiredsysadmin <rcmd@garage.rcmd.space> Thu, 29 Oct 2026 12:00:00 +0000
Reference in New Issue View Git Blame Copy Permalink