Skip to content

ChangeLog.md

Latest commit

 

History

History
651 lines (480 loc) · 40.9 KB

ChangeLog.md

File metadata and controls

651 lines (480 loc) · 40.9 KB

ChangeLog for Keychain - https://github.com/danielrobbins/keychain

keychain 2.9.8 (2 Nov 2025)

This release fixes the release tarball to include all necessary files for building and using keychain.

Bug fixes:

  • Fixed release tarball generation to include bash completion script (completions/keychain.bash), Makefile, source files, and other essential components. Previous release (2.9.7) tarball was missing these files.
  • Improved tarball generation to use git archive as source of truth, eliminating manual file inventory and preventing future omissions.
  • Updated release logic to use dist/ directory for archive generation. GitHub workflow plumbing work for new /dist tarball location, associated Makefile and CI fixes.

Documentation:

  • Added bash completion information to keychain man page (NOTES section).

keychain 2.9.7 (31 Oct 2025)

This release fixes critical issues with spaces in HOME directories and usernames, and adds official Git Bash on Windows compatibility.

Bug fixes:

  • Fixed keychain failures when HOME directory path contains spaces (e.g., C:\Users\John Doe). (#188)
  • Fixed username detection for usernames containing spaces (e.g., "Mathew Binkley" on Windows). Implemented portable get_owner() function using POSIX-defined ls -ld output format with intelligent field parsing to distinguish space-in-username from normal owner/group fields.
  • Fixed pidfile generation to properly quote SSH_AUTH_SOCK paths containing spaces while leaving SSH_AGENT_PID unquoted (numeric value). Rewrote write_pidfile() to use robust eval-in-subshell approach for extracting variable values from ssh-agent output.
  • All pidfile formats (sh/csh/fish) now correctly handle paths with spaces.
  • Fixed ssh-agent invocation to always use -s option for Bourne-compatible output, simplifying pidfile generation and improving compatibility across different environments. (#185)

Testing and quality improvements:

  • Added scripts/test-space-home.sh - automated test harness that simulates HOME directories with spaces and validates proper handling. Returns proper exit codes for CI integration.
  • Integrated space-in-home test into GitHub Actions release workflow to prevent regressions.
  • Added ShellCheck disable comments with justification for intentional POSIX ls usage.
  • Fixed Unicode arrow characters in comments that caused ShellCheck errors.

New features:

  • Added bash completion support (completions/keychain.bash) with intelligent context-aware completion for command-line options, SSH keys, GPG keys, and full --extended mode support. Based on work by @mikkoi with significant enhancements for keychain 2.9.x features:
    • Dynamically parses keychain --help for up-to-date option completion
    • Completes SSH key names from ~/.ssh/*.pub files
    • Completes GPG key IDs (8-character short format)
    • --extended mode: sshk:<tab>, gpgk:<tab>, host:<tab> with prefix completion
    • Detects hostnames from ~/.ssh/config for host: completion
    • ShellCheck compliant (#186)
  • Added Makefile targets: install-completions and uninstall-completions for optional bash completion installation (separate from default install target).
  • Updated RPM spec file (keychain.spec.in) for modern distributions:
    • Modernized description to focus on OpenSSH and GnuPG (removed obsolete ssh.com/Sun SSH)
    • Updated dependencies: sh-utils → coreutils, added Recommends: bash-completion
    • Added bash completion installation to RPM package

Documentation:

  • Updated keychain.pod with detailed implementation notes for space handling, POSIX compliance, and the robust eval approach used in pidfile generation.
  • Standardized option ordering in keychain.pod to follow Unix convention (short option first, then long option), ensuring compatibility with bash completion regex patterns.
  • Added comprehensive COMPATIBILITY section to keychain.pod documenting:
    • Minimum OpenSSH version (7.3+) and supported features
    • GnuPG 2.1+ requirements for gpg-agent integration
    • Shell compatibility (Bourne/POSIX, csh/tcsh, fish)
    • Git Bash (MSYS2) for Windows - officially documented as supported platform
    • Legacy SSH implementation status (SunSSH, ssh.com)
    • Systemd user environment integration
    • Spaces in HOME and paths handling details
  • Updated README.md with bash completion installation instructions for both system-wide and user-only installations.

keychain 2.9.6 (06 Sep 2025)

Documentation/branding release (no functional code changes):

Additional release engineering improvements:

  • Add release automation helpers: Makefile release (create) and release-refresh (asset replace), plus scripts under scripts/ and GitHub Actions workflow to build artifacts on tag push (staging only).
  • Add docs/release-steps.md to formalize release process (numeric tags only, assets: tarball, wrapper script, man page).
  • Orchestrated release flow (make release / make release-refresh) now enforces:
    • Mandatory CI (Debian container) artifact fetch for the tag.
    • Normalized comparisons:
      • keychain – raw sha256.
      • keychain.1 – raw sha256; on mismatch, re-compare with Pod::Man first line stripped.
      • Tarball – internal file list + per-file sha256 (man page internally normalized) ignoring tar/gzip metadata.
    • If (and only if) all artifacts match (raw or normalized) CI artifacts are used DIRECTLY for publication; local artifacts are never overwritten (kept for audit).
    • Any real content mismatch aborts unless KEYCHAIN_FORCE_LOCAL=1 is explicitly set (single override; KEYCHAIN_ADOPT_CI removed).
    • Copy/paste diff command hints emitted on mismatch for rapid investigation.
    • Asset path indirection via exported variables prevents local file mutation, improving auditability.
  • Release notes body automatically extended with a Build Provenance table (sha256 for keychain and keychain.1) plus the tag commit SHA1.
  • Workflow continues to only stage artifacts; publication requires explicit maintainer action (no auto-release on tag push).

keychain 2.9.5 (16 May 2025)

This is a bugfix release.

  • Hardening checks were failing on Android and some MacOS environments. Make them more compatible and lower to warnings instead of aborting the script, until they have been tested in more environments. (#177)

  • Fixed issues with indentation of note(), warn(), mesg().

  • Convert SSH_AUTH_SOCK in pidfile is invalid; ignoring it into a debug message, as this is normal when rebooting your system so is not really useful to show typically. (#176)

keychain 2.9.4 (14 May 2025)

This is a minor bugfix release.

  • Fix minor regression which allowed some warnings to display with --quiet. (#175)

  • "Cannot find separate public key" turned into a note() rather than warn(), along with several other non-critical notices. note() can be suppressed with --quiet, unlike warn(). (#157)

  • Minor improvement when wiping GnuPG keys with --wipe option so keychain output is more understandable when gpg-agent is not running.

keychain 2.9.3 (14 May 2025)

This is a security and bug fix release. Many thanks to those who have reported issues to GitHub, send in pull requests, and tested out fixes. 2.9.3 includes the following updates:

  • The --quick option logic had several bugs which have been resolved. Thanks to Filipe Fernandes (@ffernand) for reporting the issue and for assistance testing fixes. (#167)

  • Fix keychain --query exit code when no pidfile exists. (#171)

  • --systemd option should now be fixed. ([#168])

  • Harden keychain so the use of the --dir and --absolute options cannot be used to instruct keychain to write pidfiles into insecure areas. (#174)

    Prior to this release, it was possible to use these options in combination with bad (empty) default umask to write pidfiles into a public area on disk where they were writable by other users. In the worst case, this could allow arbitrary execution of the contents of the malicious pidfile by keychain.

    This hardening now makes it difficult for a user to configure their keychain in a way that would allow this to happen. Note that if you are not using the --dir or --absolute options, keychain will use the $HOME/.keychain directory by default, which is typically under the full control of the current user and thus not exploitable.

    The hardening changes include:

    • Setting a global restrictive umask in the script.
    • Remove pidfiles before redirecting data to them to ensure they are created with restrictive permissions from the umask.
    • Check the keychain pidfile directory to ensure it is owned by the current user, and only the current user can access it (mode 700). If not, abort with an informative error message.
    • Check any existing pidfiles prior to use to make sure they are owned by the current user, and only the current user can access them. If not, abort with an informative error message.

    Thanks to Eisuke Kawashima (@e-kwsm) for reporting this issue, the --systemd issue, as well as for the --query fix.

keychain 2.9.2 (2 May 2025)

This is primarily a bug fix release, but also introduces the new --extended option -- see below:

  • Deprecate --confhost option and replace with --extended option. The old --confhost myhost would now be --extended host:myhost. This also allows specifying SSH keys (sshk: prefix), GPG keys ( gpgk: prefix) and hosts (host: prefix) together without confusion.
  • Well, I became intimately familiar with IFS the hard way. Fix 2.9.1 bug #159 by reworking IFS settings and adding proper documentation to the right places. This fixes the --timeout option and also now allows --stop to work properly which was broken.
  • Improve --agents deprecation warning.
  • Have keychain properly adopt a currently-running gpg-agent providing ssh-agent functionality when --ssh-use-gpg is specified.
  • Explicitly clean up known-bad pidfiles during processing.
  • Deprecate --confhost option and replace with new --extended option.
  • Improve host-based key processing by using ssh -G to officially extract host-based keys.
  • Make Makefile BSD-compatible.

keychain 2.9.1 (1 May 2025)

This release fixes a major bug related to the --eval option with non-Bourne shells.

  • Fix --eval option so it works with non-Bourne shells (#158).
  • Last-minute option change: replace --ssh-wipe and --gpg-wipe with --wipe [ssh|gpg|all].
  • Deprecate --attempts option which doesn't work with gpg-agent pinentry nor modern OpenSSH.
  • More script rewriting -- default to IFS of newline in the script, totally rework SSH and GPG key adding code.
  • Remove undocumented and likely unused -- option.
  • Script is now at a svelte 1049 lines of code.

keychain 2.9.0 (30 Apr 2025)

These release notes contain a summary of all changes, including cumulative changes in pre-releases:

  • A new release after 8 years, with Daniel Robbins (script creator) returning as maintainer.
  • 60% of the script has been rewritten, and is now compliant with ShellCheck.
  • --agents and --inherit options have been deprecated to improve ease-of-use.
  • gpg-agent no longer started by default -- only when a GPG key has been provided on the command-line. GnuPG 2.1+ supported.
  • GnuPG pidfiles with -gpg extension are deprecated and no longer used.
  • Better GnuPG integration: gpg-agent can be used for SSH key storage. This can be enabled by specifying one of the new --ssh-allow-gpg and --ssh-spawn-gpg options. Agent information for gpg-agent's SSH socket will be stored in the regular pidfile for compatibility.
  • Add --ssh-rm, --ssh-wipe, --gpg-wipe options for removing/wiping SSH and GPG keys. This addresses GitHub Issue #153.
  • --clear option is now designed to be used for "initial clearing" of keys only.
  • Many user interface output improvements, to provide additional detail.
  • --debug option which can be used to troubleshoot issues with keychain.
  • Manual page significantly improved: New section on invocation, as well as documentation of the startup and agent detection algorithm.
  • Addition of --ssh-agent-socket option to manually specify desired path of the ssh-agent socket when starting.
  • Addition of --confallhosts to load identity files for all hosts.
  • Various bug fixes and improvements.
  • Script size reduced from 1500 to 1133 lines.

keychain 2.9.0_beta4 (26 Apr 2025)

  • Rewrite key parsing code to remove unwanted use of wantagent gpg in the code. This may fix previous bugs related to identifying and loading GPG keys.
  • Fix GitHub Issue #61 by ensuring that any error messages generated when adding SSH or GPG keys are printed as warnings to facilitate troubleshooting by users.
  • Manually merge in fish shell examples into keychain.pod.
  • Resolve GitHub Issue #75 and ensure that "IdentityFile" allows case variations.

keychain 2.9.0_beta3 (25 Apr 2025)

  • The previous beta of keychain attempted to use gpg-agent by default instead of ssh-agent. This behavior has been changed so that now you must opt-in to using gpg-agent. There are two new options to allow you to do this: --ssh-allow-gpg and --ssh-spawn-gpg, which are documented in the man page.
  • Displayed information about found/started agents has been greatly enhanced.
  • New option --debug, which currently allows display of more information regarding keychain's decisions.
  • Full technical documentation for keychain's agent-detection algorithm in the man page.
  • Key decision points in keychain's internal code now have better comments.
  • Fixing behavior of --noinherit to match previous versions.
  • Fixing behavior of --quick to match previous versions.
  • Tweaking agent detection to match legacy --inherit=local-once option.
  • Many documentation updates and improvements.
  • Now at 1119 lines of code (from 1500 lines of code in keychain 2.8.5)

keychain 2.9.0_beta2 (23 Apr 2025)

  • Code has been overhauled to be more maintainable and various parts of the codebase have been rewritten. During this process, which started with 2.9.0_alpha1, various things were broken. THIS IS THE FIRST POTENTIALLY VIABLE WORKING RELEASE since 2.8.5, so PLEASE TEST AND PROVIDE FEEDBACK. It will be marked as a non-prerelease on GitHub to get more active testing and feedback.
  • Please note -- this version of keychain uses gpg-agent by default, if available. We are evaluating the consequences of this change at the moment, request feedback on complications related to this change, and THIS DECISION MAY BE REVERSED in the final release of 2.9.0 (we may go back to defaulting to ssh-agent, and have an option to use gpg-agent in place of ssh-agent, instead of just automatically using gpg-agent.) Please provide feedback in GitHub issues based on your experience. We have already found some challenges with the gpg-agent-by-default strategy, so no need to convince anyone. Just share your feedback/opinion.
  • ChangeLog has been converted to ChangeLog.md (thanks @d4g33z) to facilitate better interoperability with GitHub and modern conventions.

keychain 2.9.0_beta1 (15 Apr 2025)

  • Keychain will now detect when gpg-agent is available and has ssh-agent functionality, and use gpg-agent by default. To disable this behavior, use the '--nosub' option to disable auto-substitution of gpg-agent for ssh-agent. This implements GitHub issue #67 requested by Martin Väth.
  • Begin removal of support for gpg-agent earlier than 2.1. This release is about 9 years old at this point, and if you have a newer version of keychain on a system, it's likely you also have updated GNUPG.
  • Update of keychain project URL to point to GitHub, and minor copyright updates.

keychain 2.9.0_alpha1 (9 Apr 2025)

  • Daniel Robbins returns as keychain maintainer.
  • 'keychain' and 'keychain.1' removed from git repo and added to .gitignore.
  • Make 'keychain.sh' fully-compliant with ShellCheck, and add necessary exception comments to the codebase. These changes require testing, as some of the suggested fixes are not desired, and I tried to catch all of these. Thus the _alpha1 status.
  • Merge in typographical errors from Peter Pentchev (@ppentchev). (commit d8a566d6402a2e93ce1664cb9c7e9df3233323de)
  • Merge in validity checking for malformed SSH public key files, also from Peter Pentchev (@ppentchev). (commit 2722fdcc5d86725dd72995a83694862849494471)
  • Merge in support for --agents, which adds detection of gpg-agent which was disabled. From Mikko Koivunalho (@mikkoi). (commit 1d170da33be908c742a0840191533fe90b82db5b)
  • Merge in support for --agent-socket option, to specify the path for SSH_AUTH_SOCK manually. From Mikhail f. Shiryaev (@felixoid). (commit 2a3dfcd46e91c32a620d64035c42c8d2971c926f)
  • Fix handling of exit codes. This fix is from Manolis Androulidakis (@manolis-andr). (commit ced07855cca34664c382aaaf536e719113f9e4e4)
  • Add --confallhosts option to allow loading of keys from all hosts. This is from Ole Martin Ruud (@barskern). (commit 004107877d0258076653b291f25c1e6083fec0fb)
  • Update GPL-2 license file. This is from Karol Babioch (@ghost). (commit 15ad9e1c8d5624dd762e503c4da014bcc8ebe890)

keychain 2.8.5 (24 Jan 2018)

  • Summary: Various fixes and support systemd gnupg sockets
  • Some shells don't support local builtin (Roy Marples)
  • Support systemd managed gnupg sockets (Pedro Romano)
  • Fix some lintian warnings in the man page (Chris West)
  • Fix issues loading pem keys (Jack Twilley)

keychain 2.8.4 (19 Oct 2017)

  • Summary: Support to GPG2 (Ryan Harris)
  • Support busybox ps (Alastair Hughes)
  • Various optimizations

keychain 2.8.3 (24 Jun 2016)

  • Summary: fix gpg key addition (Clemens Kaposi)

keychain 2.8.2 (06 Nov 2015)

  • Summary: Support new ssh features, bug fix release.
  • Support for new hash algorithms (Ben Boeckel)
  • Remove bashisms (Daniel Hertz)
  • Various optimizations (Daniel Hahler)
  • --timeout option now gets passed to agent, doc fixes (Andrew Bezella, Emil Lundberg)
  • RPM, Makefile fixes (Mike Frysinger)

keychain 2.8.1 (29 May 2015)

  • Summary: POSIX compatibility and bug fix release.
  • Only set PATH to a standard value if PATH is not set. Otherwise, do not modify.
  • Makefile Cygwin and RPM spec fixes (thanks Luke Bakken and Ricardo Silva)
  • Confhost fixes. Deprecate in_path. Use command -v instead.
  • Find_pids: Modify "ps" call to work with non-GNU ps. (Bryan Drewery)
  • Re-introduce POSIX compatibility (remove shopt.) (vaeth)

keychain 2.8.0 (21 Mar 2015)

  • Support for OpenSSH 6.8 fingerprints.
  • Support for GnuPG 2.1.0.
  • Handle private keys that are symlinks, even if the associated public key is in the target directory rather than alongside the symlink.
  • Allow private keys to have extensions, such as foo.priv. When looking for matching public keys, look for foo.priv.pub, but also strip extension and look for foo.pub if foo.priv.pub doesn't exist.
  • Initial support for --list/-l option to list SSH keys.
  • Updated docs for fish shell usage.

keychain 2.7.2_beta1 (07 July 2014)

  • Various changes and updates:
  • Fixes for fish from Marc Joliet.
  • Keychain will default to start only ssh-agent unless GPG is explicitly updated using --agents.
  • Write ~/.gpg-agent-info when launching gpg-agent - fix from Thomas Spura.
  • Add support for injecting agents into systemd (Ben Boeckel)
  • Add support for --query option (Ben Boeckel)
  • Add --absolute flag, allowing user to set a full path without getting a .keychain suffix automatically appended.
  • Add --confhost option to scan ~/.ssh/config file to locate private key path specified there.

keychain 2.7.1 (07 May 2010)

  • 07 May 2010; Daniel Robbins drobbins@funtoo.org: Addition of a "make clean" target. removal of runtests as it is currently broken.
  • 07 May 2010; Daniel Robbins drobbins@funtoo.org: New release process in Makefile and release.sh - keychain release tarball will now contain pre-generated keychain, keychain.1 and keychain.spec so that users do not need to run "make". Updated README.rst to refer to the "source code" as a "release archive" since it contains both source code and ready-to-go script and man page.
  • 14 Apr 2010; Daniel Robbins drobbins@funtoo.org: GPG fix from Gentoo bug 203871; from Frederic Bathelery. This fix will fix the issue with pinentry starting in the background and not showing up in the terminal.
  • 20 Feb 2010; Daniel Robbins drobbins@funtoo.org: MacOS X documentation fix from James Turnbull.

keychain 2.7.0 (23 Oct 2009)

  • 23 Oct 2009; Daniel Robbins drobbins@funtoo.org: updated README.rst with 2.7.0 and MacOS X package update.
  • 18 Oct 2009; Daniel Robbins drobbins@funtoo.org: lockfile() replacement from Parallels Inc. OpenVZ code, takelock() rewrite, resulting in ~100 line code savings. Default lock timeout set to 5 seconds, and now keychain will try to forcefully acquire the lock if the timeout aborts, rather than simply failing and aborting.
  • 30 Sep 2009; Daniel Robbins drobbins@funtoo.org: MacOS X/BSD improvements: fix sed call in Makefile for MacOS X and presumably other *BSD environments, Rename COPYING to COPYING.txt, slight COPYING.txt formatting changes to allow license to display more cleanly from MacOS X .pkg automated install. Fixed POD errors (removed '=end').
  • 29 Sep 2009; Daniel Robbins drobbins@funtoo.org: disable "Identity added" messages when --quiet is specified (Gentoo bug #250328, thanks to Richard Laager,) --help will print output to stdout (Gentoo bug #196060, thanks to Elan Ruusamäe,) output cleanup and colorization changes - moving away from blue and over to cyan as it displays better terminals with black background. Also some additional colorization. Version bump to 2.6.10.

keychain 2.6.9 (26 Jul 2009)

  • 26 Jul 2009; Daniel Robbins drobbins@funtoo.org: Close Gentoo bug 222953 from Bernd Petrovitsch to fix potential issues with GNU grep, Mac OS X color fix when called with --eval from Aron Griffis agriffis@n01se.net, Perl 5.10 Makefile fix from Aron Griffis agriffis@n01se.net. Transition README to README.rst (reStructuredText). Updated maintainership information. Simplified default output ( --version or --help now required to show version, copyright and license information.)

keychain 2.6.8 (24 Oct 2006)

  • 24 Oct 2006; Aron Griffis agriffis@gentoo.org: Save LC_ALL for gpg invocation so that pinentry-curses works. This affected peper and kloeri, though it seems to work for me in any case.

keychain 2.6.7 (24 Oct 2006)

  • 24 Oct 2006; Aron Griffis agriffis@gentoo.org: Prevent gpg_listmissing from accidentally loading keys

keychain 2.6.6 (08 Sep 2006)

  • 08 Sep 2006; Aron Griffis agriffis@gentoo.org: Make --lockwait -1 mean forever. Previously 0 meant forever but was undocumented. Add more locking regression tests #137981

keychain 2.6.5 (08 Sep 2006)

  • 08 Sep 2006; Aron Griffis agriffis@gentoo.org: Break out of loop when empty lockfile can't be removed #127471. Add locking regression tests: 100_lock_stale 101_lock_held 102_lock_empty 103_lock_empty_cant_remove

keychain 2.6.4 (08 Sep 2006)

  • 08 Sep 2006; Aron Griffis agriffis@gentoo.org: Add validinherit function so that validity of SSH_AUTH_SOCK and friends can be validated from startagent rather than up front. The advantage is that warning messages aren't emitted unnecessarily when --inherit *-once. Fix --eval for fish, and add new testcases:
    • 053_start_with_--eval_ksh
    • 054_start_with_--eval_fish
    • 055_start_with_--eval_csh

keychain 2.6.3 (07 Sep 2006)

keychain 2.6.2 (20 Mar 2006)

  • 20 Mar 2006; Aron Griffis agriffis@gentoo.org: Add --confirm option and corresponding regression tests for Debian bug 296382. Thanks to Liyang HU for the patch. Also add initialization for $ssh_timeout which was being inherited from the environment and add regression tests for --timeout

keychain 2.6.1 (10 Oct 2005)

  • 10 Oct 2005; Aron Griffis agriffis@gentoo.org: Change unset evalopt to evalopt=false and run through all the regression tests instead of just the new ones. sigh

keychain 2.6.0 (10 Oct 2005)

  • 10 Oct 2005; Aron Griffis agriffis@gentoo.org: Add the --eval option which makes keychain startup easier. See the man-page for examples. Get rid of the release notes from README, so now this file is where changes are tracked.

keychain 2.5.5 (28 Jul 2005)

  • 28 Jul 2005; Aron Griffis agriffis@gentoo.org: Add the --env option and automatic reading of .keychain/env. This allows variables such as PATH to be overridden for peculiar environments

keychain 2.5.4.1 (11 May 2005)

  • 11 May 2005; Aron Griffis agriffis@gentoo.org: A minor bug in 2.5.4 resulted in always exiting with non-zero status. Change back to the correct behavior of zero for success, non-zero for failure

keychain 2.5.4 (11 May 2005)

  • 11 May 2005; Aron Griffis agriffis@gentoo.org: Fix bug 92316: If any locale variables are set, override them with LC_ALL=C. This fixes a multibyte issue with awk that could keep a running ssh-agent from being found. Fix bug 87340: Use files instead of symlinks for locking, since symlink creation is not atomic on cygwin.

keychain 2.5.3.1 (10 Mar 2005)

  • 10 Mar 2005; Aron Griffis agriffis@gentoo.org: Fix problem introduced in 2.5.3 wrt adding gpg keys to the agent. Thanks to Azarah for spotting it.

keychain 2.5.3 (09 Mar 2005)

  • 09 Mar 2005; Aron Griffis agriffis@gentoo.org: Improve handling of DISPLAY by unsetting if blank. Call gpg with --use-agent explicitly.

keychain 2.5.2 (06 Mar 2005)

  • 06 Mar 2005; Aron Griffis agriffis@gentoo.org: Fix bug 78974 "keychain errors on Big/IP (x86 BSD variant)" by refraining from using ! in conditional expressions. Fix RSA fingerprint extraction on Solaris, reported in email by Travis Fitch. Use $HOSTNAME when possible instead of calling uname -n to improve bash_profile compatibility.

keychain 2.5.1 (12 Jan 2005)

  • 12 Jan 2005; Aron Griffis agriffis@gentoo.org: Don't accidentally inherit a forwarded agent when inheritwhich=local-once. Move the --stop warning after the version splash.

keychain 2.5.0 (07 Jan 2005)

  • 07 Jan 2005; Aron Griffis agriffis@gentoo.org: Add inheritance support via --inherit. Add parameters to --stop for more control. Change the default behavior of keychain to inherit if there's no keychain agent running ("--inherit local-once"), and refrain from killing other agents unless "--stop others" is specified.

keychain 2.4.3 (17 Nov 2004)

  • 17 Nov 2004; Aron Griffis agriffis@gentoo.org: Fix bug 69879: Update findpids to work again on BSD; it has been broken since the changes in version 2.4.2. Now we use OSTYPE (bash) or uname to determine the system type and call ps appropriately.

keychain 2.4.2.1 (30 Sep 2004)

  • 30 Sep 2004; Aron Griffis agriffis@gentoo.org: Fix minor issues in the test for existing gpg keys wrt DISPLAY

keychain 2.4.2 (29 Sep 2004)

  • 29 Sep 2004; Aron Griffis agriffis@gentoo.org: Make gpg support more complete. Allow adding keys, clearing the agent, etc. Fix --quick support to work properly again; it was broken since 2.4.0. Change default --attempts to 1 since the progs ask multiple times anyway.

keychain 2.4.1 (22 Sep 2004)

  • 22 Sep 2004; Aron Griffis agriffis@gentoo.org: Fix bugs 64174 and 64178; support Sun SSH, which is really OpenSSH in disguise and a few critical outputs changed. Thanks to Nathan Bardsley for lots of help debugging on Solaris 9
  • 15 Sep 2004; Aron Griffis agriffis@gentoo.org: Fix pod2man output so it formats properly on SGI systems. Thanks to Matthew Moore for reporting the problem.

keychain 2.4.0 (09 Sep 2004)

  • 09 Sep 2004; Aron Griffis agriffis@gentoo.org: Fix bug 26970 with first pass at gpg-agent support
  • Fix Debian bug 269722; don't filter output of ssh-add
  • Fix bug reported by Marko Myllynen regarding keychain and Solaris awk's inability to process -F'[ :]'
  • Fix bug in now_seconds calculation, noticed by me.

keychain 2.3.5 (28 Jul 2004)

  • 28 Jul 2004; Aron Griffis agriffis@gentoo.org: Fix bug 58623 with patch from Daniel Westermann-Clark; don't put an extra newline in the output of listmissing
  • Generate keychain.spec from keychain.spec.in automatically so that the version can be set appropriately.

keychain 2.3.4 (24 Jul 2004)

  • 24 Jul 2004; Aron Griffis agriffis@gentoo.org: Fix bug 28599 reported by Bruno Pelaia; ignore defunct processes in ps output

keychain 2.3.3 (30 Jun 2004)

  • 30 Jun 2004; Aron Griffis agriffis@gentoo.org: Fix bug reported by Matthew S. Moore in email; escape the backticks in --help output
  • Fix bug reported by Herbie Ong in email; set pidf, cshpidf and lockf variables after parsing command-line to honor --dir setting
  • Fix bug reported by Stephan Stahl in email; make spaces in filenames work throughout keychain, even in pure Bourne shell
  • Fix operation on HP-UX with older OpenSSH by interpreting output of ssh-add as well as the error status

keychain 2.3.2 (16 Jun 2004)

  • 16 Jun 2004; Aron Griffis agriffis@gentoo.org: Fix bug 53837 (keychain needs ssh-askpass) by unsetting SSH_ASKPASS when --nogui is specified

keychain 2.3.1 (03 Jun 2004)

  • 03 Jun 2004; Aron Griffis agriffis@gentoo.org: Fix bug 52874: problems when the user is running csh

keychain 2.3.0 (14 May 2004)

keychain 2.2.2 (03 May 2004)

  • 03 May 2004; Aron Griffis agriffis@gentoo.org: Call loadagent prior to generating $HOSTNAME-csh file so that variables are set.

keychain 2.2.1 (27 Apr 2004)

  • 27 Apr 2004; Aron Griffis agriffis@gentoo.org: Find running ssh-agent processes by searching for /[s]sh-agen/ instead of /[s]sh-agent/ for the sake of Solaris, which cuts off ps -u output at 8 characters. Thanks to Clay England for reporting the problem and testing the fix.

keychain 2.2.0 (21 Apr 2004)

  • 21 Apr 2004; Aron Griffis agriffis@gentoo.org: Rewrote most of the code, organized into functions, fixed speed issues involving ps, fixed compatibility issues for various UNIXes, hopefully didn't introduce too many bugs. This version has a --quick option (for me) and a --timeout option (for carpaski).
  • Also added a Makefile and converted the man-page to pod for easier editing. See perlpod(1) for information on the format. Note that the pod is sucked into keychain and colorized when you run make.

keychain 2.0.3 (06 Apr 2003)

  • 06 Apr 2003; Seth Chandler sethbc@gentoo.org: Added keychain man page, fixed bugs with displaying colors for keychain --help. Also added a $grepopts to fix the grepping for a pid on cygwin Also added a TODO document color fix based on submission by Luke Holden email@alterself.org

keychain 2.0.2 (26 Aug 2002)

  • 26 Aug 2002; the Tru64 fix didn't work; it was being caused by "trap - foo" rather than "tail +2 -". Now really fixed.
  • 26 Aug 2002; fixed "ssh-add" call to only redirect stdin (thus enabling ssh-askpass) if ssh_askpass happens to be set; this is to work around a bug in openssh were redirecting stdin will enable ssh-askpass even if ssh_askpass isn't set, which contradicts the openssh 3.4_p1 man page. to enable ssh-askpass, keychain now requires that the ssh_askpass var be set to point to your askpass program.

keychain 2.0.1 (24 Aug 2002)

  • 24 Aug 2002; "--help" fixes; the keychain files were listed as sh-${HOSTNAME} rather than ${HOSTNAME}-sh. Now consistent with the actual program. Thanks to Christian Plessl plessl@tik.ee.ethz.ch, others for reporting this issue.
  • 24 Aug 2002; cycloon cycloon@linux-de.org: "If you add < /dev/null when adding the missingkeys via "ssh-add ${missingkeys}" (at line 454 of version 2.0) so that it reads: "ssh-add ${missingkeys} < /dev/null" then users can use program like x11-ssh-askpass in xfree to type in their passphrase. It then still works for users on shell, depending if $DISPLAY is set." Added.
  • 24 Aug 2002; A fix to calling "tail" that should fix things for Tru64 Unix; unfortunately, I have no way to test but the solution should be portable to all other flavors of systems. Thanks to Mark Scarborough Mark.Scarborough@broadwing.com for reporting the issue.
  • 24 Aug 2002; Changed around the psopts detection stuff so that "-x -u $me f" is used; this is needed on MacOS X. Thanks to Brian Bergstrand brian@classicalguitar.net, others for reporting this issue.

keychain 2.0 (17 Aug 2002)

  • 17 Aug 2002; (Many submitters): A fix for keychain when running on HP-UX 10.20.
  • 17 Aug 2002; Patrice DUMAS - DOCT dumas@centre-cired.fr: Now perform help early on to avoid unnecessary processing. Also added --dir option to allow keychain to look in an alternate location for the .keychain directory (use like this: "keychain --dir /var/foo")
  • 17 Aug 2002; Martial MICHEL martial@users.sourceforge.net: Martial also suggested moving help processing to earlier in the script. He also submitted a patch to place .ssh-agent-* files in a ~/.keychain/ directory, which makes sense particularly for NFS users so I integrated the concept into the code.
  • 17 Aug 2002; Fred Carter fred.carter@amberpoint.com: Cygwin fix to use proper "ps" options.
  • 17 Aug 2002; Adrian Howard adrianh@quietstars.com: patch so that lockfile gets removed even if --noask is specified.
  • 17 Aug 2002; Mario Wolff wolff@voll.prima.de: Replaced an awk dependency with a shell construct for improved performance.
  • 17 Aug 2002; Marcus Stoegbauer marcus@grmpf.org, Dmitry Frolov frolov@riss-telecom.ru: I (Daniel Robbins) solved problems reported by Marcus and Dmitry (mis-parsed command line issues) by following Dmitry's good suggestion of performing argument parsing all at once at the top of the script.
  • 17 Aug 2002; Brian W. Curry truth@bcurry.cjb.net: Added commercial SSH2 client support; improved output readability by initializing myfail=0; integrated Cygwin support into the main keychain script; improved Cygwin support by setting "trap" appropriately. Thanks Brian!

keychain 1.9 (04 Mar 2002)

  • 04 Mar 2002; changed license from "GPL, v2 or later" to "GPL v2".
  • 04 Mar 2002; added "keychain.cygwin" for Cygwin systems. It may be time to follow this pattern and start building separate, optimized scripts for each platform so they don't get too sluggish. Maybe I could use a C preprocessor for this.
  • 06 Dec 2001; several people: Solaris doesn't like '-e' comparisons; switched to '-f'

keychain 1.8 (29 Nov 2001)

  • 29 Nov 2001; Philip Hallstrom (philip@adhesivemedia.com) Added a "--local" option for removing the ${HOSTNAME} from the various files that keychain creates. Handy for non-NFS users.
  • 29 Nov 2001; Aron Griffis (agriffis@gentoo.org) Using the Bourne shell "type" builtin rather than using the external "which" command. Should make things a lot more robust and slightly faster.
  • 09 Nov 2001; Mike Briseno (mike@radik.com) Solaris' "which" command outputs "no lockfile in..." to stdout rather than stderr. A one-line fix (test the error condition) has been applied.
  • 09 Nov 2001; lockfile settings tweak
  • 09 Nov 2001; Rewrote how keychain detects failed passphrase attempts. If you stop making progress providing valid passphrases, it's three strikes and you're out.
  • 09 Nov 2001; Constantine P. Sapuntzakis (csapuntz@stanford.edu) Some private keys can't be "ssh-keygen -l -f"'d; this patch causes keychain to look for the corresponding public key if the private key doesn't work. Thanks Constantine!
  • 09 Nov 2001; Victor Leitman (vleitman@yahoo.com) CYAN color misdefined; fixed.
  • 27 Oct 2001; Brian Wellington (bwelling@xbill.org) A "quiet mode" (--quiet) fix; I missed an "echo".
  • 27 Oct 2001; J.A. Neitzel (jan@belvento.org) Missed another "kill -9"; it's now gone.

keychain 1.7 (21 Oct 2001)

  • 21 Oct 2001; Frederic Gobry (frederic.gobry@smartdata.ch) Frederic suggested using procmail's lockfile to serialize the execution of critical parts of keychain, thus avoiding multiple ssh-agent processes being started if you happen to have multiple xterms open automatically when you log in. Initially, I didn't think I could add this, since systems may not have the lockfile command; however, keychain will now auto-detect whether lockfile is installed; if it is, keychain will automatically use it, thus preventing multiple ssh-agent processes from being spawned.
  • 21 Oct 2001; Raymond Wu (ursus@usa.net): --nocolor test is no longer inside the test for whether "echo -e" works. According to Raymond, this works optimally on his Solaris box.
  • 21 Oct 2001; J.A. Neitzel (jan@belvento.org): No longer "kill -9" our ssh-agent processes. SIGTERM should be sufficient and will allow ssh-agent to clean up after itself (this reverses a previously-applied patch).
  • 21 Oct 2001; Thomas Finneid (tfinneid@online.no): Added argument "--quiet | -q" to make the program less intrusive to the user; with it, only error and interactive messages will appear.
  • 21 Oct 2001; Thomas Finneid (tfinneid@online.no): Changed the format of some arguments to bring them more in line with common *nix programs: added "-h" as alias for "--help"; added "-k" as alias for "--stop"
  • 21 Oct 2001; Mark Stosberg (mark@summersault.com): $pidf to "$pidf" fixes to allow keychain to work with paths that include spaces (for Darwin and MacOS X in particular).
  • 21 Oct 2001; Jonathan Wakely (redi@redi.uklinux.net): Small patch to convert "echo -n -e" to "echo -e "\c"" for FreeBSD compatibility.

keychain 1.6 (15 Oct 2001)

  • 13 Oct 2001; Ralf Horstmann (ralf.horstmann@webwasher.com): Add /usr/ucb to path for Solaris systems.
  • 11 Oct 2001; Idea from Joe Reid (jreid@vnet.net): Try to add multiple keys using ssh-add; avoid typing in identical passphrases more than once. Good idea!

keychain 1.5 (21 Sep 2001)

  • 21 Sep 2001; David Hull (hull@paracel.com): misc. compatibility, signal handling, cleanup fixes
  • 21 Sep 2001; "ps" test to find the right one for your OS.
  • 20 Sep 2001; Marko Myllynen (myllynen@lut.fi): "grep [s]sh-agent" to "grep [s]sh-agent" (zsh fix)

keychain 1.4 (20 Sep 2001)

  • 20 Sep 2001; David Hull (hull@paracel.com): "touch $foo" to ">$foo" optimization and other "don't fork" fixes. Converted ${foo#--} to a case statement for Solaris sh compatibility.
  • 20 Sep 2001; Try an alternate "ps" syntax if our default one fails. This should give us Solaris and IRIX (sysV) compatibility without breaking BSD.
  • 20 Sep 2001; Hans Peter Verne (h.p.verne@usit.uio.no); "echo -e" to "echo $E" (for IRIX compatibility with --nocolor), optimization of grep ("grep [s]sh-agent")
  • 17 Sep 2001; Marko Myllynen (myllynen@lut.fi): Various fixes: trap signal 2 if signal INT not supported (NetBSD); handle invalid keys correctly; ancient version of ash didn't support ~, so using $HOME; correct zsh instruction; minor cleanups

keychain 1.3 (12 Sep 2001)

  • 12 Sep 2001; Minor color changes; the cyan was hard to read on xterm-colored terms so it was switched to bold. Additional --help text added.
  • 10 Sep 2001; We now use .ssh-agent-[hostname] instead of .ssh-agent. We now create a .ssh-agent-csh-[hostname] file that can be sourced by csh-compatible shells. We also now kill all our existing ssh-agent processes before starting a new one.
  • 10 Sep 2001; Robert R. Wal (rrw@hell.pl): Very nice NFS fixes, colorization fixes, tcsh redirect -> grep -v fix. Thanks go out to others who sent me similar patches.
  • 10 Sep 2001; Johann Visagie (johann@egenetics.com): "source" to "." shell-compatibility fixes. Thanks for the FreeBSD port.
  • 10 Sep 2001; Marko Myllynen (myllynen@lut.fi): rm -f $pidf after stopping ssh-agent fix

keychain 1.2 (09 Sep 2001)

  • 09 Sep 2001; README updates to reflect new changes.
  • 09 Sep 2001; Marko Myllynen (myllynen@lut.fi): bash 1/zsh/sh compatibility; now only tries to kill your ssh-agent processes, version fix, .ssh-agent file creation error detection. Thanks!

keychain 1.1 (07 Sep 2001)

  • 07 Sep 2001; Addition of README stating that keychain requires bash 2.0 or greater, as well as quick install directions and web URL.
  • 07 Sep 2001; Explicitly added /sbin and /usr/sbin to path, and then called "pidof". I think that this is a bit more robust.
  • 06 Sep 2001; from John Ellson (ellson@lucent.com): "pidof" changed to "/sbin/pidof", since it's probably not in $PATH
  • 06 Sep 2001; New ChangeLog! :)

keychain 1.0 (Aug 2001)

  • initial release