Ghost
released this
2026-09-15 18:33:51 +00:00
| 114 commits to master since this release
Added in 1.8.0-beta
- A profile window, shown before the main window every time. Firefox and Thunderbird open a profile chooser first and this is the same idea for the same reason: the profile decides which token, cache and settings the rest of the session is built from, and a protected profile has to be unlocked before any of that exists. Everything to do with profiles now happens there, so the sidebar's Profile page is gone; switching profiles re-executes the process, which is why it belongs where the process starts. Closing the window quits, and there is no cancel to nowhere
- A profile's API token can be locked behind a passphrase. Scrypt (n=2^15, r=8, p=1) derives the key, Fernet encrypts the token, and a verifier blob tells a wrong passphrase from a corrupt file. Set a passphrase when creating the profile and the key exists before the token does, so the token is never written unprotected even once. The parameters are stored per profile rather than read from a constant, so raising them later does not strand what is already encrypted
- The window says exactly what a passphrase protects, in the window and not only in the documentation: the API token, and nothing else. Cached zone and record names, the queue history, the shared version history and the shared log stay readable on disk. Overstating that would be the real failure of the feature
- Forgotten your passphrase? There is no recovery, by design, so the escape replaces the passphrase panel in the same slot and asks twice before clearing the stored token. The profile, its cached zones and records and its settings are all kept, and the old token keeps working until it is revoked at deSEC
- One instance per profile. Opening a profile takes an exclusive
flock on a file in its directory, held for the life of the process, so a second window on the same profile is refused by name. Two windows on two different profiles work, which is the point: two accounts at once. The kernel drops the lock however the process ends, so a crash leaves nothing to clean up
- Reverse DNS wizard mode. Turns IP prefixes into the reverse zones that cover them,
192.0.2.0/24 into 2.0.192.in-addr.arpa and 2001:db8:1:2::/64 into its ip6.arpa name, and optionally fills each one with PTR records from a naming pattern. Reverse delegation cuts on a label boundary, so a prefix that lands on one is a single zone however large it is, and one that does not is covered by several at the boundary below it; a /22 is four /24 zones. A /25 to /31 is refused by name, since sharing a /24 needs RFC 2317 delegation from whoever holds it, and IPv6 prefixes below the last nibble are refused for the same reason
- The wizard's preset library reworked against current vendor documentation. 70 presets in 18 categories becomes 61 in 16. Every preset holding a hardcoded third-party address was checked against that vendor's own documentation rather than memory
- Six presets added: Stalwart Mail with the MTA-STS trio and DANE, a null MX "Disable Email" set for a domain that should neither send nor receive mail, a current Google Site Verification, a Bluesky handle, an HTTPS service binding, and Apple iCloud+ custom email
- Every multi-select list now says so. Twelve views accept Ctrl+click and Shift+click and not one of them advertised it, so the bulk actions beside them read as though they applied to whatever single row was highlighted. A question mark beside each list carries the gestures in its tooltip
- The Variables step groups each variable under the preset that asks for it, in the order the presets were picked, instead of one alphabetical run of unfamiliar names with no way back to the previous screen
- A logo, in the four places the application introduces itself: the title bar's upper left corner and the task bar entry beside it, next to "Choose a profile" in the window that opens first, and above the name and version on the About page and in the About drawer. It follows the theme, and follows a theme change as it happens rather than waiting for the page to be reopened. The artwork is chosen by measured luminance rather than by its file name, because the names describe the colour of the drawing and not the theme it belongs on: picking the wrong one does not fail, it renders the logo nearly invisible
- One name everywhere: "deSEC Qt DNS Manager". The window title and the About page said "deSEC DNS Manager" while the package, the desktop entry,
setApplicationName and the documentation said the longer form, so the application introduced itself under one name in its title bar and another in the menu that launched it. Both windows now take the name from about.APP_NAME, which is where the version already lives, so there is no literal left to drift
- The About page leads with the licence, ahead of the author and the credits. It is what a reader goes to that page to find, and it had been the last line of a panel that has to be scrolled
Fixed in 1.8.0-beta
- A reverse DNS run could overwrite somebody else's PTR records. If a zone planned as "create" turned out to exist, Retry Failed probed it and treated any answer as proof its own earlier create had gone through, then wrote 254 generated PTRs into it. A create that timed out after succeeding and a zone belonging to somebody else look identical to that probe. The zone's contents decide now: any PTR record in it means the zone is left alone, which is the rule the review step already applied
- Unlocking a profile with the Enter key did nothing except silently clear what had been typed. The window is a dialog whose Open Profile button is the default one, so Return re-ran Open Profile, which reopened the panel and emptied the field. An open panel owns the Return key now
- Cancelling a queued item from the Queue page could wedge a wizard permanently, with Back, Next and Start Over all refused and nothing to do but restart. A cancelled item never invoked its callback, so anything counting outstanding callbacks waited forever. Every enqueued item's callback now fires exactly once, whatever becomes of the item
- Records in reverse zones sorted 1, 10, 11, 2. Names and content sort the way a person reads numbers now
- A profile's cache directory was created shared and then repointed. The cache manager's constructor creates its directory, restricts it to the owner and deletes stale files from it, and it did all of that against a path shared by every profile before being given the profile's own. No data crossed between profiles, but the directory should never have existed
- Error toasts in the profile window ran past the edge of the window and lost the end of the message. They are capped, centred and wrap to a second line
- Confirmation drawers spanned the full width of the window, putting a single sentence across roughly two thousand pixels, which read as far heavier than the thing being confirmed. They are capped, centred cards now, and logging out asks once rather than twice: it takes nothing away
- The application had no icon at all, in any window or any task bar. Startup asked for
QIcon("icon.png"), a relative path to a file that has never existed in the repository, which Qt answers with an empty icon and no complaint, so every window carried whatever placeholder the desktop draws for an application it cannot identify
Technical Improvements in 1.8.0-beta
- The blocking work is off the UI thread. The DNSSEC status store rewrote its whole file once per finished check and a sweep finishes 25, so a background pass cost 178 ms in one burst at 800 zones; it batches now, at 7 ms. Zone snapshots ran three git subprocesses on the thread that was about to repaint, at 14 ms each; they run on a worker now, at 0.07 ms. The paint path copied a dictionary per visible row per repaint, measured at 33,000 copies in a single scroll
- The records held in memory are bounded at fifty domains, least recently used evicted first. Every domain visited used to stay for the life of the session, which measured 43 MB after 500 zones of 200 records, and a single reverse /24 holds 254 PTR records. Nothing is lost by an eviction: the file cache still holds it, and a miss costs about a millisecond
- The queue keeps a thousand history entries by default, up from 500
- Counted nouns go through one helper, so nothing in the interface says "1 records"
- No em dash appears in any tracked file, enforced by a test that walks them all
- Every example in the repository is documentation or private address space (RFC 1918, RFC 3849, RFC 2606). Real prefixes, reverse zones and domain names from a live account had reached test fixtures, docstrings, UI copy and the documentation
- The logo is drawn at the display's device pixel ratio, so a HiDPI screen gets the artwork at its real resolution instead of a logical-size pixmap stretched to fill twice the pixels. The ratio is part of the cache key, or moving a window to a second display with a different ratio would be served the stale pixmap. The source assets were regenerated larger to cover it: 614x512, enough for the largest size drawn at a ratio of 3, from the untouched originals
- The logo assets ship inside the application, under
src/assets rather than img/. The RPM copies src/ wholesale and the AppImage bundles only what its spec lists, so reading from img/ would have worked from a source checkout and left a gap in both installs; the frozen build reads them through sys._MEIPASS, since PyInstaller rewrites __file__ to a path inside the archive
- The old
logo/ directory is gone and the packaged desktop icon is generated from the new artwork, square at 256 px because it installs into hicolor/256x256/apps/. It is 46 KB against the old icon's 1 MB. A test now walks every file path the release workflow, the RPM spec and the README point at and fails if one stops existing, because a rename does not fail at the point of the rename, it fails in CI part way through a release
- 657 tests across 24 scripts, up from 524, including new suites for the version manager, cache isolation, the memory bound, the selection hints and the logo
Downloads