The Microsoft Store doesn't update EXE installs, so the app updates itself
with Tauri's updater. It reads updater/latest.json from the Kestrove Gitea a
minute after startup and once a day. A new version shows as a banner and in
Settings > Updates, and installs only on "Update and restart". The vault locks
before the installer takes over.
The installer must be signed with the Kestrove updater key, with the signature
bound to its version (requireSignedVersion), so a compromised download server
can hold updates back but can't ship one or replay an old installer. Signing
is a release step, after Authenticode: gitea-release.sh signs, uploads the
.sig, and writes latest.json last. Plain builds need no key.
Checks reveal only the IP address and app version, and can be turned off in
Settings. endpoints is a list, so a mirror can be added. Linux packages update
through their package manager.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The broker, pairing channel, IPC and kestrove-nmh moved to kestrove-core so the macOS app serves
the extension too (a Mac no longer needs this app). Old module paths are re-exports.
rustls-webpki 0.103.16 and webpki-roots 1.0.10 (RUSTSEC-2026-0381/0382).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Device key (DeviceSigner): Windows TPM via CNG with a DPAPI-sealed software
fallback, Linux Secret Service with a 0600 file fallback (warned in Settings),
macOS keychain for dev runs. The store used is recorded; no silent switching.
- SyncService (Tauri-free): server URL and pins, create account with the
server's setup code, sync after unlock/save/browser save, every 15 min while
unlocked and on demand, status events, integrity alarm, device list with
fingerprint approval and revoke.
- Onboarding: "Use my phone" (join_start/poll, QR rendered locally, 6-digit
code), Emergency Kit from PDF/PNG/JPEG (hayro + rqrr), paste setup code, new
account. Then only the master password.
- From a signed-in desktop: "Add a phone or tablet" QR with countdown (cancel,
lock and quit revoke the ticket) and "Approve a computer" via pasted join code.
- KESTROVE_DATA_DIR / KESTROVE_DEVICE_NAME for a second instance; ignored
live test drives three instances against a real server.
- deny: ignore three unmaintained notices for zbus 5 sub-crates (Linux keyring).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Builds and runs (tauri build --debug); placeholder icons; persistent VaultCore::open in the
OS app-data dir; Secret Key remembered on the device; tray keeps the app serving the extension.
- Auto-lock: idle (system idle on Windows/macOS, in-app activity on Linux), screen lock, sleep.
- Local IPC for kestrove-nmh: 0700 dir + 0600 Unix socket with peer-uid checks; Windows named
pipe (first instance, local only, user DACL, client SID check) behind cfg.
- Pairing channel: X25519 → HKDF → 6-word fingerprint confirmed in both UIs, per-connection
session keys, AES-256-GCM with strict counters. Test vectors shared with kestrove-browser.
- Broker: query/fill/totp/save with origin re-checks; pairing and save prompts in the UI.
- kestrove-nmh relays ciphertext only; native-host installers for Linux/macOS/Windows.
- Tests: unit tests, tests/nmh_stdio.rs (real kestrove-nmh over stdio), examples/test-host.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
samiandClaude Opus 5.5