otpclient-5.1.7-1.2e>UA?,X_$ ?jrۆeo1bn?U(KpNz ZxuAW@_s+s>>?d   D&E Vl  ( h  X$ ( 8 '9 `':'FGH ILX\Yt\]^: b^cdoetfyl~uv wtxy<z@DCotpclient5.1.71.2Simple GTK+ client for managing TOTP and HOTPHighly secure and easy to use GTK+ software for two-factor authentication that supports both Time-based One-time Passwords (TOTP) and HMAC-Based One-Time Passwords (HOTP).jrۆreproducibleLGNOME:Apps / openSUSE_Factoryobs://build.opensuse.org/GNOMEGPL-3.0-or-laterProductivity/Securityhttps://github.com/paolostivanin/otpclientlinuxppc64le h(M C큤A큤A큤A큤jrۆjrۆjrۆjqqjrۆjqqjqqjqqjqqjrۆjqqjqqjqqjqqjrۆjqq60b92dd31c0630f2760b96a0112a6bbfa63e0baea6837231b2b14c2c7aa604ee90ac809d6bfef83b9034e35ab0f34d6f43550f138f1ba4b1d72eda179ae3b325e1032dd9bcb45f3d1849511ff500604a9d49b2522182adcdfa71243d0aa68ab58bbca232d3d177bb199abf86792a8818d65e516cfc6a17a3f9847b74935a9c8ea1e662fe891e053cdfef702e415af55e0d6033f01489f03226a021077bd937d3ad40ae3e7d545cd95473c1422a52d18b6dd5c53f0a343ab8cbea7f89a3bf02165c2c2f8ecd45d99d5ef900589f8159e7abcedbe480e81aeb3e079df908c9d627e7a09f83be5f1b49685c4541bda3b909184ecda0cc1346c1b7a0eedbc2917fd73972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb3698623532a70a49dad2deeb3805e847788bd02a8baadeef969fdddbe400fdc7d61b850a65a6fb72fa5c054e7dfb88b3a4096e08c50a427897da6fdcb23b56acd3125533f784675eb445412d62a0c89aea1cbf1263a60fc4e90eb4c401d46992a1d04aa6c57707199085ee16d2f7ac36da1f4a8afacab04be53e690764fb0ea747568rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootroototpclient-5.1.7-1.2.src.rpmapplication()application(com.github.paolostivanin.OTPClient.desktop)metainfo()metainfo(com.github.paolostivanin.OTPClient.appdata.xml)otpclientotpclient(ppc-64)@@@@@@@@@@@@@@@@@@@@@@@@@@    libadwaita-1.so.0()(64bit)libadwaita-1.so.0(LIBADWAITA_1_0)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.25)(64bit)libc.so.6(GLIBC_2.32)(64bit)libc.so.6(GLIBC_2.33)(64bit)libc.so.6(GLIBC_2.34)(64bit)libcotp.so.4()(64bit)libgcrypt.so.20()(64bit)libgcrypt.so.20(GCRYPT_1.6)(64bit)libgdk_pixbuf-2.0.so.0()(64bit)libgio-2.0.so.0()(64bit)libglib-2.0.so.0()(64bit)libgobject-2.0.so.0()(64bit)libgtk-4.so.1()(64bit)libjansson.so.4()(64bit)libjansson.so.4(libjansson.so.4)(64bit)libprotobuf-c.so.1()(64bit)libprotobuf-c.so.1(LIBPROTOBUF_C_1.0.0)(64bit)libprotobuf-c.so.1(LIBPROTOBUF_C_1.3.0)(64bit)libqrencode.so.4()(64bit)libsecret-1.so.0()(64bit)libuuid.so.1()(64bit)libuuid.so.1(UUID_1.0)(64bit)libzbar.so.0()(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsZstd)3.0.4-14.6.0-14.0-15.4.18-14.20.1js%jb@j^ jPjO@jN;jCj=@j.@jj j@jgi@i@ifiiiO@h@faf'@f~eee @e@e@ee@epeDe9@d@ddp@dd@c1cGPaolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Pablo Herranz Ramírez Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin Paolo Stivanin - Update to 5.1.7: * FIX: with minimize-to-tray enabled on a desktop that has no system tray (stock GNOME without the AppIndicator extension, i3bar, polybar), closing the window hid it with no icon to restore it, leaving an invisible process holding a decrypted database that only killall could stop. The window is now hidden only once a tray host has accepted the icon, and if the tray disappears while the window is hidden the window comes back (#405)- Update to 5.1.6: * FIX: with Auto-Lock enabled but the timeout left at its default, the database re-locked roughly five seconds after each unlock. The idle timer counts seconds, but the default was 5 and documented as minutes; it is now 300 seconds (five minutes), so profiles that never set a timeout pick up a sane value automatically (#467) * FIX: the unlock prompt could not be dismissed and closing it quit the whole application, so Settings could not be reached while locked. Dismissing it (Escape, the dialog close button, clicking outside, or the window close button) now drops to the locked screen and keeps the toolbar reachable; the toolbar lock button doubles as an unlock button while locked, and an explicit Quit button remains on the prompt (#467)- Update to 5.1.5: * FIX: a database stored on a filesystem without lock support (the Flatpak document portal, and some NFS/SMB mounts) could not be opened or created, failing with Failed to acquire database lock: Function not implemented. Locking is now best- effort, so the database opens normally on those filesystems, while real locking is unchanged everywhere else (#466) * FIX: the secure-memory pool reserved the whole RLIMIT_MEMLOCK budget, so the GTK password entry could not lock its own buffer and warned couldn't lock 16384 bytes of memory (gtk): Cannot allocate memory, falling back to unlocked memory for the typed password on every unlock. The pool now leaves headroom for it (Debian #1141809)- Update to 5.1.4: * FIX: a database containing a token with an out-of-range digit count or period refused to open, locking you out of all of your tokens. The accepted ranges now match the OTP engine exactly (digits 4 to 10, period 1 to 120 seconds), so such tokens load again. Any token the engine still cannot use (out-of-range value, invalid secret, unsupported algorithm) is set aside and preserved in the database rather than blocking the whole load (#464, follow-up to #458/#462) * FIX: right-click context menus on tokens and databases were clipped to the scrolled area and needed scrolling to reach lower items such as "Set Group"; they now size to their contents (#465)- Update to 5.1.3: * FIX: a database (or import) containing a token with neither an account name nor an issuer refused to open on 5.1.x with "Token N has neither a label nor an issuer", locking you out of all of your tokens. Such tokens now load with a synthesized Unknown N placeholder label instead of being rejected, so the database opens and the token stays usable and editable. Interactive manual entry and editing still require a name (#462, follow-up to #458)- Update to 5.1.2: * FIX: screensaver, session lock, and suspend now respect the Auto- Lock setting. With Auto-Lock off, the app no longer locks the database on every screen lock and then leaves you behind a manual password prompt. The mutual exclusivity between Auto-Lock and Secret Service is also restored, enabling one greys out the other, and a legacy profile with both enabled is reconciled on startup (#460, re-report of #279)- Update to 5.1.1: * FIX: databases containing a token with an issuer but no account name (for example some ProtonMail or Steam entries) refused to open on 5.1.0 with "Could not open database: Token has a missing label", locking you out of the entire database. A token is now valid as long as it has either an account name or an issuer; the same rule applies to imports and manual token entry (#458)- Update to 5.1.0: * BREAKING: After upgrading to 5.1.0, older OTPClient releases will NOT be able to open v3 databases, so keep a backup before upgrading if you may need to downgrade * NEW: webcam QR scanning runs on a worker thread, no more main- thread freeze while the camera initializes or while frames are decoded * NEW: you can quit OTPClient while the database is locked (#456) * NEW: the app locks automatically when the system suspends (via logind PrepareForSleep), so the database is never left decrypted across sleep * IMPROVEMENT: database file format bumped to v3 with a portable, byte-addressable big-endian header. v1 and v2 databases are read transparently and upgraded to v3 on first successful open/unlock. Older OTPClient releases cannot open v3 databases, so keep a backup before upgrading if you may need to downgrade * IMPROVEMENT: cross-process write serialization via a bounded- wait .lock sidecar, prevents two OTPClient instances from clobbering each other on save * IMPROVEMENT: search-filter cache, large token lists filter without re-walking the model on every keystroke * IMPROVEMENT: changing the password now requires verifying the current one before the change is applied * IMPROVEMENT: CLI plain imports dispatch by file type automatically, no longer prompt for a password on unencrypted formats * IMPROVEMENT: Google Authenticator migration import was rewritten with bounded payload/token/batch limits and now reports multi-batch progress, across the file, screen, and webcam paths * SECURITY: locking wipes the decrypted database and master key from memory; unlocking re-derives the key instead of comparing a copy held in RAM * SECURITY: generated codes, notification text, clipboard contents, and per-token values are wiped after use, and live codes are kept in libgcrypt secure memory * SECURITY: search-provider activation IDs are now random 128-bit capability tokens with a 30-second TTL and single-use enforcement, replacing the predictable db_index:json_index scheme * SECURITY: HOTP entries are excluded from the search provider at load time, advancing a counter from a desktop search result is too easy to do by accident * SECURITY: transient password buffers are wiped after use across the GUI and CLI, including on password-dialog cancel and dispose * SECURITY: search-provider derived-key cache + rate limit on OTP delivery, using a single global rate bucket (no per-connection bypass) and an idle-wipe timer for keys and caches * SECURITY: 2FAS encrypted import now surfaces decryption errors instead of silently swallowing them * SECURITY: broad correctness and hardening pass across src/ (core, GUI, importers, CLI), including a parse-uri double-error fix, an authpro stream check, a bytes_to_hexstr overflow guard, and NULL-checked secure-memory allocations * SECURITY: tightened Argon2id parameter bounds (MAX_ITER 100 -> 64, MAX_MC 4 GiB -> 1 GiB, MAX_PARAL 64 -> 16) to reject pathological configurations * FIX: v2 databases were misread as a far-future format version and refused to open; both v2 and v3 headers are now read correctly * FIX: the window no longer gets stuck on the "Unlocking..." page when a database fails to load for a reason other than a missing file or wrong password; it drops back to the no-database view so you can retry * FIX: the desktop search provider copies the OTP to the clipboard asynchronously on KDE; the synchronous Klipper D-Bus call could block every activation for up to a second when Klipper did not reply in time, delaying the copy and the notification * FIX: CLI HOTP counter is now persisted before the code is printed, the counter upper bound is exclusive everywhere, the terminal is restored on interrupt, and CR/LF is stripped from piped input * FIX: memory leaks in DB and OTP handling paths * FIX: freeotp importer secmem budget and GError-overwrite bug that also affected other importers * FIX: in-memory database state is now restored if an encrypt-on- save fails, instead of being left half-mutated * FIX: debianStable CI build and the JPEG sanitizers test- Update to 5.0.6: Fixes * FIX: unlock dialog re-prompting forever with the correct password. A wrong-password attempt was poisoning the in-memory key cache, so even the correct password kept being rejected until the app was restarted (#448) * FIX: auto-unlock via the system keyring stopped working after upgrading from 4.x. On first launch, OTPClient now picks up the old keyring entry, uses it to unlock, and re-saves it under the new format so it keeps working (#448) * FIX: Backup and Restore buttons in Settings did nothing on Ubuntu 24.04, Pop!_OS 24.04, Linux Mint 22.3, and other distros shipping libadwaita 1.5 (#449) * FIX: a revealed OTP could fall out of sync with the clipboard near the end of a 30-second window, leaving you unsure which code you actually pasted. Reveal now ends cleanly when the code rotates, and the clipboard rolls to the new code if "Show next OTP" is on (#450) * FIX: "Hide OTPs by default" only took effect after restarting the app. Toggling it now updates the visible list immediately (#450) * FIX: re-clicking an already-selected token did nothing, so it could not be copied or advance the HOTP counter a second time. Re-clicks now re-trigger the copy and counter-advance action (#451) * FIX: window close/minimize/maximize buttons were forced to the right side, ignoring the system setting. They now follow the desktop's decoration layout, e.g. left-side buttons on macOS- style KDE setups (#452) * FIX: switching to a different database (sidebar click, Open DB, or New DB) while an unlock was still in progress could corrupt memory. The app now shows a toast and waits for the unlock to finish Improvements * Saving the database after a fresh unlock is noticeably faster. The password-derivation result is now cached on save just like on unlock, so the first save no longer re-runs the slow key derivation- Update to 5.0.5: * Welcome dialog Back/Next/page-indicator row got pushed below the visible area when an AdwStatusPage's natural height exceeded the dialog's content area (#441). The nav row lived inside the same GtkBox as the stack; now pinned via AdwToolbarView's bottom bar so it stays visible while the status page's internal scroll handles long descriptions. Dialog also bumped from 500×420 to 560×560. * Keyboard focus did not land on the token list after unlock (#445). 5.x was leaving focus on whatever widget the stack last rendered, so Up/Down/Enter required a mouse click into the list first. Restored the 4.x default of focusing the token list after unlock, and extended the same idea to the empty and no-database pages so the obvious next action (add the first token / create the first database) is one keystroke away. Focus only moves on page transitions, so search-bar typing and in-page item changes don't get stolen. * Per-launch loop when the registered Secret Service is unavailable (#446). On Kubuntu/KDE Plasma with KWallet disabled (but still owning the org.freedesktop.secrets D-Bus name), libsecret has no way to fall back to gnome-keyring — that has to be configured at the session layer. The previous behavior looped: every launch did a failing lookup, prompted for the password, then a failing store fired a notification. Now the "Use Secret Service" toggle pre- flights the keyring with a sync store/lookup/verify/clear round- trip when you enable it; if the round-trip fails the switch reverts and you get a dialog with the libsecret error. If the keyring breaks after the setting was already enabled, the first failed lookup or store flips the setting OFF, surfaces one notification, and falls through to the password dialog so you can still unlock. CLI and search-provider also fall through gracefully without mutating GSettings (avoids races with the GUI session). * Lock bypass via unlock dialog dismissal (#447). The token list was still rendered and on_otp_selection_changed was unguarded, so a click would copy the OTP; the right-click "Show QR" action also remained enabled and would render the secret. Defense in depth: password dialog set non-dismissable for DECRYPT, new locked page in content_stack hides the token list while locked, lock_app_lock() wipes cached OTP values via otpclient_window_clear_displayed_otps(), set_db_actions_enabled() expanded from 5 to 18 actions gating every token-touching path including show-qr. Lock guards added in on_otp_selection_changed, on_drag_prepare, and on_token_right_click. A closed-signal handler re-presents the dialog if it ever slips closed while still locked.- Update to 5.0.3: * Startup crash gdk_display_manager_get() was called before gtk_init() when use-dark-theme is enabled on environments without a portal-reported color scheme (#440). The dark-theme preference was being applied before AdwApplication's startup chain ran, so adw_style_manager_get_default() reached into an uninitialized GDK display and aborted. Now applied after chaining up to the parent startup().- Update to 5.0.2: * NEW: Add → Scan QR from Clipboard (#438). Reads a GdkTexture from the focused display's clipboard, downloads it to RGBA, converts to grayscale, and decodes via zbar. * FIX: Scanning a QR that does not encode an otpauth:// URI now surfaces a toast instead of silently doing nothing. Applies to file and webcam scans too, not just the new clipboard path.- Update to 5.0.1: * QR import (file picker and webcam) no longer duplicates pre- existing tokens (#435). Root cause: data_to_add was not cleared after update_db, so subsequent imports re-merged the entire list. * Set Group / Remove from Group / New Group act on the right token when a group filter or column sort is active (#437). * Token actions — delete, edit, show QR, move to database, HOTP increment — act on the right token when a filter or column sort is active. Same root cause as #437: bare selection position was used as a JSON index, ignoring the filter+sort offset. * Clicking a database row in the sidebar now actually loads that database (#436). The selection callback was an empty stub left over from the AdwOverlaySplitView refactor. * The sidebar now distinguishes the default database (loaded on startup, marked with a star) from the currently open database (shown in bold). * Creating or opening an additional database no longer overrides which one loads on startup — that's now controlled exclusively by right-click → Set as Primary. Previously, every new or opened database silently became the default. * Set as Primary now persists across restarts. The startup sidebar repopulation was clobbering the saved choice with whichever database happened to be added to the list first.- Update to 5.0.0: First stable release of the GTK4 / libadwaita rewrite, with multi-database support, token grouping, an opt-in trigger keyword for the desktop search provider, and a sweeping crypto and import-path hardening pass. Existing v2 databases unlock and migrate automatically. Features * Complete GUI rewrite on GTK4 + libadwaita. * Persistent multi-database support with sidebar and right-click "Move to..." between databases. * Token grouping with header-bar dropdown and "group:" / "#" search prefix; groups round-trip through Aegis, AuthPro and 2FAS. * Cross-database search with auto-select-and-copy on a single result. * Hidden-by-default OTPs with click-to-reveal and auto-hide. * Async unlock with KDF spinner. * Search-provider trigger keyword (default "otp"); KRunner subtitle no longer leaks live codes; activation copies the OTP. * Settings -> Backup is the unified entry point for native (encrypted) backup and restore; format-specific export becomes migration-only with a plaintext warning. * Settings import/export, Welcome and What's New dialogs, KDF presets, paste-to-fill otpauth:// URI, backup-age banner, lock-time clipboard wipe. * Scriptable CLI output (--output=table|json|csv), translated CLI strings, --list-databases, HOTP counter in CSV, bash/zsh/fish completions. * Native StatusNotifierItem tray (libayatana-appindicator dependency removed). Security * Argon2id header validation refuses out-of-bounds parameters on unlock. * KDF byte-length fix: gcry_kdf_* was passed character count instead of byte count, weakening keys for non-ASCII passwords; transparent retry plus opportunistic re-encryption on the next write. * O_NOFOLLOW + fstat S_ISREG on every importer and database read site, closing the symlink-swap TOCTOU window. * 0600 mode on backup files; PR_SET_DUMPABLE=0 + RLIMIT_CORE=0 to suppress core dumps. * AEAD validation tightened across decrypt paths; 2FAS no longer accepts plaintext on tag mismatch. * Search provider refuses every D-Bus method when the keyword is empty (closes arbitrary local enumeration of accounts). * otpauth:// URI capped at 4 KB, HOTP counter capped at 2^48, PNG QR capped at 4096x4096, settings import capped at 1 MiB. * Signal-safe clipboard wipe on SIGINT/SIGTERM/SIGHUP; CLI --password-file refuses group/world-readable files; secret service disabled by default. * HOTP counter increment is transactional (rolled back if save fails). Fixes * NULL-deref crashes across Aegis, AuthPro, 2FAS, FreeOTP+ and otpauth importers on malformed input. * Use-after-free in async secret lookup; double-free of filter_model in window dispose; DBus assertion on exit. * Notification spam during store rebuilds and search-bar close. * Window size and group dropdown restored across sessions; schema and icon cache updated on install. Performance * KDF-derived key cache, lazy cross-DB OTP, deferred HOTP writes, pre-folded labels in search provider. Breaking * GTK 4.18+ and libadwaita 1.5+ required; configuration migrated to GSettings (GKeyFile not migrated automatically).- Update to 4.5.0: Features * Search-provider trigger keyword (default otp): only desktop search queries whose first whitespace-separated token equals the keyword surface OTP results, so they're no longer drowned under file/app/web runner output. Configurable in Settings → Integration. Empty keyword falls back to legacy unfiltered behaviour. Daemon restart required after a change. Security * KRunner Match subtitle no longer leaks the live OTP code. Any process on the session bus could previously poll Match and read codes without user action; the code is still delivered via the Run notification. * Argon2id header validation: refuse v2 databases whose iter / memcost / parallelism fall outside safe ARGON2ID_MIN/MAX_* bounds (would otherwise enable memory-exhaustion or KDF-weakening DoS on unlock). * Core-dump suppression: prctl(PR_SET_DUMPABLE,0) + RLIMIT_CORE=0 in init_libs() so a crash with secrets in memory cannot leak them to disk. * KDF byte-length fix: gcry_kdf_* was being passed g_utf8_strlen (character count) instead of byte count, weakening keys for non-ASCII passwords. Fixed in db-common.c, common.c (AuthPro), aegis.c, twofas.c, and freeotp.c. Existing v2 databases unlock via a transparent retry path and are silently re-encrypted with the corrected length on the next write. * O_NOFOLLOW everywhere: new path_open_safe_regular_file() helper (open(O_RDONLY | O_NOFOLLOW | O_CLOEXEC) + fstat S_ISREG check) applied to all importers (Aegis, AuthPro, 2FAS, FreeOTP+) and to both database read sites. Subsequent reads run through /proc/self/fd/ so the inode stays bound across the whole operation, closing the symlink-swap TOCTOU window. * chmod 0600 on database backups so a permissive umask cannot leave .bak files group/world-readable. * otpauth:// URI length capped at 4 KB to prevent multi- gigabyte allocations from malformed input. * CLI hard-refuses --password-file with group/world-readable permissions instead of merely warning; recommends chmod 600. * GUI clears the system clipboard on SIGINT / SIGTERM / SIGHUP via g_unix_signal_add and at shutdown. Fixes * 2FAS importer: NULL-deref crashes on missing servicesEncrypted, malformed colon-separated payload, and under-sized AEAD ciphertext; secure-buffer leaks on decrypt and tag-check failure; silent acceptance of unauthenticated plaintext on tag mismatch (now properly rejected). * 2FAS exporter: NULL-deref on missing algo / type fields. * Aegis importer: NULL-deref when header.slots is missing or the password slot lacks key_params. * FreeOTP+ exporter: unconditional g_object_unref(NULL) after a failed g_file_replace; correct byte length passed to write. * AuthPro importer: leaked GFile / GFileInputStream on the plain-backup path (no password).- Update to 4.4.2: * Allow click to copy when searching via desktop provider- Update to 4.4.1: New Features * Add cross-desktop search provider for GNOME Shell and KDE Plasma 6 (KRunner). OTP codes are displayed directly in search results and copied via system notification on activation. Can be toggled in settings. * Add --password-file CLI option to read the password from an external file instead of stdin (thanks @kouta-kun) Security * Harden CLI password input: use read() with gcry_calloc_secure instead of fgets() to prevent password remnants in libc internal buffers. Disable all terminal echo modes and restore state via TCSAFLUSH. * Fix under-allocation of secure password buffer for multibyte UTF-8 passwords (g_utf8_strlen returns character count, not byte count) Bug Fixes * Fix copy-paste bug in Authenticator Pro export: "issuer" key was read instead of "label" when building the Username field * Fix secure-memory leak in get_otpauth_data: g_file_get_contents overwrote a gcrypt secure-buffer pointer with non-secure memory * Fix g_utf8_strdown() memory leak in URI parsing * Fix silent guint8 truncation of period/digits values; now validated with range checks * Add missing g_set_error() on five error paths in Aegis encrypted backup import * Fix salt and key_nonce leak on kdf_derive failure in Aegis export * NULL-guard json_string_value() results across URI parsing, Authenticator Pro, and Aegis modules * Unify hash type to guint32 in database layer (was mixing guint/guint32, potential issue on ILP64 platforms) * Remove duplicate json_object_set() for "secret" key in build_json_obj * Replace VLA stack buffers (salt, iv, tag) with heap allocations in get_data_from_encrypted_backup * Fix search provider: add missing gcrypt initialization, fix memory leaks, eliminate redundant Argon2id+AES256-GCM cycle in result activation * Improve --password-file error handling and terminal detection * Fixed Ctrl+F search not working due to premature key controller destruction. * Fixed GTK-CRITICAL assertions on close caused by accessing the tree view after widget destruction. Refactoring * Modernise application and window layer to GTK idioms: G_DECLARE_FINAL_TYPE, GtkEventControllerKey, configure-event for window-size tracking, proper dispose() for builder ownership * Split monolithic activate() into resolve_db_path(), load_db_with_password(), setup_ui_and_timers() * Extract config-misc.c/h utility module from window code- Update to 4.3.1: * Made countdown colors configurable. * Added support for selecting the countdown display type (numeric value or cake-style). * Wired the validity countdown switch to disable color pickers when “show countdown as seconds” is enabled, and stored those widgets in the settings state for reuse in callbacks. * Added a dedicated handler to update color picker sensitivity whenever the display mode switch changes (including on dialog initialization). * Added persistence for tree view column widths by loading saved widths on startup and saving current widths to the configuration on shutdown. * Renamed the “OTP Value” column header to “OTP” and tagged columns with IDs to support width tracking. * Added polished empty-state screens with direct call-to-action buttons. * Improved consistency and clarity across menus, headers, and dialogs. * Enhanced OTP list readability with resizable columns, ellipsized labels, and monospace formatting. * Replaced the validity text column with a progress bar showing remaining TOTP time. * Switched visual indicators from bar-based to filled pie charts for clearer status at a glance. * Improved CLI usability and feedback. * Refactored the codebase to follow proper GTK coding patterns and lifecycle management. * Removed obsolete option-migration logic. * Added an explicit shutdown event. * Hardened shutdown cleanup to safely handle partially initialized components, avoiding GTK critical warnings while still persisting window state when possible.- Update to 4.2.0: * ADDED: interactive search (ctrl-f) * IMPROVED: search now matches query against type, account label, and issuer uniformly * IMPROVED: Streamlined treeview model population to read JSON directly with safe defaults * IMPROVED: Simplified OTP update flow and tightened reorder/delete safety and cleanup * IMPROVED: Centralized app/db default initialization and early cleanup paths in app.c * IMPROVED: Tightened error handling by clearing config migration errors and freeing the config path * IMPROVED: Made early-exit cleanup safer by avoiding double-freeing the database key * IMPROVED: Added a helper to clear password entries and reset visibility on successful submit * IMPROVED: Cleared old/new password fields before the dialog closes to avoid brief exposure * IMPROVED: Initialized settings defaults when the config load fails and persisted them to otpclient.cfg * IMPROVED: Added warning dialog only when saving fallback defaults fails * IMPROVED: cli: improve robustness and correctness in string and file handling * FIXED: duplicate windows and tray icons on re-activation (#409)- Update to 4.1.0: * ADDED: minimize to tray with ayatana-appindicator3 (#386 thanks a lot @len-foss) * IMPROVED: only show memlock warning dialog when secure memory is unavailable (#397) * IMPROVED: allow creating a database via CLI (#392) * FIX: allow using different databases in flatpak (#372) * CHANGED: dropped andOTP support- Update to 4.0.2: * FIX: importing data on a first run (#376) * FIX: better error handling * IMPROVED: handling of memlock when too low- Update to 4.0.1: * CHANGE: switch from PBKDF2 to Argon2id (#358). This change is completely transparent to the end user, therefore no action is required. * NEW: make Argon2id parameters configurable (#358) * NEW: add support for importing plain Aegis txt * FIX: various issues related to importing Aegis backups (#371) * FIX: improving handling of json files (#369) * FIX: parsing QR codes (#374) * FIX: show db parameters dynamically * FIX: add missing ui file to CMakeLists.txt- Update to 3.7.0: * CHANGE: deleting a row, editing a row and showing the qr code is now done via right click on the target row (#359). * FIX: multiple fixes to QR handling (#364). * FIX: exporting to FreeOTP+ format (#367). * FIX: updated otpclient and otpclient-cli man pages (thanks @fvcr). * FIX: code more readable thanks to macros.- Update to 3.6.0: * NEW: add possibility to import plain/encrypted backups using the CLI. * FIX: make GUI and CLI independent, so that CLI only can be built and installed without GTK being present. * FIX: check file size against memlock before importing a backup. * FIX: code cleanup and internal refactoring.- Update to 3.5.2: * NEW: add possibility to export plain/encrypted Authenticator Pro/2FAS backups using the CLI. * FIX: improve popover layout. * FIX: exporting plaing Aegis via CLI. * FIX: cleanup code.- Update to 3.5.1: * NEW: add back buttons to the various popover menus * FIX: split popovers into their own UI files * FIX: remove upgrade message when upgrading from a version older than 2.6.0- Update to 3.5.0: * NEW: add support for importing and exporting plain/encrypted 2FAS backups (#322) * NEW: add support for importing and exporting plain/encrypted AuthenticatorPro backups (#322) * CHANGE: show warning when exporting a plain backup * CHANGE: remove support for older Glib and GCrypt * FIX: add 2fa keyword to the desktop file (#349) * FIX: remove custom keywords from metadata file (#348) * FIX: returning to a dialog won't crash the widget- Update to 3.4.1: * FIX: FreeOTP+ export (thanks @hubnut)- Update to 3.4.0: * NEW: CLI was completely refactored, and the options have changed. Be sure to check the new options using the help command (-h) * NEW: you can now specify a database when calling the CLI (#340) * FIX: handling errors when path and/or password is incorrect (#336) * FIX: prompt for file again, if needed (#335) * FIX: prevent about dialog from hiding * FIX: use system RNG as source of entropy- Update to 3.3.0: * Set brackground to red when delete mode is entered * Fix base32 encoding/decoding * Requires libcotp >= 3.0- Update to 3.2.1: * FIX: increase secure memory pool to 64 MB, if possible * FIX: parsing of big aegis encrypted json (#309) * FIX: better memory management- Update to 3.2.0: * NEW: add file chooser dialog on export (#305). * FIX: overwrite exported file instead of appending it (#305). * FIX: exported file will be accessible only by the current user (#305). * FIX: multiple issues related to failed first launch (#303). * FIX: couple of issues with secret-service.- Update to 3.1.9: * Fix db corruption when symbols are used (#301). * Fix crash when user changes db multiple times.- Update to 3.1.8: * Fix importing Aegis plain text json (#296).- Update to 3.1.7: * Add new Database info dialog (Hamburger menu -> Database info) * Fix crash when no row is selected (#295) * Fix UI when creating/changing a database * Multiple fixes when creating a new database * Use current db folder when creating/changing database * Fix memory leak in case of error when opening the settings dialog- Update to 3.1.6: * Correctly quit the password dialog on export. This avoid dumping the database in plaintext format if the user presses either the cancel or close button.- Update to 3.1.5: * allow db to be a symlink (fix #289)- Update to 3.1.4: * make auto-lock and secret service mutually exclusive (#279) * fix importing plain AEGIS (#281) * fix importing encrypted AEGIS on some distros (#281) * rename disable_secret_service setting to use_secret_service- Update to 3.1.3: * Fix Aegis import/export when using long pwds. * Fix secret service cleanup * Show the correct error message when import fails * Use g_utf8_strlen instead of strlen * Add libcotp >= 2.0 compatibilityreproducible 1785912198 5.1.7-1.25.1.7-1.2 otpclientotpclient-cliotpclient-search-providercom.github.paolostivanin.OTPClient.desktopotpclientREADME.mdcom.github.paolostivanin.OTPClient.gschema.xmlcom.github.paolostivanin.OTPClient-symbolic.svgcom.github.paolostivanin.OTPClient.svgotpclientLICENSEotpclient-cli.1.gzotpclient.1.gzcom.github.paolostivanin.OTPClient.appdata.xmlotpclientwindow.ui/usr/bin//usr/share/applications//usr/share/doc/packages//usr/share/doc/packages/otpclient//usr/share/glib-2.0/schemas//usr/share/icons/hicolor/scalable/apps//usr/share/licenses//usr/share/licenses/otpclient//usr/share/man/man1//usr/share/metainfo//usr/share//usr/share/otpclient/-O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -Werror=return-type -flto=auto -gobs://build.opensuse.org/GNOME:Apps/openSUSE_Factory/c169a0849652a44d3c37fdaba79e91a5-otpclientdrpmzstd19T0ppc64le-suse-linux  ELF 64-bit LSB pie executable, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=0f604bdcc89bec6abd8954a43f0482ba8c9bba8c, for GNU/Linux 4.3.0, strippedELF 64-bit LSB pie executable, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=e4f6fdfa06526796ed6cdf535eca0f7a5df76d69, for GNU/Linux 4.3.0, strippedELF 64-bit LSB pie executable, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=2c5e74f1eb54c07dc875d22f2f78308effcf0614, for GNU/Linux 4.3.0, strippedASCII textdirectoryXML 1.0 document, ASCII text, with very long lines (470)SVG Scalable Vector Graphics imagetroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix, original size modulo 2^32 4677)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix, original size modulo 2^32 1924)XML 1.0 document, Unicode text, UTF-8 text, with very long lines (810)XML 1.0 document, Unicode text, UTF-8 text*8:RRRRRRRRRR RRRR RRRR RRRR RR RRR RRRRRRR RRRR RR RRR RRRRRR RRRR RR RPPPPil/+˾utf-85187222f8b9499c50091d4727c2ff9987ff961f2ee114bdd0c4f795e78b91f85b175656bb47bb58c797b0a2e6d0f1a87b4f8d4ae69ed2008d3cdf8c8828ae1e8? (/hGꀨ< s&8桧7s8fO003 }nGĥÚl ntѡnrd9JG.pu2ܙr6 FAu34E2i&ieSܜ9ϒ%t!2$<'A)Ц|ua Wp{VǑ  ˼NA\*N&'U(Oמ0VftO.ωtBY9kPM$hj:]H0@bcX-Cm6sc\mSSVmOP]rSv<Ζ]X%wKwnnd8;6ݎdn %rVܳŠM;PW"q b}(W=h%o[N˖%QwSRMSiҙ .t!3W~h@ wv݋Rn0]Lxk(@鋏/ӟ]U I2cf%`$ ϫCh9Dvi\œO2MB p]᥸ FpUUZeee.=%%o LHc% 1Kk /䷜s-kȀP-{ U*J`]G; *y.thֵ!(dBw>(5K-0U`yhHiGR9T CR뛀X{ &.C@pWw 2.]_[nKj`M;,(!|,Gd@tņV>,),掳EAgh@!5Q/H(k+2.#-LyX*X, >I`A$%~ ;}GIޘ$QK[Ǩ]z#3iU9=~n+ɭ5/G [ɭf|S!kdr[gU-w]uIW /zofH~デ?t/ gQy,WJ;}nֆ)z_Du4vPW Qf{DBc—O ˔b + i4cPtFSPw"scmMqNFxe@_(Gj'0jOFp}FHMrdJ'_YGM+6r|h.qJ*9aoWݰP PLUmҘnW.oUY3AEd1<:yHLoDB>H5/i|ȇqIC⮱"4N ,pH9MO pь< 9mFFb'lC!8`AB @uaŢ1TX*;Z2t9DnEꔁ%~m(v4[29p[ rtopcBt_M~`MVgyEp # .r h4~JыdO}tF_"\Cow@FUW9 _=||voh"k]+}?{RFߩXKgIk+~ *a=gVRg~KnV[,h!6gZp~=IhTi5_n/W }y#y%_>'̟}yκ9K-s}V5VoBG^k]OF-aqIU'21u?E7SWq7=W[< dpFpW/ttk2:&x&[RieZ1Li#"HR$Tu֢NYPPB;#CYj`( *yt\:>޽(z ~cX ??< ]ḇ;s G{Dކ,8w}U=*?ҧ]ٲfS:źcvPLYm WbA'p+$+k+=:WCJtn>~I{YIstM``gWLEX#P !@'}M)