Package: qtpass
Version: 1.6.0-1
Severity: wishlist
X-Debbugs-Cc: [email protected]
Hi Philip,
upstream here. QtPass 1.8.1 was released on 2026-09-15; unstable currently
carries 1.6.0 (2026-04-13). Two upstream releases have happened since:
1.7.0 2026-04-20
1.8.0 2026-09-13
1.8.1 2026-09-15
1.8.1 is a security and bug-fix release, which is why I am filing rather
than
waiting. The fixes that matter for Debian users:
* Every gpg encrypt call now passes --no-encrypt-to, as pass does: an
"encrypt-to" line in the user's gpg.conf could silently add a
recipient the
.gpg-id never listed, i.e. secrets encrypted to an unintended key.
* Only launchable http(s) URLs become clickable links in the password pane;
previously ssh://, ftp:// and URLs with embedded credentials were
linkified
and handed to the desktop's URL handler.
* The key-generation dialog no longer shows the passphrase in clear text in
the batch template, and an expert-mode template can no longer produce an
unprotected key by accident.
* The re-encryption backup commit stages tracked files only, so a stray
plaintext export or editor swap file in the store is no longer
committed and
auto-pushed to a shared remote.
* Single-instance IPC: a stale socket left by a crash no longer disables it
permanently, the socket is restricted to the owning user, and a
launch whose
forward fails opens a window instead of exiting silently.
* "New folder" wrote a zero-byte .gpg-id, which shadowed the parent
recipients
and made every insert in that folder fail; it is now seeded from the
parent.
* A configured GPG home that no longer exists is ignored with a status
message
instead of making every gpg call fail with "No secret key".
* Windows/WSL only: commands ran through the WSL login shell, so entry
paths,
.gpg-id recipients and commit messages were word-split and $()-expanded.
Not exploitable on a Debian system, listed for completeness.
Full list: https://github.com/IJHack/QtPass/blob/v1.8.1/CHANGELOG.md
Release: https://github.com/IJHack/QtPass/releases/tag/v1.8.1
Notes for packaging 1.8.x:
* debian/watch works unchanged: the release carries QtPass-1.8.1.tar.gz
and a
detached QtPass-1.8.1.tar.gz.asc, signed with my key (same as previous
releases).
* Qt 6 only since 1.8.0; qt6-base-dev, qt6-tools-dev-tools and now
qt6-svg-dev (SVG icons are loaded through QIcon, so libqt6svg6 at
runtime,
which d/control already has).
* 1.8.1 installs the desktop file, the AppStream metainfo and the hicolor
icons itself (main/main.pro INSTALLS), and 2.0 will add the man page, so
parts of debian/install and debian/qtpass.* may become redundant.
* Two of the three patches look obsolete to me:
- 03-fix-gpg-detection.patch: since 1.8.0 the probe tries gpg2 and falls
back to gpg (src/qtpasssettings.cpp, initExecutables()), so no patch is
needed to find /usr/bin/gpg.
- 01-disable-tests.patch: the suite runs headless. Upstream CI runs
"make check TESTARGS='--platform offscreen'" on every push; if you
would
rather keep the tests disabled that is of course fine, but they should
work in a buildd chroot now and would give the package some coverage.
- 02-make-reproducible.patch: I am taking this one upstream
(QMAKE_RESOURCE_FLAGS += --format-version 1 in qtpass.pri), so it
can be
dropped from the next upload that includes it.
Given the gpg.conf recipient issue and the .gpg-id one, 1.8.1 (or the
relevant
patches) would be worth considering for trixie via stable-updates or
backports, but I will leave that judgement to you.
Happy to help with anything upstream that makes packaging easier; you can
reach me here or at [email protected].
Thanks for maintaining the package.
--
Anne Jan Brouwer
QtPass upstream
