Prevent unnecessary key transformations, resolves #2704

The database master key settings widget does not actually
need to (re-)transform the master key, it only needs to update
the Key object on the database. Transformation can be deferred
until the Database is persisted to disk. This avoids delays
and unnecessary user interaction with challenge-response
dongles by eliminating redundant key transformations.

.clang-format

@@ -23,15 +23,14 @@ BraceWrapping:
   AfterClass:      true
   AfterFunction:   true
   AfterControlStatement: false
-  AfterEnum:       false
+  AfterEnum:       true
-  AfterNamespace:  false
+  AfterNamespace:  true
-  AfterObjCDeclaration: false
+  AfterStruct:     true
-  AfterStruct:     false
+  AfterUnion:      true
-  AfterUnion:      false
   BeforeCatch:     false
   BeforeElse:      false
   IndentBraces:    false
-BreakBeforeBinaryOperators: None
+BreakBeforeBinaryOperators: NonAssignment
 BreakBeforeBraces: Custom
 BreakBeforeTernaryOperators: true
 BreakConstructorInitializersBeforeComma: true

.github/CONTRIBUTING.md

@@ -53,7 +53,7 @@ If we reject your contribution, it means only that we do not consider it suitabl
 ## How can I contribute?
 ### Feature requests
 
-We're always looking for suggestions to improve our application. If you have a suggestion to improve an existing feature, or would like to suggest a completely new feature for KeePassXC, please use the [issue tracker on GitHub][issues-section]. For more general discussion, try using our [Google Groups][google-groups] forum.
+We're always looking for suggestions to improve our application. If you have a suggestion to improve an existing feature, or would like to suggest a completely new feature for KeePassXC, please use the [issue tracker on GitHub][issues-section].
 
 ### Bug reports
 
@@ -63,7 +63,7 @@ Before submitting a bug report, check if the problem has already been reported.
 
 ### Discuss with the team
 
-As with feature requests, you can talk to the KeePassXC team about bugs, new features, other issues and pull requests on the dedicated issue tracker, using the [Google Groups][google-groups] forum, or in the IRC channel on Freenode (`#keepassxc-dev` on `irc.freenode.net`, or use a [webchat link](https://webchat.freenode.net/?channels=%23keepassxc-dev)).
+As with feature requests, you can talk to the KeePassXC team about bugs, new features, other issues and pull requests on the dedicated issue tracker, or in the IRC channel on Freenode (`#keepassxc-dev` on `irc.freenode.net`, or use a [webchat link](https://webchat.freenode.net/?channels=%23keepassxc-dev)).
 
 ### Your first code contribution
 
@@ -94,7 +94,7 @@ The Branch Strategy is based on [git-flow-lite](http://nvie.com/posts/a-successf
 * **master** – points to the latest public release
 * **develop** – points to the development of the next release, contains tested and reviewed code
 * **feature/**[name] – points to a branch with a new feature, one which is candidate for merge into develop (subject to rebase)
-* **hotfix/**[id]-[description] – points to a branch with a fix for a particular issue ID
+* **hotfix/**[name] – points to a branch with a fix for a particular issue ID
 
 
 ### Git commit messages
@@ -103,24 +103,16 @@ The Branch Strategy is based on [git-flow-lite](http://nvie.com/posts/a-successf
 * Use the imperative mood ("Move cursor to…" not "Moves cursor to…")
 * Limit the first line to 72 characters or less
 * Reference issues and pull requests liberally
-* When only changing documentation, include `[ci skip]` in the commit description
+* If your pull request fixes an existing issue, add "Fixes #ISSUENUMBER" to your pull request description
-* Consider starting the commit message with an applicable emoji:
-    * :memo: `:memo:` when writing docs
-    * :penguin: `:penguin:` when fixing something on Linux
-    * :apple: `:apple:` when fixing something on macOS
-    * :checkered_flag: `:checkered_flag:` when fixing something on Windows
-    * :bug: `:bug:` when fixing a bug
-    * :fire: `:fire:` when removing code or files
-    * :green_heart: `:green_heart:` when fixing the CI build
-    * :white_check_mark: `:white_check_mark:` when adding tests
-    * :lock: `:lock:` when dealing with security
-
 
 ### Coding styleguide
 
-This project follows the [Qt Coding Style](https://wiki.qt.io/Qt_Coding_Style). All submissions are expected to follow this style.
+The coding style of the project is enforced using llvm's `clang-format` formatting tool. A thorough description
+of the coding style can be found in the `.clang-format` file, but the main conventions are presented here.
 
-In particular, code must stick to the following rules:
+Formatting can be performed automatically by calling `make format` from the `build/` directory.
+
+Note that [formatting can be disabled on a piece of code](https://clang.llvm.org/docs/ClangFormatStyleOptions.html#disabling-formatting-on-a-piece-of-code) if manual formatting is deemed more readable.
 
 #### Naming convention
 `lowerCamelCase`
@@ -132,15 +124,67 @@ For names made of multiple concatenated words, the first letter of the whole is
 For **C++ files** (*.cpp .h*): 4 spaces  
 For **Qt-UI files** (*.ui*): 2 spaces
 
-#### Pointers
+#### Includes
+```c
+// Class includes
+#include "MyWidget.h"
+#include "ui_MyWidget.h"
+
+// Application includes
+#include "core/Config.h"
+#include "core/FilePath.h"
+
+// Global includes
+#include <QWidget>
+#include <stdin>
+```
+
+#### Classes
+```c
+// Note: order is important, stay organized!
+class MyWidget : public QWidget
+{
+    Q_OBJECT
+
+public:
+    explicit MyWidget(QWidget* parent);
+    ~MyWidget() override;
+
+signals:
+    void alert();
+
+public slots:
+    void processEvent(Event* event);
+
+private slots:
+    void myEvent(Event* event);
+
+private:
+    const QScopedPointer<Ui::MyWidget> m_ui;
+    int m_counter;
+};
+
+// Note: alignment of variable initialization
+MyWidget::MyWidget(QWidget* parent)
+    : QWidget(parent)
+    , m_ui(new Ui::MyWidget())
+{
+
+}
+```
+
+#### Pointers / References
 ```c
 int* count;
+const QString& string;
 ```
 
 #### Braces
 ```c
 if (condition) {
     doSomething();
+} else {
+    doSomethingElse();
 }
 
 void ExampleClass::exampleFunction()
@@ -151,15 +195,18 @@ void ExampleClass::exampleFunction()
 
 #### Switch statement
 ```c
+// Note: avoid declaring variables in a switch statement
 switch (a) {
 case 1:
     doSomething();
     break;
 
-default:
+// Note: use braces if necessary
+default: {
     doSomethingElse();
     break;
 }
+}
 ```
 
 #### Member variables
@@ -177,4 +224,3 @@ Example: `<widget class="QCheckBox" name="rememberCheckBox">`
 [beginner]:https://github.com/keepassxreboot/keepassx/issues?q=is%3Aopen+is%3Aissue+label%3Abeginner+label%3A%22help+wanted%22+sort%3Acomments-desc
 [help-wanted]:https://github.com/keepassxreboot/keepassx/issues?q=is%3Aopen+is%3Aissue+label%3A%22help+wanted%22+sort%3Acomments-desc
 [issues-section]:https://github.com/keepassxreboot/keepassxc/issues
-[google-groups]:https://groups.google.com/forum/#!forum/keepassx-reboot

.github/ISSUE_TEMPLATE.md

@@ -1,32 +0,0 @@
-<!--- Provide a general summary of the issue in the title above -->
-
-## Expected Behavior
-<!--- If you're describing a bug, tell us what should happen -->
-<!--- If you're suggesting a change/improvement, tell us how it should work -->
-
-## Current Behavior
-<!--- If describing a bug, tell us what happens instead of the expected behavior -->
-<!--- If suggesting a change/improvement, explain the difference from the current behavior -->
-
-## Possible Solution
-<!--- Not obligatory, but suggest a fix/reason for the bug, -->
-<!--- or ideas how to implement the addition or change -->
-
-## Steps to Reproduce (for bugs)
-<!--- Provide a link to a live example, or an unambiguous set of steps to -->
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-1.
-2.
-3.
-4.
-
-## Context
-<!--- How has this issue affected you? What are you trying to accomplish? -->
-<!--- Providing context helps us come up with a solution that is most useful in the real world -->
-
-## Your Environment
-<!--- Include relevant details about the environment you experienced the bug in -->
-* KeePassXC version/commit used: (can be found under Help -> About)
-* Qt version (e.g. Qt 5.3): 
-* Compiler (e.g. Clang++3.6.0): 
-* Operating System and version: 

.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,49 @@
+---
+name: Bug Report
+about: provide information about a problem
+title: 
+labels: bug
+assignees: ''
+
+---
+
+[TIP]:  # ( Provide a general summary of the issue in the title above ^^ )
+[TIP]:  # ( DO NOT include screenshots of your actual database! )
+
+## Expected Behavior
+[NOTE]: # ( Tell us what you expected to happen )
+
+
+## Current Behavior
+[NOTE]: # ( Tell us what actually happens )
+
+
+## Possible Solution
+[NOTE]: # ( Not required, but suggest a fix/reason for the bug )
+
+
+## Steps to Reproduce
+[NOTE]: # ( Provide a link to a live example, or an unambiguous set of steps to )
+[NOTE]: # ( reproduce this bug. Include code to reproduce, if relevant )
+1.
+2.
+3.
+
+## Context
+[NOTE]: # ( How has this issue affected you? What unique circumstances do you have? )
+
+
+## Debug Info
+[NOTE]: # ( Paste debug info from Help → About here )
+KeePassXC - VERSION
+Revision: REVISION
+
+Libraries:
+- LIBS
+
+Operating system: OS
+CPU architecture: ARCH
+Kernel: KERNEL
+
+Enabled extensions:
+- EXTENSIONS

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,26 @@
+---
+name: Feature Request
+about: tell us about a new capability you want to see
+title: 
+labels: new feature
+assignees: ''
+
+---
+
+[TIP]:  # ( Provide a general summary of the feature in the title above ^^ )
+[TIP]:  # ( DO NOT include screenshots of your actual database! )
+
+## Summary
+[NOTE]: # ( Provide a brief overview of what the new feature is all about )
+
+
+## Desired Behavior
+[NOTE]: # ( Tell us how the new feature should work, be specific )
+
+
+## Possible Solution
+[NOTE]: # ( Not required, but suggest ideas on how to implement the addition or change )
+
+
+## Context
+[NOTE]: # ( Why does this feature matter to you? What unique circumstances do you have? )

.github/ISSUE_TEMPLATE/release-preview-bug-report.md

@@ -0,0 +1,49 @@
+---
+name: Release Preview Bug report
+about: report a bug with a release preview (eg, 2.4.0-beta1)
+title: "[PRE-RELEASE] "
+labels: PRE-RELEASE BUG
+assignees: droidmonkey
+
+---
+
+[TIP]:  # ( Provide a general summary of the issue in the title above ^^ )
+[TIP]:  # ( DO NOT include screenshots of your actual database! )
+
+## Expected Behavior
+[NOTE]: # ( Tell us what you expected to happen )
+
+
+## Current Behavior
+[NOTE]: # ( Tell us what actually happens )
+
+
+## Possible Solution
+[NOTE]: # ( Not required, but suggest a fix/reason for the bug )
+
+
+## Steps to Reproduce
+[NOTE]: # ( Provide a link to a live example, or an unambiguous set of steps to )
+[NOTE]: # ( reproduce this bug. Include code to reproduce, if relevant )
+1.
+2.
+3.
+
+## Context
+[NOTE]: # ( How has this issue affected you? What unique circumstances do you have? )
+
+
+## Debug Info
+[NOTE]: # ( Paste debug info from Help → About here )
+KeePassXC - VERSION
+Revision: REVISION
+
+Libraries:
+- LIBS
+
+Operating system: OS
+CPU architecture: ARCH
+Kernel: KERNEL
+
+Enabled extensions:
+- EXTENSIONS

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,34 +1,36 @@
-<!--- Provide a general summary of your changes in the title above -->
+[TIP]:  # ( Provide a general summary of your changes in the title above ^^ )
 
-## Description
+## Type of change
-<!--- Describe your changes in detail -->
+[NOTE]: # ( Please remove all lines which don't apply. )
-
-## Motivation and context
-<!--- Why is this change required? What problem does it solve? -->
-<!--- If it fixes an open issue, please link to the issue here. -->
-
-## How has this been tested?
-<!--- Please describe in detail how you tested your changes. -->
-<!--- Include details of your testing environment, and the tests you ran to -->
-<!--- see how your change affects other areas of the code, etc. -->
-
-## Screenshots (if appropriate):
-
-## Types of changes
-<!--- What types of changes does your code introduce? -->
-<!--- Please remove all lines which don't apply. -->
 - ✅ Bug fix (non-breaking change which fixes an issue)
+- ✅ Refactor (significant modification to existing code)
 - ✅ New feature (non-breaking change which adds functionality)
 - ✅ Breaking change (fix or feature that would cause existing functionality to change)
+- ✅ Documentation (non-code change)
+
+## Description and Context
+[NOTE]: # ( Describe your changes in detail, why is this change required? )
+[NOTE]: # ( Describe the context of your change. Explain large code modifications. )
+[NOTE]: # ( If it fixes an open issue, please add "Fixes #XXX" as necessary )
+
+
+## Screenshots
+[TIP]:  # ( Do not include screenshots of your actual database! )
+
+
+## Testing strategy
+[NOTE]: # ( Please describe in detail how you tested your changes. )
+[TIP]:  # ( We expect new code to be covered by unit tests and documented with doc blocks! )
+
 
 ## Checklist:
-<!--- Please go over all the following points. -->
+[NOTE]: # ( Please go over all the following points. )
-<!--- Again, remove any lines which don't apply. -->
+[NOTE]: # ( Again, remove any lines which don't apply. )
-<!--- Pull Requests that don't fulfill all [REQUIRED] requisites are likely -->
+[NOTE]: # ( Pull Requests that don't fulfill all [REQUIRED] requisites are likely )
-<!--- to be sent back to you for correction or will be rejected.  -->
+[NOTE]: # ( to be sent back to you for correction or will be rejected.  )
 - ✅ I have read the **CONTRIBUTING** document. **[REQUIRED]**
 - ✅ My code follows the code style of this project. **[REQUIRED]**
 - ✅ All new and existing tests passed. **[REQUIRED]**
 - ✅ I have compiled and verified my code with `-DWITH_ASAN=ON`. **[REQUIRED]**
-- ✅ My change requires a change to the documentation and I have updated it accordingly.
+- ✅ My change requires a change to the documentation, and I have updated it accordingly.
 - ✅ I have added tests to cover my changes.

.gitignore

@@ -1,8 +1,23 @@
 CMakeLists.txt.*
 build*/
+cmake-build-*/
 release*/
 .idea/
 *.iml
 *.kdev4
 
 \.vscode/
+*.swp
+
+.DS_Store
+.version
+desktop.ini
+\.scannerwork/
+
+/snap/.snapcraft/
+/parts/
+/stage/
+/prime/
+/*.snap
+/*_source.tar.bz2
+

.travis.yml

@@ -1,47 +0,0 @@
-language: cpp
-sudo: required
-dist: trusty
-# FIXME : remove when (https://github.com/google/sanitizers/issues/837) is resolved.
-group: deprecated-2017Q3
-services: [docker]
-
-os:
-  - linux
-#  - osx
-
-# Define clang compiler without any frills
-compiler:
-  - clang
-  - gcc
-
-env:
-  - CONFIG=Release ASAN_OPTIONS=detect_odr_violation=1:leak_check_at_exit=0
-  - CONFIG=Debug ASAN_OPTIONS=detect_odr_violation=1:leak_check_at_exit=0
-
-git:
-  depth: 3
-
-before_install:
-  - if [ "$TRAVIS_OS_NAME" = "linux" ]; then sudo apt-get -qq update; fi
-  - if [ "$TRAVIS_OS_NAME" = "linux" ]; then sudo apt-get -qq install cmake libclang-common-3.5-dev libxi-dev qtbase5-dev libqt5x11extras5-dev qttools5-dev qttools5-dev-tools libgcrypt20-dev zlib1g-dev libxtst-dev xvfb libyubikey-dev libykpers-1-dev;  fi
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then brew update; fi
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then brew ls | grep -wq cmake || brew install cmake; fi
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then brew ls | grep -wq qt5 || brew install qt5; fi
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then brew ls | grep -wq libgcrypt || brew install libgcrypt; fi
-
-before_script:
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then CMAKE_ARGS="-DCMAKE_PREFIX_PATH=/usr/local/opt/qt5"; fi
-  - mkdir build && pushd build
-
-script:
-  - cmake -DCMAKE_BUILD_TYPE=${CONFIG} -DWITH_GUI_TESTS=ON -DWITH_ASAN=ON -DWITH_XC_HTTP=ON -DWITH_XC_AUTOTYPE=ON -DWITH_XC_YUBIKEY=ON $CMAKE_ARGS ..
-  - make -j2
-  - if [ "$TRAVIS_OS_NAME" = "linux" ]; then make test ARGS+="-E testgui --output-on-failure"; fi
-  - if [ "$TRAVIS_OS_NAME" = "linux" ]; then xvfb-run -a --server-args="-screen 0 800x600x24" make test ARGS+="-R testgui --output-on-failure"; fi
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then make test ARGS+="--output-on-failure"; fi
-
-# Generate snapcraft build when merging into master/develop branches
-#after_success:
-#  - popd
-#  - "[[ $DEPLOY = 1 ]] && [[ $CONFIG = Release ]] && [[ $TRAVIS_BRANCH =~ (master|develop) ]] && [[ $TRAVIS_PULL_REQUEST = false ]] \
-#    && docker run -v $(pwd):/cwd snapcore/snapcraft sh -c 'cd /cwd && apt update && snapcraft'"

AppImage-Recipe.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-# 
-# KeePassXC AppImage Recipe
-# Copyright (C) 2017 KeePassXC team <https://keepassxc.org/>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 or (at your option)
-# version 3 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-if [ "$1" == "" ] || [ "$2" == "" ]; then
-    echo "Usage: $(basename $0) APP_NAME RELEASE_VERSION" >&2
-    exit 1
-fi
-
-if [ -f CHANGELOG ]; then
-    echo "This recipe must not be run from the sources root." >&2
-    exit 1
-fi
-
-if [ ! -d ../bin-release ]; then
-    echo "../bin-release does not exist." >&2
-    exit 1
-fi
-
-APP="$1"
-LOWERAPP="$(echo "$APP" | tr '[:upper:]' '[:lower:]')"
-VERSION="$2"
-
-mkdir -p $APP.AppDir
-wget -q https://github.com/probonopd/AppImages/raw/master/functions.sh -O ./functions.sh
-. ./functions.sh
-
-LIB_DIR=./usr/lib
-if [ -d ./usr/lib/x86_64-linux-gnu ]; then
-    LIB_DIR=./usr/lib/x86_64-linux-gnu
-fi
-
-cd $APP.AppDir
-cp -a ../../bin-release/* .
-cp -a ./usr/local/* ./usr
-rm -R ./usr/local
-rmdir ./opt 2> /dev/null
-
-# bundle Qt platform plugins and themes
-QXCB_PLUGIN="$(find /usr/lib -name 'libqxcb.so' 2> /dev/null)"
-if [ "$QXCB_PLUGIN" == "" ]; then
-    QXCB_PLUGIN="$(find /opt/qt*/plugins -name 'libqxcb.so' 2> /dev/null)"
-fi
-QT_PLUGIN_PATH="$(dirname $(dirname $QXCB_PLUGIN))"
-mkdir -p ".${QT_PLUGIN_PATH}/platforms"
-cp "$QXCB_PLUGIN" ".${QT_PLUGIN_PATH}/platforms/"
-
-get_apprun
-copy_deps
-delete_blacklisted
-
-# remove dbus and systemd libs as they are not blacklisted
-find . -name libdbus-1.so.3 -exec rm {} \;
-find . -name libsystemd.so.0 -exec rm {} \;
-
-get_desktop
-get_icon
-cat << EOF > ./usr/bin/keepassxc_env
-#!/usr/bin/env bash
-#export QT_QPA_PLATFORMTHEME=gtk2
-export LD_LIBRARY_PATH="..$(dirname ${QT_PLUGIN_PATH})/lib:\${LD_LIBRARY_PATH}"
-export QT_PLUGIN_PATH="..${QT_PLUGIN_PATH}"
-
-# unset XDG_DATA_DIRS to make tray icon work in Ubuntu Unity
-# see https://github.com/probonopd/AppImageKit/issues/351
-unset XDG_DATA_DIRS
-
-exec keepassxc "\$@"
-EOF
-chmod +x ./usr/bin/keepassxc_env
-sed -i 's/Exec=keepassxc/Exec=keepassxc_env/' keepassxc.desktop
-get_desktopintegration $LOWERAPP
-
-GLIBC_NEEDED=$(glibc_needed)
-
-cd ..
-
-generate_type2_appimage
-
-mv ../out/*.AppImage ..
-rmdir ../out > /dev/null 2>&1

CHANGELOG

@@ -1,3 +1,149 @@
+2.4.0-preview (TBD)
+=========================
+
+This is a pre-release build, view merged PR's at
+https://github.com/keepassxreboot/keepassxc/pulls?q=is%3Apr+milestone%3Av2.4.0+is%3Aclosed
+
+2.3.4 (2018-08-21)
+=========================
+
+- Show all URL schemes in entry view [#1768]
+- Disable merge when database is locked [#1975]
+- Fix intermittent crashes with favorite icon downloads [#1980]
+- Provide potential crash warning to Qt 5.5.x users [#2211]
+- Disable apply button when creating new entry/group to prevent data loss [#2204]
+- Allow for 12 hour timeout to lock idle database [#2173]
+- Multiple SSH Agent fixes [#1981, #2117]
+- Multiple Browser Integration enhancements [#1993, #2003, #2055, #2116, #2159, #2174, #2185]
+- Fix browser proxy application not closing properly [#2142]
+- Add real names and Patreon supporters to about dialog [#2214]
+- Add settings button to toolbar, Donate button, and Report a Bug button to help menu [#2214]
+- Enhancements to release-tool to appsign intermediate build products [#2101]
+
+
+2.3.3 (2018-05-09)
+=========================
+
+- Fix crash when browser integration is enabled [#1923]
+
+2.3.2 (2018-05-07)
+=========================
+
+- Enable high entropy ASLR on Windows [#1747]
+- Enhance favicon fetching [#1786]
+- Fix crash on Windows due to autotype [#1691]
+- Fix dark tray icon changing all icons [#1680]
+- Fix --pw-stdin not using getPassword function [#1686]
+- Fix placeholders being resolved in notes [#1907]
+- Enable auto-type start delay to be configurable [#1908]
+- Browser: Fix native messaging reply size [#1719]
+- Browser: Increase maximum buffer size [#1720]
+- Browser: Enhance usability and functionality [#1810, #1822, #1830, #1884, #1906]
+- SSH Agent: Parse aes-256-cbc/ctr keys [#1682]
+- SSH Agent: Enhance usability and functionality [#1677, #1679, #1681, #1787]
+
+2.3.1 (2018-03-06)
+=========================
+
+- Fix unnecessary automatic upgrade to KDBX 4.0 and prevent challenge-response key being stripped [#1568]
+- Abort saving and show an error message when challenge-response fails [#1659]
+- Support inner stream protection on all string attributes [#1646]
+- Fix favicon downloads not finishing on some websites [#1657]
+- Fix freeze due to invalid STDIN data [#1628]
+- Correct issue with encrypted RSA SSH keys [#1587]
+- Fix crash on macOS due to QTBUG-54832 [#1607]
+- Show error message if ssh-agent communication fails [#1614]
+- Fix --pw-stdin and filename parameters being ignored [#1608]
+- Fix Auto-Type syntax check not allowing spaces and special characters [#1626]
+- Fix reference placeholders in combination with Auto-Type [#1649]
+- Fix qtbase translations not being loaded [#1611]
+- Fix startup crash on Windows due to missing SVG libraries [#1662]
+- Correct database tab order regression [#1610]
+- Fix GCC 8 compilation error [#1612]
+- Fix copying of advanced attributes on KDE [#1640]
+- Fix member initialization of CategoryListWidgetDelegate [#1613]
+- Fix inconsistent toolbar icon sizes and provide higher-quality icons [#1616]
+- Improve preview panel geometry [#1609]
+
+2.3.0 (2018-02-27)
+=========================
+
+- Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494]
+- Add SSH Agent feature [#1098, #1450, #1463]
+- Add preview panel with details of the selected entry [#879, #1338]
+- Add more and configurable columns to entry table and allow copying of values by double click [#1305]
+- Add KeePassXC-Browser API as a replacement for KeePassHTTP [#608]
+- Deprecate KeePassHTTP [#1392]
+- Add support for Steam one-time passwords [#1206]
+- Add support for multiple Auto-Type sequences for a single entry [#1390]
+- Adjust YubiKey HMAC-SHA1 challenge-response key generation for KDBX 4.0 [#1060]
+- Replace qHttp with cURL for website icon downloads [#1460]
+- Remove lock file [#1231]
+- Add option to create backup file before saving [#1385]
+- Ask to save a generated password before closing the entry password generator [#1499]
+- Resolve placeholders recursively [#1078]
+- Add Auto-Type button to the toolbar [#1056]
+- Improve window focus handling for Auto-Type dialogs [#1204, #1490]
+- Auto-Type dialog and password generator can now be exited with ESC [#1252, #1412]
+- Add optional dark tray icon [#1154]
+- Add new "Unsafe saving" option to work around saving problems with file sync services [#1385]
+- Add IBus support to AppImage and additional image formats to Windows builds [#1534, #1537]
+- Add diceware password generator to CLI [#1406]
+- Add --key-file option to CLI [#816, #824]
+- Add DBus interface for opening and closing KeePassXC databases [#283]
+- Add KDBX compression options to database settings [#1419]
+- Discourage use of old fixed-length key files in favor of arbitrary files [#1326, #1327]
+- Correct reference resolution in entry fields [#1486]
+- Fix window state and recent databases not being remembered on exit [#1453]
+- Correct history item generation when configuring TOTP for an entry [#1446]
+- Correct multiple TOTP bugs [#1414]
+- Automatic saving after every change is now a default [#279]
+- Allow creation of new entries during search [#1398]
+- Correct menu issues on macOS [#1335]
+- Allow compilation on OpenBSD [#1328]
+- Improve entry attachments view [#1139, #1298]
+- Fix auto lock for Gnome and Xfce [#910, #1249]
+- Don't remember key files in file dialogs when the setting is disabled [#1188]
+- Improve database merging and conflict resolution [#807, #1165]
+- Fix macOS pasteboard issues [#1202]
+- Improve startup times on some platforms [#1205]
+- Hide the notes field by default [#1124]
+- Toggle main window by clicking tray icon with the middle mouse button [#992]
+- Fix custom icons not copied over when databases are merged [#1008]
+- Allow use of DEL key to delete entries [#914]
+- Correct intermittent crash due to stale history items [#1527]
+- Sanitize newline characters in title, username and URL fields [#1502]
+- Reopen previously opened databases in correct order [#774]
+- Use system's zxcvbn library if available [#701]
+- Implement various i18n improvements [#690, #875, #1436]
+
+2.2.4 (2017-12-13)
+=========================
+
+- Prevent database corruption when locked [#1219]
+- Fixes apply button not saving new entries [#1141]
+- Switch to Consolas font on Windows for password edit [#1229]
+- Multiple fixes to AppImage deployment [#1115, #1228]
+- Fixes multiple memory leaks [#1213]
+- Resize message close to 16x16 pixels [#1253]
+
+2.2.2 (2017-10-22)
+=========================
+
+- Fixed entries with empty URLs being reported to KeePassHTTP clients [#1031]
+- Fixed YubiKey detection and enabled CLI tool for AppImage binary [#1100]
+- Added AppStream description [#1082]
+- Improved TOTP compatibility and added new Base32 implementation [#1069]
+- Fixed error handling when processing invalid cipher stream [#1099]
+- Fixed double warning display when opening a database [#1037]
+- Fixed unlocking databases with --pw-stdin [#1087]
+- Added ability to override QT_PLUGIN_PATH environment variable for AppImages [#1079]
+- Fixed transform seed not being regenerated when saving the database [#1068]
+- Fixed only one YubiKey slot being polled [#1048]
+- Corrected an issue with entry icons while merging [#1008]
+- Corrected desktop and tray icons in Snap package [#1030]
+- Fixed screen lock and Google fallback settings [#1029]
+
 2.2.1 (2017-10-01)
 =========================
 

CMakeLists.txt

@@ -1,5 +1,5 @@
+#  Copyright (C) 2018 KeePassXC Team <team@keepassxc.org>
 #  Copyright (C) 2010 Felix Geyer <debfx@fobos.de>
-#  Copyright (C) 2017 KeePassXC Team <team@keepassxc.org>
 #
 #  This program is free software: you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -14,15 +14,15 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-if(NOT CMAKE_BUILD_TYPE)
+cmake_minimum_required(VERSION 3.1.0)
-  set(CMAKE_BUILD_TYPE "RelWithDebInfo" CACHE STRING
-      "Choose the type of build, options are: None Debug Release RelWithDebInfo Debug DebugFull Profile MinSizeRel."
-      FORCE)
-endif()
 
 project(KeePassXC)
 
-cmake_minimum_required(VERSION 3.1.0)
+if(NOT CMAKE_BUILD_TYPE)
+    set(CMAKE_BUILD_TYPE "RelWithDebInfo" CACHE STRING
+            "Choose the type of build, options are: None Debug Release RelWithDebInfo Debug DebugFull Profile MinSizeRel."
+            FORCE)
+endif()
 
 set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
 
@@ -36,51 +36,150 @@ include(CheckCXXSourceCompiles)
 option(WITH_TESTS "Enable building of unit tests" ON)
 option(WITH_GUI_TESTS "Enable building of GUI tests" OFF)
 option(WITH_DEV_BUILD "Use only for development. Disables/warns about deprecated methods." OFF)
-option(WITH_ASAN "Enable address sanitizer checks (Linux only)" OFF)
+option(WITH_ASAN "Enable address sanitizer checks (Linux / macOS only)" OFF)
 option(WITH_COVERAGE "Use to build with coverage tests (GCC only)." OFF)
-option(WITH_APP_BUNDLE "Enable Application Bundle for OS X" ON)
+option(WITH_APP_BUNDLE "Enable Application Bundle for macOS" ON)
+
+set(WITH_XC_ALL OFF CACHE BOOLEAN "Build in all available plugins")
 
 option(WITH_XC_AUTOTYPE "Include Auto-Type." ON)
-option(WITH_XC_HTTP "Include KeePassHTTP and Custom Icon Downloads." OFF)
+option(WITH_XC_NETWORKING "Include networking code (e.g. for downlading website icons)." OFF)
+option(WITH_XC_BROWSER "Include browser integration with keepassxc-browser." OFF)
 option(WITH_XC_YUBIKEY "Include YubiKey support." OFF)
+option(WITH_XC_SSHAGENT "Include SSH agent support." OFF)
+option(WITH_XC_KEESHARE "Sharing integration with KeeShare" OFF)
+option(WITH_XC_KEESHARE_SECURE "Sharing integration with secured KeeShare containers" OFF)
+if(APPLE)
+    option(WITH_XC_TOUCHID "Include TouchID support for macOS." OFF)
+endif()
 
-# Process ui files automatically from source files
+if(WITH_XC_ALL)
-set(CMAKE_AUTOUIC ON)
+    # Enable all options
+    set(WITH_XC_AUTOTYPE ON)
+    set(WITH_XC_NETWORKING ON)
+    set(WITH_XC_BROWSER ON)
+    set(WITH_XC_YUBIKEY ON)
+    set(WITH_XC_SSHAGENT ON)
+    set(WITH_XC_KEESHARE ON)
+    if(APPLE)
+        set(WITH_XC_TOUCHID ON)
+    endif()
+endif()
+
+if(WITH_XC_KEESHARE_SECURE)
+    set(WITH_XC_KEESHARE ON)
+endif()
+
+if(WITH_XC_SSHAGENT OR WITH_XC_KEESHARE)
+  set(WITH_XC_CRYPTO_SSH ON)
+else()
+  set(WITH_XC_CRYPTO_SSH OFF)
+endif()
 
 set(KEEPASSXC_VERSION_MAJOR "2")
-set(KEEPASSXC_VERSION_MINOR "2")
+set(KEEPASSXC_VERSION_MINOR "4")
-set(KEEPASSXC_VERSION_PATCH "1")
+set(KEEPASSXC_VERSION_PATCH "0")
 set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION_MAJOR}.${KEEPASSXC_VERSION_MINOR}.${KEEPASSXC_VERSION_PATCH}")
 
+set(KEEPASSXC_BUILD_TYPE "Snapshot" CACHE STRING "Set KeePassXC build type to distinguish between stable releases and snapshots")
+set_property(CACHE KEEPASSXC_BUILD_TYPE PROPERTY STRINGS Snapshot Release PreRelease)
+
+# Retrieve git HEAD revision hash
+set(GIT_HEAD_OVERRIDE "" CACHE STRING "Manually set the Git HEAD hash when missing (eg, when no .git folder exists)")
+execute_process(COMMAND git rev-parse --short=7 HEAD
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+        OUTPUT_VARIABLE GIT_HEAD
+        ERROR_QUIET)
+string(STRIP "${GIT_HEAD}" GIT_HEAD)
+if(GIT_HEAD STREQUAL "")
+    string(SUBSTRING "${GIT_HEAD_OVERRIDE}" 0 7 GIT_HEAD)
+endif()
+message(STATUS "Found Git HEAD Revision: ${GIT_HEAD}\n")
+
+# Check if on a tag, if so build as a release
+execute_process(COMMAND git tag --points-at HEAD
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+        OUTPUT_VARIABLE GIT_TAG
+        ERROR_QUIET)
+if(GIT_TAG)
+    string(STRIP "${GIT_TAG}" GIT_TAG)
+    set(OVERRIDE_VERSION ${GIT_TAG})
+elseif(EXISTS ${CMAKE_SOURCE_DIR}/.version)
+    file(READ ${CMAKE_SOURCE_DIR}/.version OVERRIDE_VERSION)
+endif()
+
+string(REGEX REPLACE "(\r?\n)+" "" OVERRIDE_VERSION "${OVERRIDE_VERSION}")
+if(OVERRIDE_VERSION)
+    if(OVERRIDE_VERSION MATCHES "^[\\.0-9]+-(alpha|beta)[0-9]+$")
+        set(KEEPASSXC_BUILD_TYPE PreRelease)
+        set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
+    elseif(OVERRIDE_VERSION MATCHES "^[\\.0-9]+$")
+        set(KEEPASSXC_BUILD_TYPE Release)
+        set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
+    endif()
+endif()
+
+if(KEEPASSXC_BUILD_TYPE STREQUAL "PreRelease" AND NOT OVERRIDE_VERSION)
+    set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION}-preview")
+elseif(KEEPASSXC_BUILD_TYPE STREQUAL "Snapshot")
+    set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION}-snapshot")
+endif()
+
+if(KEEPASSXC_BUILD_TYPE STREQUAL "Release")
+    set(KEEPASSXC_BUILD_TYPE_RELEASE ON)
+elseif(KEEPASSXC_BUILD_TYPE STREQUAL "PreRelease")
+    set(KEEPASSXC_BUILD_TYPE_PRE_RELEASE ON)
+else()
+    set(KEEPASSXC_BUILD_TYPE_SNAPSHOT ON)
+endif()
+
+message(STATUS "Setting up build for KeePassXC v${KEEPASSXC_VERSION}\n")
+
+# Distribution info
+set(KEEPASSXC_DIST ON)
+set(KEEPASSXC_DIST_TYPE "Other" CACHE STRING "KeePassXC Distribution Type")
+set_property(CACHE KEEPASSXC_DIST_TYPE PROPERTY STRINGS Snap AppImage Other)
+if(KEEPASSXC_DIST_TYPE STREQUAL "Snap")
+    set(KEEPASSXC_DIST_SNAP ON)
+elseif(KEEPASSXC_DIST_TYPE STREQUAL "AppImage")
+    set(KEEPASSXC_DIST_APPIMAGE ON)
+elseif(KEEPASSXC_DIST_TYPE STREQUAL "Other")
+    unset(KEEPASSXC_DIST)
+endif()
+
+if("${CMAKE_SIZEOF_VOID_P}" EQUAL "4")
+    set(IS_32BIT TRUE)
+endif()
+
 if("${CMAKE_C_COMPILER}" MATCHES "clang$" OR "${CMAKE_C_COMPILER_ID}" STREQUAL "Clang")
-  set(CMAKE_COMPILER_IS_CLANG 1)
+    set(CMAKE_COMPILER_IS_CLANG 1)
 endif()
 
 if("${CMAKE_CXX_COMPILER}" MATCHES "clang(\\+\\+)?$" OR "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
-  set(CMAKE_COMPILER_IS_CLANGXX 1)
+    set(CMAKE_COMPILER_IS_CLANGXX 1)
 endif()
 
 macro(add_gcc_compiler_cxxflags FLAGS)
-  if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_COMPILER_IS_CLANGXX)
+    if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_COMPILER_IS_CLANGXX)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${FLAGS}")
+        set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${FLAGS}")
-  endif()
+    endif()
 endmacro(add_gcc_compiler_cxxflags)
 
 macro(add_gcc_compiler_cflags FLAGS)
-  if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
+    if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${FLAGS}")
+        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${FLAGS}")
-  endif()
+    endif()
 endmacro(add_gcc_compiler_cflags)
 
 macro(add_gcc_compiler_flags FLAGS)
-  add_gcc_compiler_cxxflags("${FLAGS}")
+    add_gcc_compiler_cxxflags("${FLAGS}")
-  add_gcc_compiler_cflags("${FLAGS}")
+    add_gcc_compiler_cflags("${FLAGS}")
 endmacro(add_gcc_compiler_flags)
 
 add_definitions(-DQT_NO_EXCEPTIONS -DQT_STRICT_ITERATORS -DQT_NO_CAST_TO_ASCII)
 
 if(WITH_APP_BUNDLE)
-  add_definitions(-DWITH_APP_BUNDLE)
+    add_definitions(-DWITH_APP_BUNDLE)
 endif()
 
 add_gcc_compiler_flags("-fno-common")
@@ -89,6 +188,10 @@ add_gcc_compiler_flags("-Wformat=2 -Wmissing-format-attribute")
 add_gcc_compiler_flags("-fvisibility=hidden")
 add_gcc_compiler_cxxflags("-fvisibility-inlines-hidden")
 
+if(CMAKE_BUILD_TYPE STREQUAL "Debug")
+    add_gcc_compiler_flags("-Werror")
+endif()
+
 if((CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER 4.8.999) OR CMAKE_COMPILER_IS_CLANGXX)
     add_gcc_compiler_flags("-fstack-protector-strong")
 else()
@@ -98,161 +201,207 @@ endif()
 add_gcc_compiler_cxxflags("-fno-exceptions -fno-rtti")
 add_gcc_compiler_cxxflags("-Wnon-virtual-dtor -Wold-style-cast -Woverloaded-virtual")
 add_gcc_compiler_cflags("-Wchar-subscripts -Wwrite-strings")
+
 if(WITH_ASAN)
-  if(NOT CMAKE_SYSTEM_NAME STREQUAL "Linux")
+    if(NOT (CMAKE_SYSTEM_NAME STREQUAL "Linux" OR APPLE))
-      message(FATAL_ERROR "WITH_ASAN is only supported on Linux at the moment.")
+        message(FATAL_ERROR "WITH_ASAN is only supported on Linux / macOS at the moment.")
-  endif()
+    endif()
 
-  add_gcc_compiler_flags("-fsanitize=address -DWITH_ASAN")
+    add_gcc_compiler_flags("-fsanitize=address -DWITH_ASAN")
+
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        if(NOT (CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 4.9))
+            add_gcc_compiler_flags("-fsanitize=leak -DWITH_LSAN")
+        endif()
+    endif()
 
-  if(NOT (CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 4.9))
-    add_gcc_compiler_flags("-fsanitize=leak -DWITH_LSAN")
-  endif()
 endif()
 
 string(TOLOWER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE_LOWER)
-if (CMAKE_BUILD_TYPE_LOWER MATCHES "(release|relwithdebinfo|minsizerel)")
+if(CMAKE_BUILD_TYPE_LOWER MATCHES "(release|relwithdebinfo|minsizerel)")
-  add_gcc_compiler_flags("-D_FORTIFY_SOURCE=2")
+    add_gcc_compiler_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2")
 endif()
 
 check_c_compiler_flag("-Werror=format-security -Werror=implicit-function-declaration" WERROR_C_AVAILABLE)
 check_cxx_compiler_flag("-Werror=format-security" WERROR_CXX_AVAILABLE)
 if(WERROR_C_AVAILABLE AND WERROR_CXX_AVAILABLE)
-  add_gcc_compiler_flags("-Werror=format-security")
+    add_gcc_compiler_flags("-Werror=format-security")
-  add_gcc_compiler_cflags("-Werror=implicit-function-declaration")
+    add_gcc_compiler_cflags("-Werror=implicit-function-declaration")
 endif()
 
 if(CMAKE_COMPILER_IS_GNUCXX)
-  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wcast-align")
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wcast-align")
-
-  if(WITH_COVERAGE)
-    # Include code coverage, use with -DCMAKE_BUILD_TYPE=Coverage
-    include(CodeCoverage)
-    setup_target_for_coverage(kp_coverage "make test" coverage)
-  endif()
 endif()
 
 if(CMAKE_COMPILER_IS_GNUCC)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wcast-align")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wcast-align")
 endif()
 
 if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  if (CMAKE_COMPILER_IS_CLANGXX)
+    if(CMAKE_COMPILER_IS_CLANGXX)
-      add_gcc_compiler_flags("-Qunused-arguments")
+        add_gcc_compiler_flags("-Qunused-arguments")
-  endif()
+    endif()
-  add_gcc_compiler_flags("-pie -fPIE")
+    add_gcc_compiler_flags("-pie -fPIE")
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--no-add-needed -Wl,--as-needed -Wl,--no-undefined")
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--no-add-needed -Wl,--as-needed -Wl,--no-undefined")
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
-  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--no-add-needed -Wl,--as-needed")
+    set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--no-add-needed -Wl,--as-needed")
-  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
+    set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
 endif()
 
+add_gcc_compiler_cflags("-std=c99")
 add_gcc_compiler_cxxflags("-std=c++11")
 
 if(APPLE)
-  add_gcc_compiler_cxxflags("-stdlib=libc++")
+    add_gcc_compiler_cxxflags("-stdlib=libc++")
 endif()
 
-add_gcc_compiler_cflags("-ansi")
-
 if(WITH_DEV_BUILD)
-  add_definitions(-DQT_DEPRECATED_WARNINGS -DGCRYPT_NO_DEPRECATED)
+    add_definitions(-DQT_DEPRECATED_WARNINGS -DGCRYPT_NO_DEPRECATED)
 endif()
 
 if(MINGW)
-  set(CMAKE_RC_COMPILER_INIT windres)
+    set(CMAKE_RC_COMPILER_INIT windres)
-  enable_language(RC)
+    enable_language(RC)
-  set(CMAKE_RC_COMPILE_OBJECT "<CMAKE_RC_COMPILER> <FLAGS> -O coff <DEFINES> -i <SOURCE> -o <OBJECT>")
+    set(CMAKE_RC_COMPILE_OBJECT "<CMAKE_RC_COMPILER> <FLAGS> -O coff <DEFINES> -i <SOURCE> -o <OBJECT>")
-  if(NOT (CMAKE_BUILD_TYPE STREQUAL "Debug" OR CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo"))
+    if(NOT (CMAKE_BUILD_TYPE STREQUAL "Debug" OR CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo"))
-    # Enable DEP and ASLR
+        # Enable DEP and ASLR
-    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
+        set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
-    set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
+        set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
-  endif()
+        # Enable high entropy ASLR for 64-bit builds
+        if(NOT IS_32BIT)
+            set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--high-entropy-va")
+            set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--high-entropy-va")
+        endif()
+    endif()
 endif()
 
 if(APPLE AND WITH_APP_BUNDLE OR MINGW)
-  set(PROGNAME KeePassXC)
+    set(PROGNAME KeePassXC)
 else()
-  set(PROGNAME keepassxc)
+    set(PROGNAME keepassxc)
-endif()
-
-if(APPLE AND WITH_APP_BUNDLE AND "${CMAKE_INSTALL_PREFIX}" STREQUAL "/usr/local")
-  set(CMAKE_INSTALL_PREFIX "/Applications")
 endif()
 
 if(MINGW)
-  set(CLI_INSTALL_DIR    ".")
+    set(CLI_INSTALL_DIR ".")
-  set(BIN_INSTALL_DIR    ".")
+    set(PROXY_INSTALL_DIR ".")
-  set(PLUGIN_INSTALL_DIR ".")
+    set(BIN_INSTALL_DIR ".")
-  set(DATA_INSTALL_DIR   "share")
+    set(PLUGIN_INSTALL_DIR ".")
+    set(DATA_INSTALL_DIR "share")
 elseif(APPLE AND WITH_APP_BUNDLE)
-  set(CLI_INSTALL_DIR    "/usr/local/bin")
+    set(CMAKE_INSTALL_MANDIR "${PROGNAME}.app/Contents/Resources/man")
-  set(BIN_INSTALL_DIR    ".")
+    set(CLI_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
-  set(PLUGIN_INSTALL_DIR "${PROGNAME}.app/Contents/PlugIns")
+    set(PROXY_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
-  set(DATA_INSTALL_DIR   "${PROGNAME}.app/Contents/Resources")
+    set(BIN_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
+    set(PLUGIN_INSTALL_DIR "${PROGNAME}.app/Contents/PlugIns")
+    set(DATA_INSTALL_DIR "${PROGNAME}.app/Contents/Resources")
 else()
-  include(GNUInstallDirs)
+    include(GNUInstallDirs)
 
-  set(CLI_INSTALL_DIR    "${CMAKE_INSTALL_BINDIR}")
+    set(CLI_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}")
-  set(BIN_INSTALL_DIR    "${CMAKE_INSTALL_BINDIR}")
+    set(PROXY_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}")
-  set(PLUGIN_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/keepassxc")
+    set(BIN_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}")
-  set(DATA_INSTALL_DIR   "${CMAKE_INSTALL_DATADIR}/keepassxc")
+    set(PLUGIN_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/keepassxc")
+    set(DATA_INSTALL_DIR "${CMAKE_INSTALL_DATADIR}/keepassxc")
 endif()
 
 if(WITH_TESTS)
-  enable_testing()
+    enable_testing()
 endif(WITH_TESTS)
 
-find_package(Qt5Core          5.2 REQUIRED)
+if(WITH_COVERAGE)
-find_package(Qt5Network       5.2 REQUIRED)
+    # Include code coverage, use with -DCMAKE_BUILD_TYPE=Debug
-find_package(Qt5Concurrent    5.2 REQUIRED)
+    include(CodeCoverage)
-find_package(Qt5Widgets       5.2 REQUIRED)
+    set(COVERAGE_GCOVR_EXCLUDES
-find_package(Qt5Test          5.2 REQUIRED)
+            "\\(.+/\\)?tests/.\\*"
-find_package(Qt5LinguistTools 5.2 REQUIRED)
+            ".\\*/moc_\\[^/\\]+\\.cpp"
-find_package(Qt5Network       5.2 REQUIRED)
+            ".\\*/ui_\\[^/\\]+\\.h"
-if (UNIX AND NOT APPLE)
+            "\\(.+/\\)?zxcvbn/.\\*")
-    find_package(Qt5DBus 5.2 REQUIRED)
+    append_coverage_compiler_flags()
+    setup_target_for_coverage_gcovr_html(
+            NAME coverage
+            EXECUTABLE $(MAKE) && $(MAKE) test
+    )
 endif()
+
+include(CLangFormat)
+
+set(QT_COMPONENTS Core Network Concurrent Gui Svg Widgets Test LinguistTools)
+if(UNIX AND NOT APPLE)
+    find_package(Qt5 COMPONENTS ${QT_COMPONENTS} DBus REQUIRED)
+elseif(APPLE)
+    find_package(Qt5 COMPONENTS ${QT_COMPONENTS} REQUIRED HINTS /usr/local/opt/qt/lib/cmake /usr/local/Cellar/qt/*/lib/cmake ENV PATH)
+    find_package(Qt5 COMPONENTS MacExtras HINTS /usr/local/opt/qt/lib/cmake /usr/local/Cellar/qt/*/lib/cmake ENV PATH)
+else()
+    find_package(Qt5 COMPONENTS ${QT_COMPONENTS} REQUIRED)
+endif()
+
+if(Qt5Core_VERSION VERSION_LESS "5.2.0")
+    message(FATAL_ERROR "Qt version 5.2.0 or higher is required")
+endif()
+
+get_filename_component(Qt5_PREFIX ${Qt5_DIR}/../../.. REALPATH)
+
+# Process moc automatically
 set(CMAKE_AUTOMOC ON)
+# Process .ui files automatically
+set(CMAKE_AUTOUIC ON)
+# Process .qrc files automatically
+set(CMAKE_AUTORCC ON)
+
+if(APPLE)
+    set(CMAKE_MACOSX_RPATH TRUE)
+    find_program(MACDEPLOYQT_EXE macdeployqt HINTS ${Qt5_PREFIX}/bin ENV PATH)
+    if(NOT MACDEPLOYQT_EXE)
+        message(FATAL_ERROR "macdeployqt is required to build in macOS")
+    else()
+        message(STATUS "Using macdeployqt: ${MACDEPLOYQT_EXE}")
+    endif()
+endif()
 
 # Debian sets the the build type to None for package builds.
 # Make sure we don't enable asserts there.
 set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS_NONE QT_NO_DEBUG)
 
 find_package(LibGPGError REQUIRED)
-
+find_package(Gcrypt 1.7.0 REQUIRED)
-find_package(Gcrypt 1.6.0 REQUIRED)
+find_package(Argon2 REQUIRED)
-
 find_package(ZLIB REQUIRED)
+find_package(QREncode REQUIRED)
 
 set(CMAKE_REQUIRED_INCLUDES ${ZLIB_INCLUDE_DIR})
 
-check_cxx_source_compiles("
+if(ZLIB_VERSION_STRING VERSION_LESS "1.2.0")
-  #include <zlib.h>
+    message(FATAL_ERROR "zlib 1.2.0 or higher is required to use the gzip format")
+endif()
 
-  #if !defined(ZLIB_VERNUM) || (ZLIB_VERNUM < 0x1200)
+include_directories(SYSTEM ${ARGON2_INCLUDE_DIR})
-      #error zlib 1.2.x or higher is required to use the gzip format
-  #endif
 
-  int main() { return 0; }" ZLIB_SUPPORTS_GZIP)
+# Optional
-
+if(WITH_XC_KEESHARE)
-if(NOT ZLIB_SUPPORTS_GZIP)
+    set(WITH_XC_KEESHARE_INSECURE ON)
-  message(FATAL_ERROR "zlib 1.2.x or higher is required to use the gzip format")
+    if(WITH_XC_KEESHARE_SECURE)
+        # ZLIB is needed and already required
+        find_package(QuaZip REQUIRED)
+        include_directories(SYSTEM ${QUAZIP_INCLUDE_DIR})
+    endif()
+else()
+    set(WITH_XC_KEESHARE_INSECURE OFF)
+    set(WITH_XC_KEESHARE_SECURE OFF)
 endif()
 
 # Optional
 if(WITH_XC_YUBIKEY)
-  find_package(YubiKey REQUIRED)
+    find_package(YubiKey REQUIRED)
 
-  include_directories(SYSTEM ${YUBIKEY_INCLUDE_DIRS})
+    include_directories(SYSTEM ${YUBIKEY_INCLUDE_DIRS})
 endif()
 
 if(UNIX)
-  check_cxx_source_compiles("#include <sys/prctl.h>
+    check_cxx_source_compiles("#include <sys/prctl.h>
     int main() { prctl(PR_SET_DUMPABLE, 0); return 0; }"
-    HAVE_PR_SET_DUMPABLE)
+            HAVE_PR_SET_DUMPABLE)
 
-  check_cxx_source_compiles("#include <sys/resource.h>
+    check_cxx_source_compiles("#include <sys/resource.h>
     int main() {
       struct rlimit limit;
       limit.rlim_cur = 0;
@@ -261,12 +410,12 @@ if(UNIX)
       return 0;
     }" HAVE_RLIMIT_CORE)
 
-  if(APPLE)
+    if(APPLE)
-    check_cxx_source_compiles("#include <sys/types.h>
+        check_cxx_source_compiles("#include <sys/types.h>
       #include <sys/ptrace.h>
       int main() { ptrace(PT_DENY_ATTACH, 0, 0, 0); return 0; }"
-      HAVE_PT_DENY_ATTACH)
+                HAVE_PT_DENY_ATTACH)
-  endif()
+    endif()
 endif()
 
 include_directories(SYSTEM ${GCRYPT_INCLUDE_DIR} ${ZLIB_INCLUDE_DIR})
@@ -276,14 +425,14 @@ include(FeatureSummary)
 add_subdirectory(src)
 add_subdirectory(share)
 if(WITH_TESTS)
-  add_subdirectory(tests)
+    add_subdirectory(tests)
 endif(WITH_TESTS)
 
 if(PRINT_SUMMARY)
-  # This will print ENABLED, REQUIRED and DISABLED
+    # This will print ENABLED, REQUIRED and DISABLED
-  feature_summary(WHAT ALL)
+    feature_summary(WHAT ALL)
 else()
-  # This will only print ENABLED and DISABLED feature
+    # This will only print ENABLED and DISABLED feature
-  feature_summary(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
+    feature_summary(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
-  feature_summary(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
+    feature_summary(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
 endif()

COPYING

@@ -27,7 +27,7 @@ Copyright: 2010-2012, Felix Geyer <debfx@fobos.de>
            2000-2008, Tom Sato <VEF00200@nifty.ne.jp>
            2013, Laszlo Papp <lpapp@kde.org>
            2013, David Faure <faure@kde.org>
-           2016-2017, KeePassXC Team <team@keepassxc.org>
+           2016-2018, KeePassXC Team <team@keepassxc.org>
 License: GPL-2 or GPL-3
 
 Comment: The "KeePassXC Team" in every copyright notice is formed by the following people:
@@ -55,20 +55,16 @@ Files: cmake/GenerateProductVersion.cmake
 Copyright: 2015 halex2005 <akharlov@gmail.com>
 License: MIT
 
-Files: cmake/CodeCoverage.cmake
-Copyright: 2012 - 2015, Lars Bilke
-License: BSD-3-clause
-
 Files: share/icons/application/*/apps/keepassxc.png
-       share/icons/application/scalable/apps/keepassxc.svgz
+       share/icons/application/scalable/apps/keepassxc.svg
        share/icons/application/*/apps/keepassxc-dark.png
-       share/icons/application/scalable/apps/keepassxc-dark.svgz
+       share/icons/application/scalable/apps/keepassxc-dark.svg
        share/icons/application/*/apps/keepassxc-locked.png
-       share/icons/application/scalable/apps/keepassxc-locked.svgz
+       share/icons/application/scalable/apps/keepassxc-locked.svg
        share/icons/application/*/apps/keepassxc-unlocked.png
-       share/icons/application/scalable/apps/keepassxc-unlocked.svgz
+       share/icons/application/scalable/apps/keepassxc-unlocked.svg
        share/icons/application/*/mimetypes/application-x-keepassxc.png
-       share/icons/application/scalable/mimetypes/application-x-keepassxc.svgz
+       share/icons/application/scalable/mimetypes/application-x-keepassxc.svg
 Copyright: 2016, Lorenzo Stella <lorenzo.stl@gmail.com>
 License: LGPL-2
 
@@ -155,7 +151,14 @@ Copyright: 2003-2004, David Vignoni <david@icon-king.com>
 License: LGPL-2.1
 Comment: based on Nuvola icon theme
 
+Files: share/icons/application/*/actions/favicon-download.png
+Copyright: 2003-2004, David Vignoni <david@icon-king.com>
+           2018, Kyle Kneitinger <kyle@kneit.in>
+License: LGPL-2.1
+Comment: based on Nuvola icon theme
+
 Files: share/icons/application/*/actions/application-exit.png
+       share/icons/application/*/actions/chronometer.png
        share/icons/application/*/actions/configure.png
        share/icons/application/*/actions/dialog-close.png
        share/icons/application/*/actions/dialog-ok.png
@@ -178,12 +181,13 @@ Files: share/icons/application/*/actions/application-exit.png
        share/icons/application/*/actions/view-history.png
        share/icons/application/*/apps/internet-web-browser.png
        share/icons/application/*/apps/preferences-desktop-icons.png
+       share/icons/application/*/apps/utilities-terminal.png
        share/icons/application/*/categories/preferences-other.png
        share/icons/application/*/status/dialog-error.png
        share/icons/application/*/status/dialog-information.png
        share/icons/application/*/status/dialog-warning.png
        share/icons/application/*/status/security-high.png
-       share/icons/svg/*.svgz
+       share/icons/svg/*.svg
 Copyright: 2007, Nuno Pinheiro <nuno@oxygen-icons.org>
            2007, David Vignoni <david@icon-king.com>
            2007, David Miller <miller@oxygen-icons.org>
@@ -214,10 +218,6 @@ Files: share/icons/database/C65_W.png
 Copyright: none
 License: public-domain
 
-Files: src/crypto/salsa20/*
-Copyright: none
-License: public-domain
-
 Files: src/streams/qtiocompressor.*
        src/streams/QtIOCompressor
        tests/modeltest.*
@@ -229,11 +229,7 @@ Copyright: 2009-2010, Iowa State University
 License: Boost-1.0
 
 Files: src/zxcvbn/zxcvbn.*
-Copyright: 2015, Tony Evans
+Copyright: 2015-2017, Tony Evans
-License: BSD 3-clause
-
-Files: src/http/qhttp/*
-Copyright: 2014, Amir Zamani
 License: MIT
 
 Files: src/gui/KMessageWidget.h
@@ -242,7 +238,6 @@ Copyright: 2011 Aurélien Gâteau <agateau@kde.org>
            2014 Dominik Haumann <dhaumann@kde.org>
 License: LGPL-2.1
 
-Files: src/totp/base32.cpp
+Files: share/macosx/dmg-background.tiff
-       src/totp/base32.h
+Copyright: 2008-2014, Andrey Tarantsov
-Copyright: 2010 Google Inc.
+License: MIT
-License: Apache 2.0

Dockerfile

@@ -1,5 +1,5 @@
 # KeePassXC Linux Release Build Dockerfile
-# Copyright (C) 2017 KeePassXC team <https://keepassxc.org/>
+# Copyright (C) 2017-2018 KeePassXC team <https://keepassxc.org/>
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,47 +16,82 @@
 
 FROM ubuntu:14.04
 
-RUN set -x \
+ENV REBUILD_COUNTER=10
-    && apt-get update \
+
-    && apt-get install --yes software-properties-common
+ENV QT5_VERSION=qt510
+ENV QT5_PPA_VERSION=qt-5.10.1
+ENV TERM=xterm-256color
 
 RUN set -x \
-    && add-apt-repository ppa:george-edison55/cmake-3.x
+    && apt-get update -y \
-
+    && apt-get -y install software-properties-common
-ENV QT_VERSION=qt59
 
 RUN set -x \
-    && add-apt-repository --yes ppa:beineri/opt-${QT_VERSION}-trusty
+    && add-apt-repository ppa:beineri/opt-${QT5_PPA_VERSION}-trusty \
-
+    && add-apt-repository ppa:phoerious/keepassxc
 
 RUN set -x \
-    && apt-get update \
+    && apt-get update -y \
-    && apt-get install --yes \
+    && apt-get upgrade -y
+
+# build and runtime dependencies
+RUN set -x \
+    && apt-get install -y \
+        cmake3 \
+        curl \
         g++ \
-        cmake \
+        git \
-        libgcrypt20-dev \
+        libgcrypt20-18-dev \
-        ${QT_VERSION}base \
+        libargon2-0-dev \
-        ${QT_VERSION}tools \
+        libsodium-dev \
-        ${QT_VERSION}x11extras \
+        libcurl-no-gcrypt-dev \
+        ${QT5_VERSION}base \
+        ${QT5_VERSION}tools \
+        ${QT5_VERSION}x11extras \
+        ${QT5_VERSION}translations \
+        ${QT5_VERSION}imageformats \
+        ${QT5_VERSION}svg \
+        zlib1g-dev \
         libxi-dev \
         libxtst-dev \
-        zlib1g-dev \
+        # ubuntu:14.04 has no quazip (it's optional)
+        # libquazip5-dev \
+        mesa-common-dev \
         libyubikey-dev \
         libykpers-1-dev \
-        xvfb \
+        libqrencode-dev \
-        wget \
+        xclip \
-        file \
+        xvfb
-        fuse \
+
-        python
+ENV PATH="/opt/${QT5_VERSION}/bin:${PATH}"
+ENV CMAKE_PREFIX_PATH="/opt/${QT5_VERSION}/lib/cmake"
+ENV CMAKE_INCLUDE_PATH="/opt/keepassxc-libs/include"
+ENV CMAKE_LIBRARY_PATH="/opt/keepassxc-libs/lib/x86_64-linux-gnu"
+ENV CPATH="${CMAKE_INCLUDE_PATH}"
+ENV LD_LIBRARY_PATH="${CMAKE_LIBRARY_PATH}:/opt/${QT5_VERSION}/lib"
 
 RUN set -x \
-    && apt-get install --yes mesa-common-dev
+    && echo "/opt/${QT5_VERSION}/lib" > /etc/ld.so.conf.d/${QT5_VERSION}.conf \
+    && echo "/opt/keepassxc-libs/lib/x86_64-linux-gnu" > /etc/ld.so.conf.d/keepassxc.conf
+
+# AppImage dependencies
+RUN set -x \
+    && apt-get install -y \
+        curl \
+        libfuse2
+
+RUN set -x \
+    && curl -L "https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage" > /usr/bin/linuxdeploy \
+    && curl -L "https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/continuous/linuxdeploy-plugin-qt-x86_64.AppImage" > /usr/bin/linuxdeploy-plugin-qt \
+    && curl -L "https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage" > /usr/bin/appimagetool \
+    && chmod +x /usr/bin/linuxdeploy \
+    && chmod +x /usr/bin/linuxdeploy-plugin-qt \
+    && chmod +x /usr/bin/appimagetool
+
+RUN set -x \
+    && apt-get autoremove --purge \
+    && rm -rf /var/lib/apt/lists/*
 
 VOLUME /keepassxc/src
 VOLUME /keepassxc/out
 WORKDIR /keepassxc
-
-ENV CMAKE_PREFIX_PATH=/opt/${QT_VERSION}/lib/cmake
-ENV LD_LIBRARY_PATH=/opt/${QT_VERSION}/lib
-RUN set -x \
-    && echo /opt/${QT_VERSION}/lib > /etc/ld.so.conf.d/${QT_VERSION}.conf

INSTALL.md

@@ -1,11 +1,13 @@
-Install KeePassXC
+Build and Install KeePassXC
 =================
 
-This document will guide you across the steps to install KeePassXC.
+This document will guide you through the steps to build and install KeePassXC from source.
-You can visit the online version of this document a the following link
+You can visit the online version of this document at the following link:
 
 https://github.com/keepassxreboot/keepassx/wiki/Install-Instruction-from-Source
 
+The [KeePassXC QuickStart](./docs/QUICKSTART.md) gets you started using KeePassXC on your
+Windows, Mac, or Linux computer using the pre-built binaries.
 
 Build Dependencies
 ==================
@@ -23,48 +25,100 @@ The following libraries are required:
 * zlib
 * libmicrohttpd
 * libxi, libxtst, qtx11extras (optional for auto-type on X11)
-
+* libsodium (>= 1.0.12, optional for KeePassXC-Browser support)
+* libargon2
 
 Prepare the Building Environment
 ================================
 
-Building Environment on Linux    ==> https://github.com/keepassxreboot/keepassx/wiki/Building-Environment-on-Linux
+* [Building Environment on Linux](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Linux)
-Building Environment on Windows  ==> https://github.com/keepassxreboot/keepassx/wiki/Building-Environment-on-Windows
+* [Building Environment on Windows](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Windows)
-Building Environment on MacOS    ==> https://github.com/keepassxreboot/keepassx/wiki/Building-Environment-on-MacOS
+* [Building Environment on MacOS](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-OS-X)
-
 
 Build Steps
 ===========
+We recommend using the release tool to perform builds, please read up-to-date instructions [on our wiki](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC#building-using-the-release-tool).
 
 To compile from source, open a **Terminal (on Linux/MacOS)** or a **MSYS2-MinGW shell (on Windows)**<br/>
 **Note:** on Windows make sure you are using a **MINGW shell** by checking the label before the current path
 
-Navigate to the path you have downloaded KeePassXC and type these commands:
+First, download the KeePassXC [source tarball](https://keepassxc.org/download#source)
+or check out the latest version from our [Git repository](https://github.com/keepassxreboot/keepassxc).
+
+To clone the project from Git, `cd` to a suitable location and run
+
+```bash
+git clone https://github.com/keepassxreboot/keepassxc.git
+```
+
+This will clone the entire contents of the repository and check out the current `develop` branch.
+
+To update the project from within the project's folder, you can run the following command:
+
+```bash
+git pull
+```
+
+For a stable build, it is recommended to checkout the master branch.
+
+```bash
+git checkout master
+```
+
+Navigate to the directory where you have downloaded KeePassXC and type these commands:
 
 ```
+cd directory-where-sources-live
 mkdir build
 cd build
-cmake -DWITH_TESTS=OFF
+cmake -DWITH_XC_ALL=ON ..
 make
 ```
 
-**Note:** If you are on MacOS you must add this parameter to **Cmake**, with the Qt version you have installed<br/> `-DCMAKE_PREFIX_PATH=/usr/local/Cellar/qt5/5.6.2/lib/cmake/`
+If you are on Windows, you may have to add ```-G "MSYS Makefiles"``` to the beginning of the cmake command. See the [Windows Build Instructions](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC#windows) for more information.
 
-You will have the compiled KeePassXC binary inside the `./build/src/` directory.
+These steps place the compiled KeePassXC binary inside the `./build/src/` directory.
+(Note the cmake notes/options below.)
 
-Common cmake parameters
+**Cmake Notes:**
-```
--DCMAKE_INSTALL_PREFIX=/usr/local
--DCMAKE_VERBOSE_MAKEFILE=ON
--DCMAKE_BUILD_TYPE=<RelWithDebInfo/Debug/Release>
--DWITH_GUI_TESTS=ON
-```
 
+* Common cmake parameters
+
+	```
+	-DCMAKE_INSTALL_PREFIX=/usr/local
+	-DCMAKE_VERBOSE_MAKEFILE=ON
+	-DCMAKE_BUILD_TYPE=<RelWithDebInfo/Debug/Release>
+	-DWITH_GUI_TESTS=ON
+	```
+
+* cmake accepts the following options:
+
+	```
+	  -DWITH_XC_AUTOTYPE=[ON|OFF] Enable/Disable Auto-Type (default: ON)
+	  -DWITH_XC_YUBIKEY=[ON|OFF] Enable/Disable YubiKey HMAC-SHA1 authentication support (default: OFF)
+	  -DWITH_XC_BROWSER=[ON|OFF] Enable/Disable KeePassXC-Browser extension support (default: OFF)
+	  -DWITH_XC_NETWORKING=[ON|OFF] Enable/Disable Networking support (favicon download) (default: OFF)
+	  -DWITH_XC_SSHAGENT=[ON|OFF] Enable/Disable SSHAgent support (default: OFF)
+	  -DWITH_XC_KEESHARE=[ON|OFF] Enable/Disable KeeShare group syncronization extension (default: OFF)
+	  -DWITH_XC_TOUCHID=[ON|OFF] (macOS Only) Enable/Disable Touch ID unlock (default:OFF)
+	  -DWITH_XC_ALL=[ON|OFF] Enable/Disable compiling all plugins above (default: OFF)
+	  -DWITH_XC_KEESHARE_SECURE=[ON|OFF] Enable/Disable KeeShare secure containers, requires libquazip5 (default: OFF)
+	  -DWITH_TESTS=[ON|OFF] Enable/Disable building of unit tests (default: ON)
+	  -DWITH_GUI_TESTS=[ON|OFF] Enable/Disable building of GUI tests (default: OFF)
+	  -DWITH_DEV_BUILD=[ON|OFF] Enable/Disable deprecated method warnings (default: OFF)
+	  -DWITH_ASAN=[ON|OFF] Enable/Disable address sanitizer checks (Linux / macOS only) (default: OFF)
+	  -DWITH_COVERAGE=[ON|OFF] Enable/Disable coverage tests (GCC only) (default: OFF)
+	  -DWITH_APP_BUNDLE=[ON|OFF] Enable Application Bundle for macOS (default: ON)
+	```
+
+* If you are on MacOS you must add this parameter to **Cmake**, with the Qt version you have installed<br/> `-DCMAKE_PREFIX_PATH=/usr/local/Cellar/qt5/5.6.2/lib/cmake/`
+
+:exclamation: When building with ASan support on macOS, you need to use `export ASAN_OPTIONS=detect_leaks=0` before running the tests (no LSan support in macOS).
 
 Installation
 ============
 
-To install this binary execute the following:
+After you have successfully built KeePassXC, install the binary by executing the following:
 
 ```bash
 sudo make install

LICENSE.APACHE-2.0

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

LICENSE.MIT

@@ -0,0 +1,19 @@
+The MIT License (MIT)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,78 +1,56 @@
-# <img src="https://keepassxc.org/logo.png" width="40" height="40"/> KeePassXC [![Travis Build Status](https://travis-ci.org/keepassxreboot/keepassxc.svg?branch=develop)](https://travis-ci.org/keepassxreboot/keepassxc)  [![Coverage Status](https://coveralls.io/repos/github/keepassxreboot/keepassxc/badge.svg)](https://coveralls.io/github/keepassxreboot/keepassxc)
+# <img src="https://keepassxc.org/logo.png" width="40" height="40"/> KeePassXC
+[![TeamCity Build Status](https://ci.keepassxc.org/app/rest/builds/buildType:\(project:KeepassXC\)/statusIcon)](https://ci.keepassxc.org/?guest=1) [![codecov](https://codecov.io/gh/keepassxreboot/keepassxc/branch/develop/graph/badge.svg)](https://codecov.io/gh/keepassxreboot/keepassxc)
 
-KeePass Cross-platform Community Edition
+## About KeePassXC
+[KeePassXC](https://keepassxc.org) is a cross-platform community fork of
+[KeePassX](https://www.keepassx.org/).
+Our goal is to extend and improve it with new features and bugfixes
+to provide a feature-rich, fully cross-platform and modern
+open-source password manager.
 
-## About
+## Installation
-[KeePassXC](https://keepassxc.org) is a community fork of [KeePassX](https://www.keepassx.org/) with the goal to extend and improve it with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager.
+The [KeePassXC QuickStart](./docs/QUICKSTART.md) gets you started using
+KeePassXC on your Windows, Mac, or Linux computer using pre-compiled binaries
+from the [downloads page](https://keepassxc.org/download).
 
+Additionally, individual Linux distributions may ship their own versions,
+so please check out your distribution's package list to see if KeePassXC is available.
 
 ## Additional features compared to KeePassX
-- Auto-Type on all three major platforms (Linux, Windows, OS X)
+- Auto-Type on all three major platforms (Linux, Windows, macOS)
-- Stand-alone password generator
+- Twofish encryption
+- YubiKey challenge-response support
+- TOTP generation
+- CSV import
+- Command line interface
+- DEP and ASLR hardening
+- Stand-alone password and passphrase generator
 - Password strength meter
-- YubiKey HMAC-SHA1 authentication for unlocking databases
 - Using website favicons as entry icons
 - Merging of databases
 - Automatic reload when the database changed on disk
-- KeePassHTTP support for use with [PassIFox](https://addons.mozilla.org/en-us/firefox/addon/passifox/) in Mozilla Firefox and [chromeIPass](https://chrome.google.com/webstore/detail/chromeipass/ompiailgknfdndiefoaoiligalphfdae) in Google Chrome or Chromium, and [passafari](https://github.com/mmichaa/passafari.safariextension/) in Safari.
+- Browser integration with KeePassXC-Browser using [native messaging](https://developer.chrome.com/extensions/nativeMessaging) for [Mozilla Firefox](https://addons.mozilla.org/en-US/firefox/addon/keepassxc-browser/) and [Google Chrome or Chromium](https://chrome.google.com/webstore/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk)
+- Synchronize passwords using KeeShare. See [Using Sharing](./docs/QUICKSTART.md#using-sharing) for more details.
 - Many bug fixes
 
 For a full list of features and changes, read the [CHANGELOG](CHANGELOG) document.
 
-### Note about KeePassHTTP
+## Building KeePassXC
-KeePassHTTP is not a highly secure protocol and has certain flaw which allow an attacker to decrypt your passwords when they manage to intercept communication between a KeePassHTTP server and PassIFox/chromeIPass over a network connection (see [here](https://github.com/pfn/keepasshttp/issues/258) and [here](https://github.com/keepassxreboot/keepassxc/issues/147)). KeePassXC therefore strictly limits communication between itself and the browser plugin to your local computer. As long as your computer is not compromised, your passwords are fairly safe that way, but use it at your own risk!
 
-### Installation
+Detailed instructions are available in the [Build and Install](./INSTALL.md)
-Pre-compiled binaries can be found on the [downloads page](https://keepassxc.org/download).  Additionally, individual Linux distributions may ship their own versions, so please check out your distribution's package list to see if KeePassXC is available.
+page or on the [Wiki page](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC).
 
-### Building KeePassXC
+## Contributing
 
-*More detailed instructions are available in the INSTALL file or on the [Wiki page](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC).*
+We are always looking for suggestions how to improve our application.
-
+If you find any bugs or have an idea for a new feature, please let us know by
-First, you must download the KeePassXC [source tarball](https://keepassxc.org/download#source) or check out the latest version from our [Git repository](https://github.com/keepassxreboot/keepassxc).
+opening a report in our [issue tracker](https://github.com/keepassxreboot/keepassxc/issues)
-
+on GitHub or join us on IRC on freenode channels #keepassxc or #keepassxc-dev.
-To clone the project from Git, `cd` to a suitable location and run
-
-```bash
-git clone https://github.com/keepassxreboot/keepassxc.git
-```
-
-This will clone the entire contents of the repository and check out the current `develop` branch.
-
-To update the project from within the project's folder, you can run the following command:
-
-```bash
-git pull
-```
-
-Once you have downloaded the source code, you can `cd` into the source code directory, build and install KeePassXC:
-
-```bash
-mkdir build
-cd build
-cmake -DWITH_TESTS=OFF ..
-make -j8
-sudo make install
-```
-
-cmake accepts the following options:
-
-```
-  -DWITH_XC_AUTOTYPE=[ON|OFF] Enable/Disable Auto-Type (default: ON)
-  -DWITH_XC_HTTP=[ON|OFF] Enable/Disable KeePassHTTP and custom icon downloads (default: OFF)
-  -DWITH_XC_YUBIKEY=[ON|OFF] Enable/Disable YubiKey HMAC-SHA1 authentication support (default: OFF)
-
-  -DWITH_TESTS=[ON|OFF] Enable/Disable building of unit tests (default: ON)
-  -DWITH_GUI_TESTS=[ON|OFF] Enable/Disable building of GUI tests (default: OFF)
-  -DWITH_DEV_BUILD=[ON|OFF] Enable/Disable deprecated method warnings (default: OFF)
-  -DWITH_ASAN=[ON|OFF] Enable/Disable address sanitizer checks (Linux only) (default: OFF)
-  -DWITH_COVERAGE=[ON|OFF] Enable/Disable coverage tests (GCC only) (default: OFF)
-```
-
-### Contributing
-
-We are always looking for suggestions how to improve our application. If you find any bugs or have an idea for a new feature, please let us know by opening a report in our [issue tracker](https://github.com/keepassxreboot/keepassxc/issues) on GitHub or join us on IRC on freenode channels #keepassxc or #keepassxc-dev.
 
 You can of course also directly contribute your own code. We are happy to accept your pull requests.
 
 Please read the [CONTRIBUTING document](.github/CONTRIBUTING.md) for further information.
+
+## License
+
+GPL-2 or GPL-3

ci/trusty/Dockerfile

@@ -0,0 +1,95 @@
+# KeePassXC Linux Release Build Dockerfile
+# Copyright (C) 2017 KeePassXC team <https://keepassxc.org/>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 2 or (at your option)
+# version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# TIP: check this Dockerfile using this online tool: https://www.fromlatest.io
+
+FROM ubuntu:14.04
+
+ENV REBUILD_COUNTER=5
+
+ENV QT5_VERSION=qt53
+ENV QT5_PPA_VERSION=${QT5_VERSION}2
+ENV TERM=xterm-256color
+
+RUN set -x \
+     && apt-get update -y \
+     && apt-get -y install software-properties-common
+
+RUN set -x \
+    && add-apt-repository ppa:beineri/opt-${QT5_PPA_VERSION}-trusty \
+    && add-apt-repository ppa:phoerious/keepassxc
+
+RUN set -x \
+    && apt-get -y update \
+    && apt-get -y --no-install-recommends install \
+        build-essential \
+        clang-3.6 \
+        libclang-common-3.6-dev \
+        clang-format-3.6 \
+        llvm-3.6 \
+        cmake3 \
+        make \
+        libgcrypt20-18-dev \
+        libargon2-0-dev \
+        libsodium-dev \
+        libcurl-no-gcrypt-dev \
+        ${QT5_VERSION}base \
+        ${QT5_VERSION}tools \
+        ${QT5_VERSION}x11extras \
+        ${QT5_VERSION}translations \
+        ${QT5_VERSION}svg \
+        zlib1g-dev \
+        libyubikey-dev \
+        libykpers-1-dev \
+        # ubuntu:14.04 has no quazip (it's optional)
+        # libquazip5-dev \
+        libxi-dev \
+        libxtst-dev \
+        libqrencode-dev \
+        xclip \
+        xvfb
+
+ENV PATH="/opt/${QT5_VERSION}/bin:${PATH}"
+ENV CMAKE_PREFIX_PATH="/opt/${QT5_VERSION}/lib/cmake"
+ENV CMAKE_INCLUDE_PATH="/opt/keepassxc-libs/include"
+ENV CMAKE_LIBRARY_PATH="/opt/keepassxc-libs/lib/x86_64-linux-gnu"
+ENV CPATH="${CMAKE_INCLUDE_PATH}"
+ENV LD_LIBRARY_PATH="${CMAKE_LIBRARY_PATH}:/opt/${QT5_VERSION}/lib"
+
+RUN set -x \
+    && echo "/opt/${QT5_VERSION}/lib" > /etc/ld.so.conf.d/${QT5_VERSION}.conf \
+    && echo "/opt/keepassxc-libs/lib/x86_64-linux-gnu" > /etc/ld.so.conf.d/keepassxc.conf
+
+# AppImage dependencies
+RUN set -x \
+    && apt-get install -y \
+        curl \
+        libfuse2
+
+RUN set -x \
+    && curl -L "https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage" > /usr/bin/linuxdeploy \
+    && curl -L "https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/continuous/linuxdeploy-plugin-qt-x86_64.AppImage" > /usr/bin/linuxdeploy-plugin-qt \
+    && curl -L "https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage" > /usr/bin/appimagetool \
+    && chmod +x /usr/bin/linuxdeploy \
+    && chmod +x /usr/bin/linuxdeploy-plugin-qt \
+    && chmod +x /usr/bin/appimagetool
+
+RUN set -x \
+    && apt-get autoremove --purge \
+    && rm -rf /var/lib/apt/lists/*
+
+VOLUME ["/keepassxc"]
+WORKDIR /keepassxc

cmake/CLangFormat.cmake

@@ -0,0 +1,64 @@
+#  Copyright (C) 2017 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set(EXCLUDED_DIRS
+        # third-party directories
+        src/zxcvbn/
+        # objective-c directories
+        src/touchid/
+        src/autotype/mac/
+        src/gui/macutils/)
+
+set(EXCLUDED_FILES
+        # third-party files
+        streams/qtiocompressor.cpp
+        streams/qtiocompressor.h
+        gui/KMessageWidget.h
+        gui/KMessageWidget.cpp
+        gui/MainWindowAdaptor.h
+        gui/MainWindowAdaptor.cpp
+        crypto/ssh/bcrypt_pbkdf.cpp
+        crypto/ssh/blf.h
+        crypto/ssh/blowfish.c
+        tests/modeltest.cpp
+        tests/modeltest.h
+        # objective-c files
+        core/ScreenLockListenerMac.h
+        core/ScreenLockListenerMac.cpp)
+
+file(GLOB_RECURSE ALL_SOURCE_FILES RELATIVE ${CMAKE_SOURCE_DIR} src/*.cpp src/*.h tests/*.cpp tests/*.h)
+foreach(SOURCE_FILE ${ALL_SOURCE_FILES})
+    foreach(EXCLUDED_DIR ${EXCLUDED_DIRS})
+        string(FIND ${SOURCE_FILE} ${EXCLUDED_DIR} SOURCE_FILE_EXCLUDED)
+        if(NOT ${SOURCE_FILE_EXCLUDED} EQUAL -1)
+            list(REMOVE_ITEM ALL_SOURCE_FILES ${SOURCE_FILE})
+        endif()
+    endforeach()
+    foreach(EXCLUDED_FILE ${EXCLUDED_FILES})
+        if(${SOURCE_FILE} MATCHES ".*${EXCLUDED_FILE}$")
+            list(REMOVE_ITEM ALL_SOURCE_FILES ${SOURCE_FILE})
+        endif()
+    endforeach()
+endforeach()
+
+add_custom_target(format)
+foreach(SOURCE_FILE ${ALL_SOURCE_FILES})
+    add_custom_command(
+            TARGET format
+            PRE_BUILD
+            COMMAND echo Formatting ${SOURCE_FILE}
+            COMMAND clang-format -style=file -i \"${SOURCE_FILE}\"
+            WORKING_DIRECTORY ${CMAKE_SOURCE_DIR})
+endforeach()

cmake/CodeCoverage.cmake

@@ -1,4 +1,4 @@
-# Copyright (c) 2012 - 2015, Lars Bilke
+# Copyright (c) 2012 - 2017, Lars Bilke
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without modification,
@@ -26,7 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
-#
+# CHANGES:
 #
 # 2012-01-31, Lars Bilke
 # - Enable Code Coverage
@@ -35,163 +35,269 @@
 # - Added support for Clang.
 # - Some additional usage instructions.
 #
+# 2016-02-03, Lars Bilke
+# - Refactored functions to use named parameters
+#
+# 2017-06-02, Lars Bilke
+# - Merged with modified version from github.com/ufz/ogs
+#
+#
 # USAGE:
-
-# 0. (Mac only) If you use Xcode 5.1 make sure to patch geninfo as described here:
-#      http://stackoverflow.com/a/22404544/80480
 #
 # 1. Copy this file into your cmake modules path.
 #
 # 2. Add the following line to your CMakeLists.txt:
-#      INCLUDE(CodeCoverage)
+#      include(CodeCoverage)
 #
-# 3. Set compiler flags to turn off optimization and enable coverage:
+# 3. Append necessary compiler flags:
-#    SET(CMAKE_CXX_FLAGS "-g -O0 -fprofile-arcs -ftest-coverage")
+#      APPEND_COVERAGE_COMPILER_FLAGS()
-#	 SET(CMAKE_C_FLAGS "-g -O0 -fprofile-arcs -ftest-coverage")
 #
-# 3. Use the function SETUP_TARGET_FOR_COVERAGE to create a custom make target
+# 4. If you need to exclude additional directories from the report, specify them
-#    which runs your test executable and produces a lcov code coverage report:
+#    using the COVERAGE_LCOV_EXCLUDES variable before calling SETUP_TARGET_FOR_COVERAGE_LCOV.
 #    Example:
-#	 SETUP_TARGET_FOR_COVERAGE(
+#      set(COVERAGE_LCOV_EXCLUDES 'dir1/*' 'dir2/*')
-#				my_coverage_target  # Name for custom target.
-#				test_driver         # Name of the test driver executable that runs the tests.
-#									# NOTE! This should always have a ZERO as exit code
-#									# otherwise the coverage generation will not complete.
-#				coverage            # Name of output directory.
-#				)
 #
-# 4. Build a Debug build:
+# 5. Use the functions described below to create a custom make target which
-#	 cmake -DCMAKE_BUILD_TYPE=Debug ..
+#    runs your test executable and produces a code coverage report.
-#	 make
-#	 make my_coverage_target
 #
+# 6. Build a Debug build:
+#      cmake -DCMAKE_BUILD_TYPE=Debug ..
+#      make
+#      make my_coverage_target
 #
 
+include(CMakeParseArguments)
+
 # Check prereqs
-FIND_PROGRAM( GCOV_PATH gcov )
+find_program( GCOV_PATH gcov )
-FIND_PROGRAM( LCOV_PATH lcov )
+find_program( LCOV_PATH  NAMES lcov lcov.bat lcov.exe lcov.perl)
-FIND_PROGRAM( GENHTML_PATH genhtml )
+find_program( GENHTML_PATH NAMES genhtml genhtml.perl genhtml.bat )
-FIND_PROGRAM( GCOVR_PATH gcovr PATHS ${CMAKE_SOURCE_DIR}/tests)
+find_program( GCOVR_PATH gcovr PATHS ${CMAKE_SOURCE_DIR}/scripts/test)
+find_program( SIMPLE_PYTHON_EXECUTABLE python )
 
-IF(NOT GCOV_PATH)
+if(NOT GCOV_PATH)
-	MESSAGE(FATAL_ERROR "gcov not found! Aborting...")
+    message(FATAL_ERROR "gcov not found! Aborting...")
-ENDIF() # NOT GCOV_PATH
+endif() # NOT GCOV_PATH
 
-IF("${CMAKE_CXX_COMPILER_ID}" MATCHES "(Apple)?[Cc]lang")
+if("${CMAKE_CXX_COMPILER_ID}" MATCHES "(Apple)?[Cc]lang")
-	IF("${CMAKE_CXX_COMPILER_VERSION}" VERSION_LESS 3)
+    if("${CMAKE_CXX_COMPILER_VERSION}" VERSION_LESS 3)
-		MESSAGE(FATAL_ERROR "Clang version must be 3.0.0 or greater! Aborting...")
+        message(FATAL_ERROR "Clang version must be 3.0.0 or greater! Aborting...")
-	ENDIF()
+    endif()
-ELSEIF(NOT CMAKE_COMPILER_IS_GNUCXX)
+elseif(NOT CMAKE_COMPILER_IS_GNUCXX)
-	MESSAGE(FATAL_ERROR "Compiler is not GNU gcc! Aborting...")
+    message(FATAL_ERROR "Compiler is not GNU gcc! Aborting...")
-ENDIF() # CHECK VALID COMPILER
+endif()
 
-SET(CMAKE_CXX_FLAGS_COVERAGE
+set(COVERAGE_COMPILER_FLAGS "-g -O0 --coverage -fprofile-arcs -ftest-coverage"
-    "-g -O0 --coverage -fprofile-arcs -ftest-coverage"
+    CACHE INTERNAL "")
+
+set(CMAKE_CXX_FLAGS_COVERAGE
+    ${COVERAGE_COMPILER_FLAGS}
     CACHE STRING "Flags used by the C++ compiler during coverage builds."
     FORCE )
-SET(CMAKE_C_FLAGS_COVERAGE
+set(CMAKE_C_FLAGS_COVERAGE
-    "-g -O0 --coverage -fprofile-arcs -ftest-coverage"
+    ${COVERAGE_COMPILER_FLAGS}
     CACHE STRING "Flags used by the C compiler during coverage builds."
     FORCE )
-SET(CMAKE_EXE_LINKER_FLAGS_COVERAGE
+set(CMAKE_EXE_LINKER_FLAGS_COVERAGE
     ""
     CACHE STRING "Flags used for linking binaries during coverage builds."
     FORCE )
-SET(CMAKE_SHARED_LINKER_FLAGS_COVERAGE
+set(CMAKE_SHARED_LINKER_FLAGS_COVERAGE
     ""
     CACHE STRING "Flags used by the shared libraries linker during coverage builds."
     FORCE )
-MARK_AS_ADVANCED(
+mark_as_advanced(
     CMAKE_CXX_FLAGS_COVERAGE
     CMAKE_C_FLAGS_COVERAGE
     CMAKE_EXE_LINKER_FLAGS_COVERAGE
     CMAKE_SHARED_LINKER_FLAGS_COVERAGE )
 
-IF ( NOT (CMAKE_BUILD_TYPE STREQUAL "Debug" OR CMAKE_BUILD_TYPE STREQUAL "Coverage"))
+if(NOT CMAKE_BUILD_TYPE STREQUAL "Debug")
-  MESSAGE( WARNING "Code coverage results with an optimized (non-Debug) build may be misleading" )
+    message(WARNING "Code coverage results with an optimised (non-Debug) build may be misleading")
-ENDIF() # NOT CMAKE_BUILD_TYPE STREQUAL "Debug"
+endif() # NOT CMAKE_BUILD_TYPE STREQUAL "Debug"
 
+if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+    link_libraries(gcov)
+else()
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} --coverage")
+endif()
 
-# Param _targetname     The name of new the custom make target
+# Defines a target for running and collection code coverage information
-# Param _testrunner     The name of the target which runs the tests.
+# Builds dependencies, runs the given executable and outputs reports.
-#						MUST return ZERO always, even on errors.
+# NOTE! The executable should always have a ZERO as exit code otherwise
-#						If not, no coverage report will be created!
+# the coverage generation will not complete.
-# Param _outputname     lcov output is generated as _outputname.info
+#
-#                       HTML report is generated in _outputname/index.html
+# SETUP_TARGET_FOR_COVERAGE_LCOV(
-# Optional fourth parameter is passed as arguments to _testrunner
+#     NAME testrunner_coverage                    # New target name
-#   Pass them in list form, e.g.: "-j;2" for -j 2
+#     EXECUTABLE testrunner -j ${PROCESSOR_COUNT} # Executable in PROJECT_BINARY_DIR
-FUNCTION(SETUP_TARGET_FOR_COVERAGE _targetname _testrunner _outputname)
+#     DEPENDENCIES testrunner                     # Dependencies to build first
+# )
+function(SETUP_TARGET_FOR_COVERAGE_LCOV)
 
-	IF(NOT LCOV_PATH)
+    set(options NONE)
-		MESSAGE(FATAL_ERROR "lcov not found! Aborting...")
+    set(oneValueArgs NAME)
-	ENDIF() # NOT LCOV_PATH
+    set(multiValueArgs EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+    cmake_parse_arguments(Coverage "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
 
-	IF(NOT GENHTML_PATH)
+    if(NOT LCOV_PATH)
-		MESSAGE(FATAL_ERROR "genhtml not found! Aborting...")
+        message(FATAL_ERROR "lcov not found! Aborting...")
-	ENDIF() # NOT GENHTML_PATH
+    endif() # NOT LCOV_PATH
 
-	SET(coverage_info "${CMAKE_BINARY_DIR}/${_outputname}.info")
+    if(NOT GENHTML_PATH)
-	SET(coverage_cleaned "${coverage_info}.cleaned")
+        message(FATAL_ERROR "genhtml not found! Aborting...")
+    endif() # NOT GENHTML_PATH
 
-	SEPARATE_ARGUMENTS(test_command UNIX_COMMAND "${_testrunner}")
+    # Setup target
+    add_custom_target(${Coverage_NAME}
 
-	# Setup target
+        # Cleanup lcov
-	ADD_CUSTOM_TARGET(${_targetname}
+        COMMAND ${LCOV_PATH} --gcov-tool ${GCOV_PATH} -directory . --zerocounters
+        # Create baseline to make sure untouched files show up in the report
+        COMMAND ${LCOV_PATH} --gcov-tool ${GCOV_PATH} -c -i -d . -o ${Coverage_NAME}.base
 
-		# Cleanup lcov
+        # Run tests
-		${LCOV_PATH} --directory . --zerocounters
+        COMMAND ${Coverage_EXECUTABLE}
 
-		# Run tests
+        # Capturing lcov counters and generating report
-		COMMAND ${test_command} ${ARGV3}
+        COMMAND ${LCOV_PATH} --gcov-tool ${GCOV_PATH} --directory . --capture --output-file ${Coverage_NAME}.info
+        # add baseline counters
+        COMMAND ${LCOV_PATH} --gcov-tool ${GCOV_PATH} -a ${Coverage_NAME}.base -a ${Coverage_NAME}.info --output-file ${Coverage_NAME}.total
+        COMMAND ${LCOV_PATH} --gcov-tool ${GCOV_PATH} --remove ${Coverage_NAME}.total ${COVERAGE_LCOV_EXCLUDES} --output-file ${PROJECT_BINARY_DIR}/${Coverage_NAME}.info.cleaned
+        COMMAND ${GENHTML_PATH} -o ${Coverage_NAME} ${PROJECT_BINARY_DIR}/${Coverage_NAME}.info.cleaned
+        COMMAND ${CMAKE_COMMAND} -E remove ${Coverage_NAME}.base ${Coverage_NAME}.total ${PROJECT_BINARY_DIR}/${Coverage_NAME}.info.cleaned
 
-		# Capturing lcov counters and generating report
+        WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
-		COMMAND ${LCOV_PATH} --directory . --capture --output-file ${coverage_info}
+        DEPENDS ${Coverage_DEPENDENCIES}
-		COMMAND ${LCOV_PATH} --remove ${coverage_info} 'tests/*' '/usr/*' --output-file ${coverage_cleaned}
+        COMMENT "Resetting code coverage counters to zero.\nProcessing code coverage counters and generating report."
-		COMMAND ${GENHTML_PATH} -o ${_outputname} ${coverage_cleaned}
+    )
-		COMMAND ${CMAKE_COMMAND} -E remove ${coverage_info} ${coverage_cleaned}
 
-		WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+    # Show where to find the lcov info report
-		COMMENT "Resetting code coverage counters to zero.\nProcessing code coverage counters and generating report."
+    add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
-	)
+        COMMAND ;
+        COMMENT "Lcov code coverage info report saved in ${Coverage_NAME}.info."
+    )
 
-	# Show info where to find the report
+    # Show info where to find the report
-	ADD_CUSTOM_COMMAND(TARGET ${_targetname} POST_BUILD
+    add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
-		COMMAND ;
+        COMMAND ;
-		COMMENT "Open ./${_outputname}/index.html in your browser to view the coverage report."
+        COMMENT "Open ./${Coverage_NAME}/index.html in your browser to view the coverage report."
-	)
+    )
 
-ENDFUNCTION() # SETUP_TARGET_FOR_COVERAGE
+endfunction() # SETUP_TARGET_FOR_COVERAGE_LCOV
 
-# Param _targetname     The name of new the custom make target
+# Defines a target for running and collection code coverage information
-# Param _testrunner     The name of the target which runs the tests
+# Builds dependencies, runs the given executable and outputs reports.
-# Param _outputname     cobertura output is generated as _outputname.xml
+# NOTE! The executable should always have a ZERO as exit code otherwise
-# Optional fourth parameter is passed as arguments to _testrunner
+# the coverage generation will not complete.
-#   Pass them in list form, e.g.: "-j;2" for -j 2
+#
-FUNCTION(SETUP_TARGET_FOR_COVERAGE_COBERTURA _targetname _testrunner _outputname)
+# SETUP_TARGET_FOR_COVERAGE_GCOVR_XML(
+#     NAME ctest_coverage                    # New target name
+#     EXECUTABLE ctest -j ${PROCESSOR_COUNT} # Executable in PROJECT_BINARY_DIR
+#     DEPENDENCIES executable_target         # Dependencies to build first
+# )
+function(SETUP_TARGET_FOR_COVERAGE_GCOVR_XML)
 
-	IF(NOT PYTHON_EXECUTABLE)
+    set(options NONE)
-		MESSAGE(FATAL_ERROR "Python not found! Aborting...")
+    set(oneValueArgs NAME)
-	ENDIF() # NOT PYTHON_EXECUTABLE
+    set(multiValueArgs EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+    cmake_parse_arguments(Coverage "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
 
-	IF(NOT GCOVR_PATH)
+    if(NOT SIMPLE_PYTHON_EXECUTABLE)
-		MESSAGE(FATAL_ERROR "gcovr not found! Aborting...")
+        message(FATAL_ERROR "python not found! Aborting...")
-	ENDIF() # NOT GCOVR_PATH
+    endif() # NOT SIMPLE_PYTHON_EXECUTABLE
 
-	ADD_CUSTOM_TARGET(${_targetname}
+    if(NOT GCOVR_PATH)
+        message(FATAL_ERROR "gcovr not found! Aborting...")
+    endif() # NOT GCOVR_PATH
 
-		# Run tests
+    # Combine excludes to several -e arguments
-		${_testrunner} ${ARGV3}
+    set(GCOVR_EXCLUDES "")
+    foreach(EXCLUDE ${COVERAGE_GCOVR_EXCLUDES})
+        list(APPEND GCOVR_EXCLUDES "-e")
+        list(APPEND GCOVR_EXCLUDES "${EXCLUDE}")
+    endforeach()
 
-		# Running gcovr
+    add_custom_target(${Coverage_NAME}
-		COMMAND ${GCOVR_PATH} -x -r ${CMAKE_SOURCE_DIR} -e '${CMAKE_SOURCE_DIR}/tests/'  -o ${_outputname}.xml
+        # Run tests
-		WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+        ${Coverage_EXECUTABLE}
-		COMMENT "Running gcovr to produce Cobertura code coverage report."
-	)
 
-	# Show info where to find the report
+        # Running gcovr
-	ADD_CUSTOM_COMMAND(TARGET ${_targetname} POST_BUILD
+        COMMAND ${GCOVR_PATH} --xml
-		COMMAND ;
+            -r ${PROJECT_SOURCE_DIR} ${GCOVR_EXCLUDES}
-		COMMENT "Cobertura code coverage report saved in ${_outputname}.xml."
+            --object-directory=${PROJECT_BINARY_DIR}
-	)
+            -o ${Coverage_NAME}.xml
+        WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+        DEPENDS ${Coverage_DEPENDENCIES}
+        COMMENT "Running gcovr to produce Cobertura code coverage report."
+    )
 
-ENDFUNCTION() # SETUP_TARGET_FOR_COVERAGE_COBERTURA
+    # Show info where to find the report
+    add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+        COMMAND ;
+        COMMENT "Cobertura code coverage report saved in ${Coverage_NAME}.xml."
+    )
+
+endfunction() # SETUP_TARGET_FOR_COVERAGE_GCOVR_XML
+
+# Defines a target for running and collection code coverage information
+# Builds dependencies, runs the given executable and outputs reports.
+# NOTE! The executable should always have a ZERO as exit code otherwise
+# the coverage generation will not complete.
+#
+# SETUP_TARGET_FOR_COVERAGE_GCOVR_HTML(
+#     NAME ctest_coverage                    # New target name
+#     EXECUTABLE ctest -j ${PROCESSOR_COUNT} # Executable in PROJECT_BINARY_DIR
+#     DEPENDENCIES executable_target         # Dependencies to build first
+# )
+function(SETUP_TARGET_FOR_COVERAGE_GCOVR_HTML)
+
+    set(options NONE)
+    set(oneValueArgs NAME)
+    set(multiValueArgs EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+    cmake_parse_arguments(Coverage "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
+
+    if(NOT SIMPLE_PYTHON_EXECUTABLE)
+        message(FATAL_ERROR "python not found! Aborting...")
+    endif() # NOT SIMPLE_PYTHON_EXECUTABLE
+
+    if(NOT GCOVR_PATH)
+        message(FATAL_ERROR "gcovr not found! Aborting...")
+    endif() # NOT GCOVR_PATH
+
+    # Combine excludes to several -e arguments
+    set(GCOVR_EXCLUDES "")
+    foreach(EXCLUDE ${COVERAGE_GCOVR_EXCLUDES})
+        list(APPEND GCOVR_EXCLUDES "-e")
+        list(APPEND GCOVR_EXCLUDES "${EXCLUDE}")
+    endforeach()
+
+    add_custom_target(${Coverage_NAME}
+        # Run tests
+        ${Coverage_EXECUTABLE}
+
+        # Create folder
+        COMMAND ${CMAKE_COMMAND} -E make_directory ${PROJECT_BINARY_DIR}/${Coverage_NAME}
+
+        # Running gcovr
+        COMMAND ${GCOVR_PATH} --html --html-details
+            -r ${PROJECT_SOURCE_DIR} ${GCOVR_EXCLUDES}
+            --object-directory=${PROJECT_BINARY_DIR}
+            -o ${Coverage_NAME}/index.html
+        WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+        DEPENDS ${Coverage_DEPENDENCIES}
+        COMMENT "Running gcovr to produce HTML code coverage report."
+    )
+
+    # Show info where to find the report
+    add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+        COMMAND ;
+        COMMENT "Open ./${Coverage_NAME}/index.html in your browser to view the coverage report."
+    )
+
+endfunction() # SETUP_TARGET_FOR_COVERAGE_GCOVR_HTML
+
+function(APPEND_COVERAGE_COMPILER_FLAGS)
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${COVERAGE_COMPILER_FLAGS}" PARENT_SCOPE)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${COVERAGE_COMPILER_FLAGS}" PARENT_SCOPE)
+    message(STATUS "Appending code coverage compiler flags: ${COVERAGE_COMPILER_FLAGS}")
+endfunction() # APPEND_COVERAGE_COMPILER_FLAGS

cmake/FindArgon2.cmake

@@ -0,0 +1,36 @@
+#  Copyright (C) 2017 KeePassXC Team
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+find_path(ARGON2_INCLUDE_DIR argon2.h)
+if(MINGW)
+    # find static library on Windows, and redefine used symbols to
+    # avoid definition name conflicts with libsodium
+    find_library(ARGON2_SYS_LIBRARIES libargon2.a)
+    message(STATUS "Patching libargon2...\n")
+    execute_process(COMMAND objcopy
+            --redefine-sym argon2_hash=libargon2_argon2_hash
+            --redefine-sym _argon2_hash=_libargon2_argon2_hash
+            --redefine-sym argon2_error_message=libargon2_argon2_error_message
+            --redefine-sym _argon2_error_message=_libargon2_argon2_error_message
+            ${ARGON2_SYS_LIBRARIES} ${CMAKE_BINARY_DIR}/libargon2_patched.a
+            WORKING_DIRECTORY ${CMAKE_BINARY_DIR})
+    find_library(ARGON2_LIBRARIES libargon2_patched.a PATHS ${CMAKE_BINARY_DIR} NO_DEFAULT_PATH)
+else()
+    find_library(ARGON2_LIBRARIES argon2)
+endif()
+mark_as_advanced(ARGON2_LIBRARIES ARGON2_INCLUDE_DIR)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Argon2 DEFAULT_MSG ARGON2_LIBRARIES ARGON2_INCLUDE_DIR)

cmake/FindGcrypt.cmake

@@ -22,7 +22,7 @@ mark_as_advanced(GCRYPT_LIBRARIES GCRYPT_INCLUDE_DIR)
 if(GCRYPT_INCLUDE_DIR AND EXISTS "${GCRYPT_INCLUDE_DIR}/gcrypt.h")
     file(STRINGS "${GCRYPT_INCLUDE_DIR}/gcrypt.h" GCRYPT_H REGEX "^#define GCRYPT_VERSION \"[^\"]*\"$")
     string(REGEX REPLACE "^.*GCRYPT_VERSION \"([0-9]+).*$" "\\1" GCRYPT_VERSION_MAJOR "${GCRYPT_H}")
-    string(REGEX REPLACE "^.*GCRYPT_VERSION \"[0-9]+\\.([0-9]+).*$" "\\1" GCRYPT_VERSION_MINOR  "${GCRYPT_H}")
+    string(REGEX REPLACE "^.*GCRYPT_VERSION \"[0-9]+\\.([0-9]+).*$" "\\1" GCRYPT_VERSION_MINOR "${GCRYPT_H}")
     string(REGEX REPLACE "^.*GCRYPT_VERSION \"[0-9]+\\.[0-9]+\\.([0-9]+).*$" "\\1" GCRYPT_VERSION_PATCH "${GCRYPT_H}")
     set(GCRYPT_VERSION_STRING "${GCRYPT_VERSION_MAJOR}.${GCRYPT_VERSION_MINOR}.${GCRYPT_VERSION_PATCH}")
 endif()

cmake/FindLibGPGError.cmake

@@ -14,10 +14,10 @@
 #  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 find_path(GPGERROR_INCLUDE_DIR gpg-error.h)
-
 find_library(GPGERROR_LIBRARIES gpg-error)
 
 mark_as_advanced(GPGERROR_LIBRARIES GPGERROR_INCLUDE_DIR)
 
 include(FindPackageHandleStandardArgs)
+include_directories(${GPGERROR_INCLUDE_DIR})
 find_package_handle_standard_args(LibGPGError DEFAULT_MSG GPGERROR_LIBRARIES GPGERROR_INCLUDE_DIR)

cmake/FindQREncode.cmake

@@ -0,0 +1,22 @@
+#  Copyright (C) 2017 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+find_path(QRENCODE_INCLUDE_DIR qrencode.h)
+find_library(QRENCODE_LIBRARY qrencode)
+
+mark_as_advanced(QRENCODE_LIBRARY QRENCODE_INCLUDE_DIR)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(QREncode DEFAULT_MSG QRENCODE_LIBRARY QRENCODE_INCLUDE_DIR)

cmake/FindQuaZip.cmake

@@ -0,0 +1,41 @@
+# QUAZIP_FOUND               - QuaZip library was found
+# QUAZIP_INCLUDE_DIR         - Path to QuaZip include dir
+# QUAZIP_INCLUDE_DIRS        - Path to QuaZip and zlib include dir (combined from QUAZIP_INCLUDE_DIR + ZLIB_INCLUDE_DIR)
+# QUAZIP_LIBRARIES           - List of QuaZip libraries
+# QUAZIP_ZLIB_INCLUDE_DIR    - The include dir of zlib headers
+
+IF(QUAZIP_INCLUDE_DIRS AND QUAZIP_LIBRARIES)
+  # in cache already
+  SET(QUAZIP_FOUND TRUE)
+ELSE(QUAZIP_INCLUDE_DIRS AND QUAZIP_LIBRARIES)
+    IF(Qt5Core_FOUND)
+        set(QUAZIP_LIB_VERSION_SUFFIX 5)
+    ENDIF()
+  IF(WIN32)
+    FIND_PATH(QUAZIP_LIBRARY_DIR
+      WIN32_DEBUG_POSTFIX d
+      NAMES libquazip${QUAZIP_LIB_VERSION_SUFFIX}.dll
+      HINTS "C:/Programme/" "C:/Program Files"
+      PATH_SUFFIXES QuaZip/lib
+    )
+    FIND_LIBRARY(QUAZIP_LIBRARIES NAMES libquazip${QUAZIP_LIB_VERSION_SUFFIX}.dll HINTS ${QUAZIP_LIBRARY_DIR})
+    FIND_PATH(QUAZIP_INCLUDE_DIR NAMES quazip.h HINTS ${QUAZIP_LIBRARY_DIR}/../ PATH_SUFFIXES include/quazip5)
+    FIND_PATH(QUAZIP_ZLIB_INCLUDE_DIR NAMES zlib.h)
+  ELSE(WIN32)
+    FIND_PACKAGE(PkgConfig)
+    pkg_check_modules(PC_QUAZIP quazip)
+    FIND_LIBRARY(QUAZIP_LIBRARIES
+      WIN32_DEBUG_POSTFIX d
+      NAMES quazip${QUAZIP_LIB_VERSION_SUFFIX}
+      HINTS /usr/lib /usr/lib64
+    )
+    FIND_PATH(QUAZIP_INCLUDE_DIR quazip.h
+      HINTS /usr/include /usr/local/include
+      PATH_SUFFIXES quazip${QUAZIP_LIB_VERSION_SUFFIX}
+    )
+    FIND_PATH(QUAZIP_ZLIB_INCLUDE_DIR zlib.h HINTS /usr/include /usr/local/include)
+  ENDIF(WIN32)
+  INCLUDE(FindPackageHandleStandardArgs)
+  SET(QUAZIP_INCLUDE_DIRS ${QUAZIP_INCLUDE_DIR} ${QUAZIP_ZLIB_INCLUDE_DIR})
+  find_package_handle_standard_args(QUAZIP DEFAULT_MSG  QUAZIP_LIBRARIES QUAZIP_INCLUDE_DIR QUAZIP_ZLIB_INCLUDE_DIR QUAZIP_INCLUDE_DIRS)
+ENDIF(QUAZIP_INCLUDE_DIRS AND QUAZIP_LIBRARIES)

cmake/FindYubiKey.cmake

@@ -17,8 +17,8 @@ find_path(YUBIKEY_CORE_INCLUDE_DIR yubikey.h)
 find_path(YUBIKEY_PERS_INCLUDE_DIR ykcore.h PATH_SUFFIXES ykpers-1)
 set(YUBIKEY_INCLUDE_DIRS ${YUBIKEY_CORE_INCLUDE_DIR} ${YUBIKEY_PERS_INCLUDE_DIR})
 
-find_library(YUBIKEY_CORE_LIBRARY yubikey)
+find_library(YUBIKEY_CORE_LIBRARY NAMES yubikey.dll libyubikey.so yubikey)
-find_library(YUBIKEY_PERS_LIBRARY ykpers-1)
+find_library(YUBIKEY_PERS_LIBRARY NAMES ykpers-1.dll libykpers-1.so ykpers-1)
 set(YUBIKEY_LIBRARIES ${YUBIKEY_CORE_LIBRARY} ${YUBIKEY_PERS_LIBRARY})
 
 include(FindPackageHandleStandardArgs)

cmake/Findsodium.cmake

@@ -0,0 +1,267 @@
+# Written in 2016 by Henrik Steffen Gaßmann <henrik@gassmann.onl>
+#
+# To the extent possible under law, the author(s) have dedicated all
+# copyright and related and neighboring rights to this software to the
+# public domain worldwide. This software is distributed without any warranty.
+#
+# You should have received a copy of the CC0 Public Domain Dedication
+# along with this software. If not, see
+#
+#     http://creativecommons.org/publicdomain/zero/1.0/
+#
+########################################################################
+# Tries to find the local libsodium installation.
+#
+# On Windows the sodium_DIR environment variable is used as a default
+# hint which can be overridden by setting the corresponding cmake variable.
+#
+# Once done the following variables will be defined:
+#
+#   sodium_FOUND
+#   sodium_INCLUDE_DIR
+#   sodium_LIBRARY_DEBUG
+#   sodium_LIBRARY_RELEASE
+#
+#
+# Furthermore an imported "sodium" target is created.
+#
+
+if (CMAKE_C_COMPILER_ID STREQUAL "GNU"
+    OR CMAKE_C_COMPILER_ID STREQUAL "Clang")
+    set(_GCC_COMPATIBLE 1)
+endif()
+
+# static library option
+option(sodium_USE_STATIC_LIBS "enable to statically link against sodium")
+if(NOT (sodium_USE_STATIC_LIBS EQUAL sodium_USE_STATIC_LIBS_LAST))
+    unset(sodium_LIBRARY CACHE)
+    unset(sodium_LIBRARY_DEBUG CACHE)
+    unset(sodium_LIBRARY_RELEASE CACHE)
+    unset(sodium_DLL_DEBUG CACHE)
+    unset(sodium_DLL_RELEASE CACHE)
+    set(sodium_USE_STATIC_LIBS_LAST ${sodium_USE_STATIC_LIBS} CACHE INTERNAL "internal change tracking variable")
+endif()
+
+
+########################################################################
+# UNIX
+if (UNIX)
+    # import pkg-config
+    find_package(PkgConfig QUIET)
+    if (PKG_CONFIG_FOUND)
+        pkg_check_modules(sodium_PKG QUIET libsodium)
+    endif()
+
+    if(sodium_USE_STATIC_LIBS)
+        set(XPREFIX sodium_PKG_STATIC)
+    else()
+        set(XPREFIX sodium_PKG)
+    endif()
+
+    find_path(sodium_INCLUDE_DIR sodium.h
+        HINTS ${${XPREFIX}_INCLUDE_DIRS}
+    )
+    find_library(sodium_LIBRARY_DEBUG NAMES ${${XPREFIX}_LIBRARIES} sodium
+        HINTS ${${XPREFIX}_LIBRARY_DIRS}
+    )
+    find_library(sodium_LIBRARY_RELEASE NAMES ${${XPREFIX}_LIBRARIES} sodium
+        HINTS ${${XPREFIX}_LIBRARY_DIRS}
+    )
+
+
+########################################################################
+# Windows
+elseif (WIN32)
+    set(sodium_DIR "$ENV{sodium_DIR}" CACHE FILEPATH "sodium install directory")
+    mark_as_advanced(sodium_DIR)
+
+    find_path(sodium_INCLUDE_DIR sodium.h
+        HINTS ${sodium_DIR}
+        PATH_SUFFIXES include
+    )
+
+    if (MSVC)
+        # detect target architecture
+        file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/arch.c" [=[
+            #if defined _M_IX86
+            #error ARCH_VALUE x86_32
+            #elif defined _M_X64
+            #error ARCH_VALUE x86_64
+            #endif
+            #error ARCH_VALUE unknown
+        ]=])
+        try_compile(_UNUSED_VAR "${CMAKE_CURRENT_BINARY_DIR}" "${CMAKE_CURRENT_BINARY_DIR}/arch.c"
+            OUTPUT_VARIABLE _COMPILATION_LOG
+        )
+        string(REGEX REPLACE ".*ARCH_VALUE ([a-zA-Z0-9_]+).*" "\\1" _TARGET_ARCH "${_COMPILATION_LOG}")
+
+        # construct library path
+        if (_TARGET_ARCH STREQUAL "x86_32")
+            string(APPEND _PLATFORM_PATH "Win32")
+        elseif(_TARGET_ARCH STREQUAL "x86_64")
+            string(APPEND _PLATFORM_PATH "x64")
+        else()
+            message(FATAL_ERROR "the ${_TARGET_ARCH} architecture is not supported by Findsodium.cmake.")
+        endif()
+        string(APPEND _PLATFORM_PATH "/$$CONFIG$$")
+
+        if (MSVC_VERSION LESS 1900)
+            math(EXPR _VS_VERSION "${MSVC_VERSION} / 10 - 60")
+        else()
+            math(EXPR _VS_VERSION "${MSVC_VERSION} / 10 - 50")
+        endif()
+        string(APPEND _PLATFORM_PATH "/v${_VS_VERSION}")
+
+        if (sodium_USE_STATIC_LIBS)
+            string(APPEND _PLATFORM_PATH "/static")
+        else()
+            string(APPEND _PLATFORM_PATH "/dynamic")
+        endif()
+
+        string(REPLACE "$$CONFIG$$" "Debug" _DEBUG_PATH_SUFFIX "${_PLATFORM_PATH}")
+        string(REPLACE "$$CONFIG$$" "Release" _RELEASE_PATH_SUFFIX "${_PLATFORM_PATH}")
+
+        find_library(sodium_LIBRARY_DEBUG libsodium.lib
+            HINTS ${sodium_DIR}
+            PATH_SUFFIXES ${_DEBUG_PATH_SUFFIX}
+        )
+        find_library(sodium_LIBRARY_RELEASE libsodium.lib
+            HINTS ${sodium_DIR}
+            PATH_SUFFIXES ${_RELEASE_PATH_SUFFIX}
+        )
+        if (NOT sodium_USE_STATIC_LIBS)
+            set(CMAKE_FIND_LIBRARY_SUFFIXES ".dll")
+            find_library(sodium_DLL_DEBUG libsodium
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES ${_DEBUG_PATH_SUFFIX}
+            )
+            find_library(sodium_DLL_RELEASE libsodium
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES ${_RELEASE_PATH_SUFFIX}
+            )
+        endif()
+
+    elseif(_GCC_COMPATIBLE)
+        if (sodium_USE_STATIC_LIBS)
+            find_library(sodium_LIBRARY_DEBUG libsodium.a
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES lib
+            )
+            find_library(sodium_LIBRARY_RELEASE libsodium.a
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES lib
+            )
+        else()
+            find_library(sodium_LIBRARY_DEBUG libsodium.dll.a
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES lib
+            )
+            find_library(sodium_LIBRARY_RELEASE libsodium.dll.a
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES lib
+            )
+
+            file(GLOB _DLL
+                LIST_DIRECTORIES false
+                RELATIVE "${sodium_DIR}/bin"
+                "${sodium_DIR}/bin/libsodium*.dll"
+            )
+            find_library(sodium_DLL_DEBUG ${_DLL} libsodium
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES bin
+            )
+            find_library(sodium_DLL_RELEASE ${_DLL} libsodium
+                HINTS ${sodium_DIR}
+                PATH_SUFFIXES bin
+            )
+        endif()
+    else()
+        message(FATAL_ERROR "this platform is not supported by FindSodium.cmake")
+    endif()
+
+
+########################################################################
+# unsupported
+else()
+    message(FATAL_ERROR "this platform is not supported by FindSodium.cmake")
+endif()
+
+
+########################################################################
+# common stuff
+
+# extract sodium version
+if (sodium_INCLUDE_DIR)
+    set(_VERSION_HEADER "${_INCLUDE_DIR}/sodium/version.h")
+    if (EXISTS _VERSION_HEADER)
+        file(READ "${_VERSION_HEADER}" _VERSION_HEADER_CONTENT)
+        string(REGEX REPLACE ".*#[ \t]*define[ \t]*SODIUM_VERSION_STRING[ \t]*\"([^\n]*)\".*" "\\1"
+            sodium_VERSION "${_VERSION_HEADER_CONTENT}")
+        set(sodium_VERSION "${sodium_VERSION}" PARENT_SCOPE)
+    endif()
+endif()
+
+# communicate results
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(sodium
+    REQUIRED_VARS
+        sodium_LIBRARY_RELEASE
+        sodium_LIBRARY_DEBUG
+        sodium_INCLUDE_DIR
+    VERSION_VAR
+        sodium_VERSION
+)
+
+# mark file paths as advanced
+mark_as_advanced(sodium_INCLUDE_DIR)
+mark_as_advanced(sodium_LIBRARY_DEBUG)
+mark_as_advanced(sodium_LIBRARY_RELEASE)
+if (WIN32)
+    mark_as_advanced(sodium_DLL_DEBUG)
+    mark_as_advanced(sodium_DLL_RELEASE)
+endif()
+
+# create imported target
+if(sodium_USE_STATIC_LIBS)
+    set(_LIB_TYPE STATIC)
+else()
+    set(_LIB_TYPE SHARED)
+endif()
+add_library(sodium ${_LIB_TYPE} IMPORTED)
+
+set_target_properties(sodium PROPERTIES
+    INTERFACE_INCLUDE_DIRECTORIES "${sodium_INCLUDE_DIR}"
+    IMPORTED_LINK_INTERFACE_LANGUAGES "C"
+)
+
+if (sodium_USE_STATIC_LIBS)
+    set_target_properties(sodium PROPERTIES
+        INTERFACE_COMPILE_DEFINITIONS "SODIUM_STATIC"
+        IMPORTED_LOCATION "${sodium_LIBRARY_RELEASE}"
+        IMPORTED_LOCATION_DEBUG "${sodium_LIBRARY_DEBUG}"
+    )
+else()
+    if (UNIX)
+        set_target_properties(sodium PROPERTIES
+            IMPORTED_LOCATION "${sodium_LIBRARY_RELEASE}"
+            IMPORTED_LOCATION_DEBUG "${sodium_LIBRARY_DEBUG}"
+        )
+    elseif (WIN32)
+        set_target_properties(sodium PROPERTIES
+            IMPORTED_IMPLIB "${sodium_LIBRARY_RELEASE}"
+            IMPORTED_IMPLIB_DEBUG "${sodium_LIBRARY_DEBUG}"
+        )
+        if (NOT (sodium_DLL_DEBUG MATCHES ".*-NOTFOUND"))
+            set_target_properties(sodium PROPERTIES
+                IMPORTED_LOCATION_DEBUG "${sodium_DLL_DEBUG}"
+            )
+        endif()
+        if (NOT (sodium_DLL_RELEASE MATCHES ".*-NOTFOUND"))
+            set_target_properties(sodium PROPERTIES
+                IMPORTED_LOCATION_RELWITHDEBINFO "${sodium_DLL_RELEASE}"
+                IMPORTED_LOCATION_MINSIZEREL "${sodium_DLL_RELEASE}"
+                IMPORTED_LOCATION_RELEASE "${sodium_DLL_RELEASE}"
+            )
+        endif()
+    endif()
+endif()

cmake/GenerateProductVersion.cmake

@@ -91,7 +91,7 @@ function(generate_product_version outfiles)
         set(PRODUCT_COMPANY_COPYRIGHT "Copyright (C) ${PRODUCT_CURRENT_YEAR} ${PRODUCT_COMPANY_NAME}")
     endif()
     if (NOT PRODUCT_COMMENTS OR "${PRODUCT_COMMENTS}" STREQUAL "")
-        set(PRODUCT_COMMENTS "${PRODUCT_NAME} v${PRODUCT_VERSION_MAJOR}.${PRODUCT_VERSION_MINOR}")
+        set(PRODUCT_COMMENTS "${PRODUCT_NAME} v${PRODUCT_VERSION_MAJOR}.${PRODUCT_VERSION_MINOR}.${PRODUCT_VERSION_PATCH}")
     endif()
     if (NOT PRODUCT_ORIGINAL_FILENAME OR "${PRODUCT_ORIGINAL_FILENAME}" STREQUAL "")
         set(PRODUCT_ORIGINAL_FILENAME "${PRODUCT_NAME}")

cmake/GetGitRevisionDescription.cmake

@@ -1,130 +0,0 @@
-# - Returns a version string from Git
-#
-# These functions force a re-configure on each git commit so that you can
-# trust the values of the variables in your build system.
-#
-#  get_git_head_revision(<refspecvar> <hashvar> [<additional arguments to git describe> ...])
-#
-# Returns the refspec and sha hash of the current head revision
-#
-#  git_describe(<var> [<additional arguments to git describe> ...])
-#
-# Returns the results of git describe on the source tree, and adjusting
-# the output so that it tests false if an error occurs.
-#
-#  git_get_exact_tag(<var> [<additional arguments to git describe> ...])
-#
-# Returns the results of git describe --exact-match on the source tree,
-# and adjusting the output so that it tests false if there was no exact
-# matching tag.
-#
-# Requires CMake 2.6 or newer (uses the 'function' command)
-#
-# Original Author:
-# 2009-2010 Ryan Pavlik <rpavlik@iastate.edu> <abiryan@ryand.net>
-# http://academic.cleardefinition.com
-# Iowa State University HCI Graduate Program/VRAC
-#
-# Copyright Iowa State University 2009-2010.
-# Distributed under the Boost Software License, Version 1.0.
-# (See accompanying file LICENSE.BOOST-1.0 or copy at
-# http://www.boost.org/LICENSE_1_0.txt)
-
-if(__get_git_revision_description)
-	return()
-endif()
-set(__get_git_revision_description YES)
-
-# We must run the following at "include" time, not at function call time,
-# to find the path to this module rather than the path to a calling list file
-get_filename_component(_gitdescmoddir ${CMAKE_CURRENT_LIST_FILE} PATH)
-
-function(get_git_head_revision _refspecvar _hashvar)
-	set(GIT_PARENT_DIR "${CMAKE_CURRENT_SOURCE_DIR}")
-	set(GIT_DIR "${GIT_PARENT_DIR}/.git")
-	while(NOT EXISTS "${GIT_DIR}")	# .git dir not found, search parent directories
-		set(GIT_PREVIOUS_PARENT "${GIT_PARENT_DIR}")
-		get_filename_component(GIT_PARENT_DIR ${GIT_PARENT_DIR} PATH)
-		if(GIT_PARENT_DIR STREQUAL GIT_PREVIOUS_PARENT)
-			# We have reached the root directory, we are not in git
-			set(${_refspecvar} "GITDIR-NOTFOUND" PARENT_SCOPE)
-			set(${_hashvar} "GITDIR-NOTFOUND" PARENT_SCOPE)
-			return()
-		endif()
-		set(GIT_DIR "${GIT_PARENT_DIR}/.git")
-	endwhile()
-	# check if this is a submodule
-	if(NOT IS_DIRECTORY ${GIT_DIR})
-		file(READ ${GIT_DIR} submodule)
-		string(REGEX REPLACE "gitdir: (.*)\n$" "\\1" GIT_DIR_RELATIVE ${submodule})
-		get_filename_component(SUBMODULE_DIR ${GIT_DIR} PATH)
-		get_filename_component(GIT_DIR ${SUBMODULE_DIR}/${GIT_DIR_RELATIVE} ABSOLUTE)
-	endif()
-	set(GIT_DATA "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/git-data")
-	if(NOT EXISTS "${GIT_DATA}")
-		file(MAKE_DIRECTORY "${GIT_DATA}")
-	endif()
-
-	if(NOT EXISTS "${GIT_DIR}/HEAD")
-		return()
-	endif()
-	set(HEAD_FILE "${GIT_DATA}/HEAD")
-	configure_file("${GIT_DIR}/HEAD" "${HEAD_FILE}" COPYONLY)
-
-	configure_file("${_gitdescmoddir}/GetGitRevisionDescription.cmake.in"
-		"${GIT_DATA}/grabRef.cmake"
-		@ONLY)
-	include("${GIT_DATA}/grabRef.cmake")
-
-	set(${_refspecvar} "${HEAD_REF}" PARENT_SCOPE)
-	set(${_hashvar} "${HEAD_HASH}" PARENT_SCOPE)
-endfunction()
-
-function(git_describe _var)
-	if(NOT GIT_FOUND)
-		find_package(Git QUIET)
-	endif()
-	get_git_head_revision(refspec hash)
-	if(NOT GIT_FOUND)
-		set(${_var} "GIT-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-	if(NOT hash)
-		set(${_var} "HEAD-HASH-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-
-	# TODO sanitize
-	#if((${ARGN}" MATCHES "&&") OR
-	#	(ARGN MATCHES "||") OR
-	#	(ARGN MATCHES "\\;"))
-	#	message("Please report the following error to the project!")
-	#	message(FATAL_ERROR "Looks like someone's doing something nefarious with git_describe! Passed arguments ${ARGN}")
-	#endif()
-
-	#message(STATUS "Arguments to execute_process: ${ARGN}")
-
-	execute_process(COMMAND
-		"${GIT_EXECUTABLE}"
-		describe
-		${hash}
-		${ARGN}
-		WORKING_DIRECTORY
-		"${CMAKE_SOURCE_DIR}"
-		RESULT_VARIABLE
-		res
-		OUTPUT_VARIABLE
-		out
-		ERROR_QUIET
-		OUTPUT_STRIP_TRAILING_WHITESPACE)
-	if(NOT res EQUAL 0)
-		set(out "${out}-${res}-NOTFOUND")
-	endif()
-
-	set(${_var} "${out}" PARENT_SCOPE)
-endfunction()
-
-function(git_get_exact_tag _var)
-	git_describe(out --exact-match ${ARGN})
-	set(${_var} "${out}" PARENT_SCOPE)
-endfunction()

cmake/GetGitRevisionDescription.cmake.in

@@ -1,41 +0,0 @@
-#
-# Internal file for GetGitRevisionDescription.cmake
-#
-# Requires CMake 2.6 or newer (uses the 'function' command)
-#
-# Original Author:
-# 2009-2010 Ryan Pavlik <rpavlik@iastate.edu> <abiryan@ryand.net>
-# http://academic.cleardefinition.com
-# Iowa State University HCI Graduate Program/VRAC
-#
-# Copyright Iowa State University 2009-2010.
-# Distributed under the Boost Software License, Version 1.0.
-# (See accompanying file LICENSE.BOOST-1.0 or copy at
-# http://www.boost.org/LICENSE_1_0.txt)
-
-set(HEAD_HASH)
-
-file(READ "@HEAD_FILE@" HEAD_CONTENTS LIMIT 1024)
-
-string(STRIP "${HEAD_CONTENTS}" HEAD_CONTENTS)
-if(HEAD_CONTENTS MATCHES "ref")
-	# named branch
-	string(REPLACE "ref: " "" HEAD_REF "${HEAD_CONTENTS}")
-	if(EXISTS "@GIT_DIR@/${HEAD_REF}")
-		configure_file("@GIT_DIR@/${HEAD_REF}" "@GIT_DATA@/head-ref" COPYONLY)
-	else()
-		configure_file("@GIT_DIR@/packed-refs" "@GIT_DATA@/packed-refs" COPYONLY)
-		file(READ "@GIT_DATA@/packed-refs" PACKED_REFS)
-		if(${PACKED_REFS} MATCHES "([0-9a-z]*) ${HEAD_REF}")
-			set(HEAD_HASH "${CMAKE_MATCH_1}")
-		endif()
-	endif()
-else()
-	# detached HEAD
-	configure_file("@GIT_DIR@/HEAD" "@GIT_DATA@/head-ref" COPYONLY)
-endif()
-
-if(NOT HEAD_HASH)
-	file(READ "@GIT_DATA@/head-ref" HEAD_HASH LIMIT 1024)
-	string(STRIP "${HEAD_HASH}" HEAD_HASH)
-endif()

docs/QUICKSTART.md

@@ -0,0 +1,131 @@
+# Quick Start for KeePassXC
+
+This procedure gets KeePassXC running on your computer with browser integration, 
+using the pre-built binaries available for [download](https://keepassxc.org/download) 
+from [KeePassXC site](https://keepassxc.org).
+
+**TL;DR** KeePassXC saves your passwords securely.
+When you double-click a URL in KeePassXC, it launches your default browser to that URL.
+With browser integration configured, KeePassXC automatically enters 
+username/password credentials into web page fields.
+
+## Installing and Starting KeePassXC
+
+* [Download the native installer](https://keepassxc.org/download) and install 
+KeePassXC for your  Windows, macOS, or Linux computer in the usual way for your platform.
+* Open the KeePassXC application.
+* Create a new database and give it a master key that's used to unlock the database file. 
+This database holds entries (usernames, passwords, account numbers, notes) 
+for all your websites, programs, etc.
+* Create a few entries - enter the username, password, URL, and optionally notes about the entry.
+* KeePassXC securely stores those entries in the database.
+
+
+## Setting up Browser Integration with KeePassXC
+
+* *Within KeePassXC*, go to **Tools->Settings** (on macOS, go to **KeePassXC->Preferences**.) 
+* In **Browser Integration**, check **Enable KeePassXC browser integration**
+* Right below that, click the checkbox for the browser(s) you use
+Leave the other options at their defaults.
+* *In your default web browser,* install the KeePassXC Browser extension/add-on. Instructions for [Firefox or Tor Browser](https://addons.mozilla.org/en-US/firefox/addon/keepassxc-browser/) or [Chrome](https://chrome.google.com/webstore/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk)
+* Click the KeePassXC icon in the upper-right corner. You'll see the dialog below. 
+* Click the blue Connect button to make the browser extension connect to the KeePassXC application. 
+<img src="./KeePassHTTP/KeePassXC-Connect.png" height="200" alt="KeePassXC Connect dialog">
+
+* *Switch back to KeePassXC.* You'll see a dialog (below) indicating that a request to connect has arrived. 
+* Give the connection a name (perhaps *Keepass-Browsername*, any unique name will suffice) and click OK to accept it.
+* This one-time operation connects KeePassXC and your browser.
+<img src="./KeePassHTTP/KeePassXC-Accept-Button.png" height="200" alt="KeePassXC accept connection dialog">
+
+## Using Browser Integration
+
+* *Within KeePassXC,* double-click the URL of an entry,
+or select it and type Ctrl+U (Cmd+U on macOS).
+* Your browser opens to that URL.
+* If there are username/password fields on that page, you will see the dialog below.
+Click *Allow* to confirm that KeePassXC may access the credentials to auto-fill the fields. 
+* Check *Remember this decision* to allow this each time you visit the page.
+<img src="./KeePassHTTP/KeePassXC-Confirm.png" height="200" alt="KeePassCX Confirm Access dialog">
+
+## Using Sharing
+
+Sharing allows you to share a subset of your credentials with others and vice versa.
+
+### Enable Sharing
+
+To use sharing, you need to enable for the application.
+
+1. Go to Tools &rarr; Settings
+2. Select the category KeeShare
+3. Check _Allow import_ if you want to import shared credentials
+4. Check _Allow export_ if you want to share credentials
+
+To make sure that your data is valid when im imported by another client, please _generate_ (or _import_) a public/private key pair and enter your _signer_ name. This way your client may verify that the imported data is valid. When Importing, you'll see the known sources with names and fingerprint in the list at the bottom. This is the place to _trust_ or _untrust_ signers. It is only possible to trust someone on application level.
+
+<img src="./KeeShare/AppSettings.png" height="600" width="800" alt="KeeShare Application Settings">
+
+### Sharing Credentials
+
+If you checked _Allow export_ in the Sharing settings you now are good to go to share some passwords with others. Sharing always is defined on a group. If you enable sharing on a group, every entry under this group or it's children is shared. If you enable sharing on the root node, **every password** inside your database gets shared!
+
+1. Open the edit sheet on a group you want to share
+1. Select the sharing section
+1. Choose _Export to path_ as the sharing method
+1. Choose a path to store the shared credentials to
+1. Generate a password for this share container
+
+The export file will not be generated automatically. Instead, each time the database is saved, the file gets written (so please deactivate the autosafe feature). If an old file is present, the old file will be overwritten! The file should be written to a location that is accessible by others. An easy setup is a network share or storing the file inside the cloud. 
+
+<img src="./KeeShare/GroupSettings_Export.png" height="600" width="800" alt="KeeShare Group Sharing Settings">
+
+### Using Shared Credentials
+
+Checking _Allow import_ in the Sharing settings of the database enables you to receive credentials from others. KeePass will watch sharing sources and import any changes immediately into your database using the synchronization feature.
+
+1. Create a group for import
+1. Open the edit sheet on that group
+1. Select the sharing section
+1. Choose _Import from path_ as the sharing method
+1. Choose a share container that is shared with you
+1. Enter the password for the shared container
+
+KeeShare observes the container for changes and merges them into your database when necessary. Importing merges in time order, so older data is moved to the history, which should have a sufficient size to prevent loss of needed data. 
+
+Please note, that the import currently is not restricted to the configured group. Every entry which was imported and moved outside the import group will be updated regardless of it's location!
+
+<img src="./KeeShare/GroupSettings_Import.png" height="600" width="800" alt="KeeShare Group Import Settings">
+
+### Using Synchronized Credentials
+
+Instead of using different groups for sharing and importing you can use a single group that acts as both. This way you can synchronize a number of credentials easily across many users without a lot of hassle.
+
+1. Open the edit sheet on a group you want to synchronize
+1. Select the sharing section
+1. Choose _Synchronize with path_ as the sharing method
+1. Choose a database that you want to use a synchronization file
+1. Enter the password for the database
+
+<img src="./KeeShare/GroupSettings_Sync.png" height="600" width="800" alt="KeeShare Group Synchronization Settings">
+
+### Disable Sharing for Credentials
+
+In case you don't want to share (import or export) some credentials, it is possible to you can 
+* use the application settings and uncheck the options or 
+* instead of selecting _Import from path_, _Export to path_ or _Synchronize with path_ you'll select _Inactive_ while leaving the path and the password untouched
+
+### Sharing overview
+
+There is a simple overview of shared groups to keep track of your data.
+
+1. Open the Database Settings
+1. Select the KeeShare category
+
+<img src="./KeeShare/DatabaseSettings.png" height="600" width="800" alt="KeeShare Group Sharing Ovewview">
+
+## Technical Details and Limitations of Sharing
+
+Sharing relies on the combination of file exports and imports as well as the synchronization mechanism provided by KeePassXC. Since the merge algorithm uses the history of entries to prevent data loss, this history must be enabled and have a sufficient size. Furthermore, the merge algorithm is location independend, therefore it does not matter if entries are moved outside of an import group. These entries will be updated none the less. Moving entries outside of export groups will prevent a further export of the entry, but it will not ensure that the already shared data will be removed from any client.
+
+KeeShare uses a custom certification mechanism to ensure that the source of the data is the expected one. This ensures that the data was exported by the signer but it is not possible to detect if someone replaced the data with an older version from a valid signer. To prevent this, the container could be placed at a location which is only writeable for valid signers.
+
+

release-tool

@@ -35,11 +35,11 @@ TAG_NAME=""
 DOCKER_IMAGE=""
 DOCKER_CONTAINER_NAME="keepassxc-build-container"
 CMAKE_OPTIONS=""
+CPACK_GENERATORS="WIX;ZIP"
 COMPILER="g++"
 MAKE_OPTIONS="-j8"
-BUILD_PLUGINS="autotype http yubikey"
+BUILD_PLUGINS="all"
 INSTALL_PREFIX="/usr/local"
-BUILD_SOURCE_TARBALL=true
 ORIG_BRANCH=""
 ORIG_CWD="$(pwd)"
 
@@ -50,14 +50,15 @@ printUsage() {
     local cmd
     if [ "" == "$1" ] || [ "help" == "$1" ]; then
         cmd="COMMAND"
-    elif [ "check" == "$1" ] || [ "merge" == "$1" ] || [ "build" == "$1" ] || [ "sign" == "$1" ]; then
+    elif [ "check" == "$1" ] || [ "merge" == "$1" ] || [ "build" == "$1" ] \
+        || [ "gpgsign" == "$1" ] || [ "appsign" == "$1" ] || [ "appimage" == "$1" ]; then
         cmd="$1"
     else
         logError "Unknown command: '$1'\n"
         cmd="COMMAND"
     fi
 
-    printf "\e[1mUsage:\e[0m $(basename $0) $cmd [--version x.y.z] [options]\n"
+    printf "\e[1mUsage:\e[0m $(basename $0) $cmd [options]\n"
 
     if [ "COMMAND" == "$cmd" ]; then
         cat << EOF
@@ -66,7 +67,8 @@ Commands:
   check      Perform a dry-run check, nothing is changed
   merge      Merge release branch into main branch and create release tags
   build      Build and package binary release from sources
-  sign       Sign previously compiled release packages
+  gpgsign    Sign previously compiled release packages with GPG
+  appsign    Sign binaries with code signing certificates on Windows and macOS
   help       Show help for the given command
 EOF
     elif [ "merge" == "$cmd" ]; then
@@ -78,7 +80,7 @@ Options:
   -v, --version        Release version number or name (required)
   -a, --app-name       Application name (default: '${APP_NAME}')
   -s, --source-dir     Source directory (default: '${SRC_DIR}')
-  -g, --gpg-key        GPG key used to sign the merge commit and release tag,
+  -k, --key            GPG key used to sign the merge commit and release tag,
                        leave empty to let Git choose your default key
                        (default: '${GPG_GIT_KEY}')
   -r, --release-branch Source release branch to merge from (default: 'release/VERSION')
@@ -104,24 +106,61 @@ Options:
                           This option has no effect if --build is not set.
       --container-name    Docker container name (default: '${DOCKER_CONTAINER_NAME}')
                           The container must not exist already
+      --snapcraft         Create and use docker image to build snapcraft distribution.
+                          This option has no effect if --docker-image is not set.
+      --appimage          Build a Linux AppImage after compilation.
+                          If this option is set, --install-prefix has no effect
+      --appsign           Perform platform specific App Signing before packaging
+  -k, --key               Specify the App Signing Key/Identity
   -c, --cmake-options     Additional CMake options for compiling the sources
       --compiler          Compiler to use (default: '${COMPILER}')
   -m, --make-options      Make options for compiling sources (default: '${MAKE_OPTIONS}')
+  -g, --generators        Additional CPack generators (default: '${CPACK_GENERATORS}')
   -i, --install-prefix    Install prefix (default: '${INSTALL_PREFIX}')
   -p, --plugins           Space-separated list of plugins to build
                           (default: ${BUILD_PLUGINS})
+      --snapshot          Don't checkout the release tag
   -n, --no-source-tarball Don't build source tarball
   -h, --help              Show this help
 EOF
-    elif [ "sign" == "$cmd" ]; then
+    elif [ "gpgsign" == "$cmd" ]; then
         cat << EOF
 
-Sign previously compiled release packages
+Sign previously compiled release packages with GPG
 
 Options:
-  -f, --files       Files to sign (required)
+  -f, --files        Files to sign (required)
-  -g, --gpg-key     GPG key used to sign the files (default: '${GPG_KEY}')
+  -k, --key          GPG key used to sign the files (default: '${GPG_KEY}')
-  -h, --help        Show this help
+  -h, --help         Show this help
+EOF
+    elif [ "appsign" == "$cmd" ]; then
+        cat << EOF
+
+Sign binaries with code signing certificates on Windows and macOS
+
+Options:
+  -f, --files        Files to sign (required)
+  -k, --key          Signing Key or Apple Developer ID
+  -h, --help         Show this help
+EOF
+    elif [ "appimage" == "$cmd" ]; then
+        cat << EOF
+
+Generate Linux AppImage from 'make install' AppDir
+
+Options:
+  -a, --appdir         Input AppDir (required)
+  -v, --version        KeePassXC version
+  -o, --output-dir     Output directory where to build the AppImage
+                       (default: '${OUTPUT_DIR}')
+  -d, --docker-image   Use the specified Docker image to build the AppImage.
+                       The image must have all required build dependencies installed.
+      --container-name Docker container name (default: '${DOCKER_CONTAINER_NAME}')
+                       The container must not exist already
+      --appsign        Embed a PGP signature into the AppImage
+  -k, --key            The PGP Signing Key
+      --verbosity      linuxdeploy verbosity (default: 3)
+  -h, --help           Show this help
 EOF
     fi
 }
@@ -175,6 +214,10 @@ exitTrap() {
     exitError "Existing upon user request..."
 }
 
+cmdExists() {
+    command -v "$1" &> /dev/null
+}
+
 checkSourceDirExists() {
     if [ ! -d "$SRC_DIR" ]; then
         exitError "Source directory '${SRC_DIR}' does not exist!"
@@ -232,7 +275,7 @@ checkVersionInCMake() {
     local app_name_upper="$(echo "$APP_NAME" | tr '[:lower:]' '[:upper:]')"
     local major_num="$(echo ${RELEASE_NAME} | cut -f1 -d.)"
     local minor_num="$(echo ${RELEASE_NAME} | cut -f2 -d.)"
-    local patch_num="$(echo ${RELEASE_NAME} | cut -f3 -d.)"
+    local patch_num="$(echo ${RELEASE_NAME} | cut -f3 -d. | cut -f1 -d-)"
 
     grep -q "${app_name_upper}_VERSION_MAJOR \"${major_num}\"" CMakeLists.txt
     if [ $? -ne 0 ]; then
@@ -257,19 +300,18 @@ checkChangeLog() {
 
     grep -qPzo "${RELEASE_NAME} \(\d{4}-\d{2}-\d{2}\)\n=+\n" CHANGELOG
     if [ $? -ne 0 ]; then
-        exitError "CHANGELOG does not contain any information about the '${RELEASE_NAME}' release!"
+        exitError "'CHANGELOG' has not been updated to the '${RELEASE_NAME}' release!"
     fi
 }
 
-checkTransifexCommandExists() {
+checkAppStreamInfo() {
-    command -v tx > /dev/null
+    if [ ! -f share/linux/org.keepassxc.KeePassXC.appdata.xml ]; then
-    if [ 0 -ne $? ]; then
+        exitError "No AppStream info file found!"
-        exitError "Transifex tool 'tx' not installed! Please install it using 'pip install transifex-client'"
     fi
 
-    command -v lupdate-qt5 > /dev/null
+    grep -qPzo "<release version=\"${RELEASE_NAME}\" date=\"\d{4}-\d{2}-\d{2}\">" share/linux/org.keepassxc.KeePassXC.appdata.xml
-    if [ 0 -ne $? ]; then
+    if [ $? -ne 0 ]; then
-        exitError "Qt Linguist tool (lupdate-qt5) is not installed! Please install using 'apt install qttools5-dev-tools'"
+        exitError "'share/linux/org.keepassxc.KeePassXC.appdata.xml' has not been updated to the '${RELEASE_NAME}' release!"
     fi
 }
 
@@ -281,7 +323,39 @@ checkSnapcraft() {
 
     grep -qPzo "version: ${RELEASE_NAME}" snapcraft.yaml
     if [ $? -ne 0 ]; then
-        exitError "snapcraft.yaml has not been updated to the '${RELEASE_NAME}' release!"
+        exitError "'snapcraft.yaml' has not been updated to the '${RELEASE_NAME}' release!"
+    fi
+}
+
+checkTransifexCommandExists() {
+    if ! cmdExists tx; then
+        exitError "Transifex tool 'tx' not installed! Please install it using 'pip install transifex-client'."
+    fi
+}
+
+checkOsslsigncodeCommandExists() {
+    if ! cmdExists osslsigncode; then
+        exitError "osslsigncode command not found on the PATH! Please install it using 'pacman -S mingw-w64-osslsigncode'."
+    fi
+}
+
+checkSigntoolCommandExists() {
+    if ! cmdExists signtool; then
+        exitError "signtool command not found on the PATH! Add the Windows SDK binary folder to your PATH."
+    fi
+}
+
+checkCodesignCommandExists() {
+    if ! cmdExists codesign; then
+        exitError "codesign command not found on the PATH! Please check that you have correctly installed Xcode."
+    fi
+}
+
+checkQt5LUpdateExists() {
+    if cmdExists lupdate && ! $(lupdate -version | grep -q "lupdate version 5\."); then
+        if ! cmdExists lupdate-qt5; then
+            exitError "Qt Linguist tool (lupdate-qt5) is not installed! Please install using 'apt install qttools5-dev-tools'"
+        fi
     fi
 }
 
@@ -296,6 +370,7 @@ performChecks() {
     logInfo "Validating toolset and repository..."
 
     checkTransifexCommandExists
+    checkQt5LUpdateExists
     checkGitRepository
     checkReleaseDoesNotExist
     checkWorkingTreeClean
@@ -309,6 +384,7 @@ performChecks() {
 
     checkVersionInCMake
     checkChangeLog
+    checkAppStreamInfo
     checkSnapcraft
 
     logInfo "\e[1m\e[32mAll checks passed!\e[0m"
@@ -316,7 +392,7 @@ performChecks() {
 
 # re-implement realpath for OS X (thanks mschrag)
 # https://superuser.com/questions/205127/
-if ! $(command -v realpath > /dev/null); then
+if ! cmdExists realpath; then
     realpath() {
         pushd . > /dev/null
         if [ -d "$1" ]; then
@@ -381,7 +457,7 @@ merge() {
                 SRC_DIR="$2"
                 shift ;;
 
-            -g|--gpg-key)
+            -k|--key|-g|--gpg-key)
                 GPG_GIT_KEY="$2"
                 shift ;;
 
@@ -414,7 +490,8 @@ merge() {
     performChecks
 
     logInfo "Updating language files..."
-    ./share/translations/update.sh
+    ./share/translations/update.sh update
+    ./share/translations/update.sh pull
     if [ 0 -ne $? ]; then
         exitError "Updating translations failed!"
     fi
@@ -454,10 +531,207 @@ merge() {
     logInfo "Don't forget to also push the tags using \e[1mgit push --tags\e[0m."
 }
 
+# -----------------------------------------------------------------------
+#                         appimage command
+# -----------------------------------------------------------------------
+appimage() {
+    local appdir
+    local build_appsign=false
+    local build_key
+    local verbosity="1"
+
+    while [ $# -ge 1 ]; do
+        local arg="$1"
+        case "$arg" in
+            -v|--version)
+                RELEASE_NAME="$2"
+                shift ;;
+
+            -a|--appdir)
+                appdir="$2"
+                shift ;;
+
+            -o|--output-dir)
+                OUTPUT_DIR="$2"
+                shift ;;
+
+            -d|--docker-image)
+                DOCKER_IMAGE="$2"
+                shift ;;
+
+            --container-name)
+                DOCKER_CONTAINER_NAME="$2"
+                shift ;;
+
+            --appsign)
+                build_appsign=true ;;
+
+            --verbosity)
+                verbosity=$2
+                shift ;;
+
+            -k|--key)
+                build_key="$2"
+                shift ;;
+
+            -h|--help)
+                printUsage "appimage"
+                exit ;;
+
+            *)
+                logError "Unknown option '$arg'\n"
+                printUsage "appimage"
+                exit 1 ;;
+        esac
+        shift
+    done
+
+    if [ -z "${appdir}" ]; then
+        logError "Missing arguments, --appdir is required!\n"
+        printUsage "appimage"
+        exit 1
+    fi
+
+    if [ ! -d "${appdir}" ]; then
+        logError "AppDir does not exist, please create one with 'make install'!\n"
+        exit 1
+    elif [ -e "${appdir}/AppRun" ]; then
+        logError "AppDir has already been run through linuxdeploy, please create a fresh AppDir with 'make install'.\n"
+        exit 1
+    fi
+
+    appdir="$(realpath "$appdir")"
+
+    local out="${OUTPUT_DIR}"
+    if [ "" == "$out" ]; then
+        out="."
+    fi
+    mkdir -p "$out"
+    local out_real="$(realpath "$out")"
+    cd "$out"
+
+    local linuxdeploy="linuxdeploy"
+    local linuxdeploy_cleanup
+    local linuxdeploy_plugin_qt="linuxdeploy-plugin-qt"
+    local linuxdeploy_plugin_qt_cleanup
+    local appimagetool="appimagetool"
+    local appimagetool_cleanup
+
+    logInfo "Testing for AppImage tools..."
+    local docker_test_cmd
+    if [ "" != "$DOCKER_IMAGE" ]; then
+        docker_test_cmd="docker run --rm ${DOCKER_IMAGE}"
+    fi
+
+    # Test if linuxdeploy and linuxdeploy-plugin-qt are installed
+    # on the system or inside the Docker container
+    if ! ${docker_test_cmd} which ${linuxdeploy} &> /dev/null; then
+        logInfo "Downloading linuxdeploy..."
+        linuxdeploy="./linuxdeploy"
+        linuxdeploy_cleanup="rm -f ${linuxdeploy}"
+        curl -L "https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage" > "$linuxdeploy"
+        chmod +x "$linuxdeploy"
+    fi
+    if ! ${docker_test_cmd} which ${linuxdeploy_plugin_qt} &> /dev/null; then
+        logInfo "Downloading linuxdeploy-plugin-qt..."
+        linuxdeploy_plugin_qt="./linuxdeploy-plugin-qt"
+        linuxdeploy_plugin_qt_cleanup="rm -f ${linuxdeploy_plugin_qt}"
+        curl -L "https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/continuous/linuxdeploy-plugin-qt-x86_64.AppImage" > "$linuxdeploy_plugin_qt"
+        chmod +x "$linuxdeploy_plugin_qt"
+    fi
+
+    # appimagetool is always run outside a Docker container, so we can access our GPG keys
+    if ! cmdExists ${appimagetool}; then
+        logInfo "Downloading appimagetool..."
+        appimagetool="./appimagetool"
+        appimagetool_cleanup="rm -f ${appimagetool}"
+        curl -L "https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage" > "$appimagetool"
+        chmod +x "$appimagetool"
+    fi
+
+    # Create custom AppRun wrapper
+    cat << EOF > "${out_real}/KeePassXC-AppRun"
+#!/usr/bin/env bash
+
+export PATH="\$(dirname \$0)/usr/bin:\${PATH}"
+export LD_LIBRARY_PATH="\$(dirname \$0)/usr/lib:\${LD_LIBRARY_PATH}"
+
+if [ "\${1}" == "cli" ]; then
+    shift
+    exec keepassxc-cli "\$@"
+elif [ "\${1}" == "proxy" ]; then
+    shift
+    exec keepassxc-proxy "\$@"
+elif [ -v CHROME_WRAPPER ] || [ -v MOZ_LAUNCHED_CHILD ]; then
+    exec keepassxc-proxy "\$@"
+else
+    exec keepassxc "\$@"
+fi
+EOF
+    chmod +x "${out_real}/KeePassXC-AppRun"
+
+    # Find .desktop files, icons, and binaries to deploy
+    local desktop_file="$(find "$appdir" -name "org.keepassxc.KeePassXC.desktop" | head -n1)"
+    local icon="$(find "$appdir" -name 'keepassxc.png' | grep -P 'application/256x256/apps/keepassxc.png$' | head -n1)"
+    local executables="$(IFS=$'\n' find "$appdir" | grep -P '/usr/bin/keepassxc[^/]*$' | xargs -i printf " --executable={}")"
+
+    logInfo "Collecting libs and patching binaries..."
+    if [ "" == "$DOCKER_IMAGE" ]; then
+        "$linuxdeploy" --verbosity=${verbosity} --plugin=qt --appdir="$appdir" --desktop-file="$desktop_file" \
+        --custom-apprun="${out_real}/KeePassXC-AppRun" --icon-file="$icon" ${executables} \
+        --library=$(ldconfig -p | grep x86-64 | grep -oP '/[^\s]+/libgpg-error\.so\.\d+$' | head -n1)
+    else
+        desktop_file="${desktop_file//${appdir}/\/keepassxc\/AppDir}"
+        icon="${icon//${appdir}/\/keepassxc\/AppDir}"
+        executables="${executables//${appdir}/\/keepassxc\/AppDir}"
+
+        docker run --name "$DOCKER_CONTAINER_NAME" --rm \
+            --cap-add SYS_ADMIN --security-opt apparmor:unconfined --device /dev/fuse \
+            -v "${appdir}:/keepassxc/AppDir:rw" \
+            -v "${out_real}:/keepassxc/out:rw" \
+            "$DOCKER_IMAGE" \
+            bash -c "cd /keepassxc/out && ${linuxdeploy} --verbosity=${verbosity} --plugin=qt --appdir=/keepassxc/AppDir \
+            --custom-apprun="/keepassxc/out/KeePassXC-AppRun" --desktop-file=${desktop_file} --icon-file=${icon} ${executables} \
+            --library=\$(ldconfig -p | grep x86-64 | grep -oP '/[^\s]+/libgpg-error\.so\.\d+$' | head -n1)"
+    fi
+
+    logInfo "Creating AppImage..."
+    local appsign_flag=""
+    local appsign_key_flag=""
+    if ${build_appsign}; then
+        appsign_flag="--sign"
+        appsign_key_flag="--sign-key ${build_key}"
+    fi
+    local appimage_name="KeePassXC-x86_64.AppImage"
+    if [ "" != "$RELEASE_NAME" ]; then
+        appimage_name="KeePassXC-${RELEASE_NAME}-x86_64.AppImage"
+    fi
+
+    # Run appimagetool to package (and possibly sign) AppImage
+    # --no-appstream is required, since it may crash on newer systems
+    # see: https://github.com/AppImage/AppImageKit/issues/856
+    "$appimagetool" --updateinformation "gh-releases-zsync|keepassxreboot|keepassxc|latest|KeePassXC-*-x86_64.AppImage.zsync" \
+        ${appsign_flag} ${appsign_key_flag} --no-appstream "$appdir" "${out_real}/${appimage_name}"
+
+    logInfo "Cleaning up temporary files..."
+    ${linuxdeploy_cleanup}
+    ${linuxdeploy_plugin_qt_cleanup}
+    ${appimagetool_cleanup}
+    rm -f "${out_real}/KeePassXC-AppRun"
+}
+
 # -----------------------------------------------------------------------
 #                             build command
 # -----------------------------------------------------------------------
 build() {
+    local build_source_tarball=true
+    local build_snapshot=false
+    local build_snapcraft=false
+    local build_appimage=false
+    local build_generators=""
+    local build_appsign=false
+    local build_key=""
+
     while [ $# -ge 1 ]; do
         local arg="$1"
         case "$arg" in
@@ -489,6 +763,19 @@ build() {
                 DOCKER_CONTAINER_NAME="$2"
                 shift ;;
 
+            --appsign)
+                build_appsign=true ;;
+
+            -k|--key)
+                build_key="$2"
+                shift ;;
+
+            --snapcraft)
+                build_snapcraft=true ;;
+
+            --appimage)
+                build_appimage=true ;;
+
             -c|--cmake-options)
                 CMAKE_OPTIONS="$2"
                 shift ;;
@@ -501,6 +788,10 @@ build() {
                 MAKE_OPTIONS="$2"
                 shift ;;
 
+            -g|--generators)
+                build_generators="$2"
+                shift ;;
+
             -i|--install-prefix)
                 INSTALL_PREFIX="$2"
                 shift ;;
@@ -510,7 +801,10 @@ build() {
                 shift ;;
 
             -n|--no-source-tarball)
-                BUILD_SOURCE_TARBALL=false ;;
+                build_source_tarball=false ;;
+
+            --snapshot)
+                build_snapshot=true ;;
 
             -h|--help)
                 printUsage "build"
@@ -525,12 +819,27 @@ build() {
     done
 
     init
-    checkWorkingTreeClean
 
     OUTPUT_DIR="$(realpath "$OUTPUT_DIR")"
 
-    logInfo "Checking out release tag '${TAG_NAME}'..."
+    if ${build_snapshot}; then
-    git checkout "$TAG_NAME"
+        TAG_NAME="HEAD"
+        local branch=`git rev-parse --abbrev-ref HEAD`
+        logInfo "Using current branch ${branch} to build..."
+        RELEASE_NAME="${RELEASE_NAME}-snapshot"
+        CMAKE_OPTIONS="${CMAKE_OPTIONS} -DKEEPASSXC_BUILD_TYPE=Snapshot"
+    else
+        checkWorkingTreeClean
+
+        if $(echo "$TAG_NAME" | grep -qP "\-(alpha|beta)\\d+\$"); then
+            CMAKE_OPTIONS="${CMAKE_OPTIONS} -DKEEPASSXC_BUILD_TYPE=PreRelease"
+            logInfo "Checking out pre-release tag '${TAG_NAME}'..."
+        else
+            CMAKE_OPTIONS="${CMAKE_OPTIONS} -DKEEPASSXC_BUILD_TYPE=Release"
+            logInfo "Checking out release tag '${TAG_NAME}'..."
+        fi
+        git checkout "$TAG_NAME"
+    fi
 
     logInfo "Creating output directory..."
     mkdir -p "$OUTPUT_DIR"
@@ -539,12 +848,32 @@ build() {
         exitError "Failed to create output directory!"
     fi
 
-    if $BUILD_SOURCE_TARBALL; then
+    if ${build_source_tarball}; then
         logInfo "Creating source tarball..."
         local app_name_lower="$(echo "$APP_NAME" | tr '[:upper:]' '[:lower:]')"
-        TARBALL_NAME="${app_name_lower}-${RELEASE_NAME}-src.tar.xz"
+        local prefix="${app_name_lower}-${RELEASE_NAME}"
-        git archive --format=tar "$TAG_NAME" --prefix="${app_name_lower}-${RELEASE_NAME}/" \
+        local tarball_name="${prefix}-src.tar"
-            | xz -6 >  "${OUTPUT_DIR}/${TARBALL_NAME}"
+
+        git archive --format=tar "$TAG_NAME" --prefix="${prefix}/" --output="${OUTPUT_DIR}/${tarball_name}"
+
+        if ! ${build_snapshot}; then
+            # add .version file to tar
+            mkdir "${prefix}"
+            echo -n ${RELEASE_NAME} > "${prefix}/.version"
+            tar --append --file="${OUTPUT_DIR}/${tarball_name}" "${prefix}/.version"
+            rm "${prefix}/.version"
+            rmdir "${prefix}" 2> /dev/null
+        fi
+
+        xz -6 "${OUTPUT_DIR}/${tarball_name}"
+    fi
+
+    if ! ${build_snapshot} && [ -e "${OUTPUT_DIR}/build-release" ]; then
+        logInfo "Cleaning existing build directory..."
+        rm -r "${OUTPUT_DIR}/build-release" 2> /dev/null
+        if [ $? -ne 0 ]; then
+            exitError "Failed to clean existing build directory, please do it manually."
+        fi
     fi
 
     logInfo "Creating build directory..."
@@ -552,9 +881,14 @@ build() {
     cd "${OUTPUT_DIR}/build-release"
 
     logInfo "Configuring sources..."
-    for p in $BUILD_PLUGINS; do
+    for p in ${BUILD_PLUGINS}; do
         CMAKE_OPTIONS="${CMAKE_OPTIONS} -DWITH_XC_$(echo $p | tr '[:lower:]' '[:upper:]')=On"
     done
+    if [ "$(uname -o)" == "GNU/Linux" ] && ${build_appimage}; then
+        CMAKE_OPTIONS="${CMAKE_OPTIONS} -DKEEPASSXC_DIST_TYPE=AppImage"
+        # linuxdeploy requires /usr as install prefix
+        INSTALL_PREFIX="/usr"
+    fi
 
     if [ "$COMPILER" == "g++" ]; then
         export CC=gcc
@@ -565,66 +899,96 @@ build() {
 
     if [ "" == "$DOCKER_IMAGE" ]; then
         if [ "$(uname -s)" == "Darwin" ]; then
-            # Building on OS X
+            # Building on macOS
-            local qt_vers="$(ls /usr/local/Cellar/qt5 2> /dev/null | sort -r | head -n1)"
+            export MACOSX_DEPLOYMENT_TARGET=10.10
-            if [ "" == "$qt_vers" ]; then
-                exitError "Couldn't find Qt5! Please make sure it is available in '/usr/local/Cellar/qt5'."
-            fi
-            export MACOSX_DEPLOYMENT_TARGET=10.7
 
             logInfo "Configuring build..."
-            cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX="${INSTALL_PREFIX}" \
+            cmake -DCMAKE_BUILD_TYPE=Release \
-                -DCMAKE_OSX_ARCHITECTURES=x86_64 -DWITH_CXX11=OFF \
+              -DCMAKE_OSX_ARCHITECTURES=x86_64 -DCMAKE_INSTALL_PREFIX="${INSTALL_PREFIX}" \
-                -DCMAKE_PREFIX_PATH="/usr/local/Cellar/qt5/${qt_vers}/lib/cmake" \
+              -DCMAKE_PREFIX_PATH="/usr/local/opt/qt/lib/cmake" \
-                -DQT_BINARY_DIR="/usr/local/Cellar/qt5/${qt_vers}/bin" $CMAKE_OPTIONS "$SRC_DIR"
+              ${CMAKE_OPTIONS} "$SRC_DIR"
 
             logInfo "Compiling and packaging sources..."
-            make $MAKE_OPTIONS package
+            make ${MAKE_OPTIONS} package
+
+            # Appsign the executables if desired
+            if [[ ${build_appsign} && ! -z ${build_key} ]]; then
+                logInfo "Signing executable files"
+                appsign "-f" "./${APP_NAME}-${RELEASE_NAME}.dmg" "-k" "${build_key}"
+            fi
 
             mv "./${APP_NAME}-${RELEASE_NAME}.dmg" ../
         elif [ "$(uname -o)" == "Msys" ]; then
-            # Building on Windows with Msys
+            # Building on Windows with Msys2
             logInfo "Configuring build..."
             cmake -DCMAKE_BUILD_TYPE=Release -DWITH_TESTS=Off -G"MSYS Makefiles" \
-                -DCMAKE_INSTALL_PREFIX="${INSTALL_PREFIX}" $CMAKE_OPTIONS "$SRC_DIR"
+                -DCMAKE_INSTALL_PREFIX="${INSTALL_PREFIX}" ${CMAKE_OPTIONS} "$SRC_DIR"
 
             logInfo "Compiling and packaging sources..."
-            make $MAKE_OPTIONS package
+            mingw32-make ${MAKE_OPTIONS} preinstall
 
-            mv "./${APP_NAME}-${RELEASE_NAME}-"*.{exe,zip} ../
+            # Appsign the executables if desired
+            if [[ ${build_appsign} && ! -z ${build_key} ]]; then
+                logInfo "Signing executable files"
+                appsign "-f" $(find src | grep '\.exe') "-k" "${build_key}"
+            fi
+
+            # Call cpack directly instead of calling make package.
+            # This is important because we want to build the MSI when making a
+            # release.
+            cpack -G "${CPACK_GENERATORS};${build_generators}"
+
+            # Inject the portable config into the zip build and rename
+            for filename in ${APP_NAME}-*.zip; do
+                logInfo "Creating portable zip file"
+                local folder=$(echo ${filename} | sed -r 's/(.*)\.zip/\1/')
+                python -c 'import zipfile,sys ; zipfile.ZipFile(sys.argv[1],"a").write(sys.argv[2],sys.argv[3])' \
+                    ${filename} ${SRC_DIR}/share/keepassxc.ini ${folder}/keepassxc.ini
+                mv ${filename} ${folder}-portable.zip
+            done
+
+            mv "${APP_NAME}-"*.* ../
         else
-            mkdir -p "${OUTPUT_DIR}/bin-release"
+            mkdir -p "${OUTPUT_DIR}/KeePassXC.AppDir"
 
             # Building on Linux without Docker container
             logInfo "Configuring build..."
-            cmake -DCMAKE_BUILD_TYPE=Release -DWITH_TESTS=Off $CMAKE_OPTIONS \
+            cmake -DCMAKE_BUILD_TYPE=Release -DWITH_TESTS=Off ${CMAKE_OPTIONS} \
                 -DCMAKE_INSTALL_PREFIX="${INSTALL_PREFIX}" "$SRC_DIR"
 
             logInfo "Compiling sources..."
-            make $MAKE_OPTIONS
+            make ${MAKE_OPTIONS}
 
             logInfo "Installing to bin dir..."
-            make DESTDIR="${OUTPUT_DIR}/bin-release" install/strip
+            make DESTDIR="${OUTPUT_DIR}/KeePassXC.AppDir" install/strip
-            
-            logInfo "Creating AppImage..."
-            ${SRC_DIR}/AppImage-Recipe.sh "$APP_NAME" "$RELEASE_NAME"
         fi
     else
-        mkdir -p "${OUTPUT_DIR}/bin-release"
+        if ${build_snapcraft}; then
+            logInfo "Building snapcraft docker image..."
 
-        logInfo "Launching Docker container to compile sources..."
+            sudo docker image build -t "$DOCKER_IMAGE" "$(realpath "$SRC_DIR")/ci/snapcraft"
 
-        docker run --name "$DOCKER_CONTAINER_NAME" --rm \
+            logInfo "Launching Docker contain to compile snapcraft..."
-            --cap-add SYS_ADMIN --device /dev/fuse \
+
-            -e "CC=${CC}" -e "CXX=${CXX}" \
+            sudo docker run --name "$DOCKER_CONTAINER_NAME" --rm \
-            -v "$(realpath "$SRC_DIR"):/keepassxc/src:ro" \
+                -v "$(realpath "$SRC_DIR"):/keepassxc" -w "/keepassxc" \
-            -v "$(realpath "$OUTPUT_DIR"):/keepassxc/out:rw" \
+                "$DOCKER_IMAGE" snapcraft
-            "$DOCKER_IMAGE" \
+        else
-            bash -c "cd /keepassxc/out/build-release && \
+            mkdir -p "${OUTPUT_DIR}/KeePassXC.AppDir"
-                cmake -DCMAKE_BUILD_TYPE=Release -DWITH_TESTS=Off $CMAKE_OPTIONS \
+
-                    -DCMAKE_INSTALL_PREFIX=\"${INSTALL_PREFIX}\" /keepassxc/src && \
+            logInfo "Launching Docker container to compile sources..."
-                make $MAKE_OPTIONS && make DESTDIR=/keepassxc/out/bin-release install/strip && \
+
-                /keepassxc/src/AppImage-Recipe.sh "$APP_NAME" "$RELEASE_NAME""
+            docker run --name "$DOCKER_CONTAINER_NAME" --rm \
+                --cap-add SYS_ADMIN --security-opt apparmor:unconfined --device /dev/fuse \
+                -e "CC=${CC}" -e "CXX=${CXX}" \
+                -v "$(realpath "$SRC_DIR"):/keepassxc/src:ro" \
+                -v "$(realpath "$OUTPUT_DIR"):/keepassxc/out:rw" \
+                "$DOCKER_IMAGE" \
+                bash -c "cd /keepassxc/out/build-release && \
+                    cmake -DCMAKE_BUILD_TYPE=Release -DWITH_TESTS=Off ${CMAKE_OPTIONS} \
+                        -DCMAKE_INSTALL_PREFIX=${INSTALL_PREFIX} /keepassxc/src && \
+                    make ${MAKE_OPTIONS} && make DESTDIR=/keepassxc/out/KeePassXC.AppDir install/strip"
+        fi
 
         if [ 0 -ne $? ]; then
             exitError "Docker build failed!"
@@ -633,55 +997,71 @@ build() {
         logInfo "Build finished, Docker container terminated."
     fi
 
+    if [ "$(uname -o)" == "GNU/Linux" ] && ${build_appimage}; then
+        local appsign_flag=""
+        local appsign_key_flag=""
+        local docker_image_flag=""
+        local docker_container_name_flag=""
+        if ${build_appsign}; then
+            appsign_flag="--appsign"
+            appsign_key_flag="-k ${build_key}"
+        fi
+        if [ "" != "${DOCKER_IMAGE}" ]; then
+            docker_image_flag="-d ${DOCKER_IMAGE}"
+            docker_container_name_flag="--container-name ${DOCKER_CONTAINER_NAME}"
+        fi
+        appimage "-a" "${OUTPUT_DIR}/KeePassXC.AppDir" "-o" "${OUTPUT_DIR}" \
+            ${appsign_flag} ${appsign_key_flag} ${docker_image_flag} ${docker_container_name_flag}
+    fi
+
     cleanup
 
     logInfo "All done!"
 }
 
-
 # -----------------------------------------------------------------------
-#                             sign command
+#                           gpgsign command
 # -----------------------------------------------------------------------
-sign() {
+gpgsign() {
-    SIGN_FILES=()
+    local sign_files=()
 
     while [ $# -ge 1 ]; do
         local arg="$1"
         case "$arg" in
             -f|--files)
                 while [ "${2:0:1}" != "-" ] && [ $# -ge 2 ]; do
-                    SIGN_FILES+=("$2")
+                    sign_files+=("$2")
                     shift
                 done ;;
 
-            -g|--gpg-key)
+            -k|--key|-g|--gpg-key)
                 GPG_KEY="$2"
                 shift ;;
 
             -h|--help)
-                printUsage "sign"
+                printUsage "gpgsign"
                 exit ;;
 
             *)
                 logError "Unknown option '$arg'\n"
-                printUsage "sign"
+                printUsage "gpgsign"
                 exit 1 ;;
         esac
         shift
     done
 
-    if [ -z "$SIGN_FILES" ]; then
+    if [ -z "${sign_files}" ]; then
         logError "Missing arguments, --files is required!\n"
-        printUsage "sign"
+        printUsage "gpgsign"
         exit 1
     fi
 
-    for f in "${SIGN_FILES[@]}"; do
+    for f in "${sign_files[@]}"; do
         if [ ! -f "$f" ]; then
-            exitError "File '${f}' does not exist!"
+            exitError "File '${f}' does not exist or is not a file!"
         fi
 
-        logInfo "Signing file '${f}'..."
+        logInfo "Signing file '${f}' using release key..."
         gpg --output "${f}.sig" --armor --local-user "$GPG_KEY" --detach-sig "$f"
 
         if [ 0 -ne $? ]; then
@@ -697,6 +1077,147 @@ sign() {
     logInfo "All done!"
 }
 
+# -----------------------------------------------------------------------
+#                           appsign command
+# -----------------------------------------------------------------------
+appsign() {
+    local sign_files=()
+    local key
+
+    while [ $# -ge 1 ]; do
+        local arg="$1"
+        case "$arg" in
+            -f|--files)
+                while [ "${2:0:1}" != "-" ] && [ $# -ge 2 ]; do
+                    sign_files+=("$2")
+                    shift
+                done ;;
+
+            -k|--key|-i|--identity)
+                key="$2"
+                shift ;;
+
+            -h|--help)
+                printUsage "appsign"
+                exit ;;
+
+            *)
+                logError "Unknown option '$arg'\n"
+                printUsage "appsign"
+                exit 1 ;;
+        esac
+        shift
+    done
+
+    if [ -z "${key}" ]; then
+        logError "Missing arguments, --key is required!\n"
+        printUsage "appsign"
+        exit 1
+    fi
+
+    if [ -z "${sign_files}" ]; then
+        logError "Missing arguments, --files is required!\n"
+        printUsage "appsign"
+        exit 1
+    fi
+
+    for f in "${sign_files[@]}"; do
+        if [ ! -f "${f}" ]; then
+            exitError "File '${f}' does not exist or is not a file!"
+        fi
+    done
+
+    if [ "$(uname -s)" == "Darwin" ]; then
+        checkCodesignCommandExists
+
+        local orig_dir="$(pwd)"
+        for f in "${sign_files[@]}"; do
+            if [[ ${f: -4} == '.dmg' ]]; then
+                logInfo "Unpacking disk image '${f}'..."
+                local tmp_dir="/tmp/KeePassXC_${RANDOM}"
+                mkdir -p ${tmp_dir}/mnt
+                hdiutil attach -quiet -noautoopen -mountpoint ${tmp_dir}/mnt "${f}"
+                cd ${tmp_dir}
+                cp -a ./mnt ./app
+                hdiutil detach -quiet ${tmp_dir}/mnt
+
+                if [ ! -d ./app/KeePassXC.app ]; then
+                    cd "${orig_dir}"
+                    exitError "Unpacking failed!"
+                fi
+
+                logInfo "Signing app using codesign..."
+                codesign --sign "${key}" --verbose --deep --entitlements ${orig_dir}/share/macosx/keepassxc.entitlements ./app/KeePassXC.app
+
+                if [ 0 -ne $? ]; then
+                    cd "${orig_dir}"
+                    exitError "Signing failed!"
+                fi
+
+                logInfo "Repacking disk image..."
+                hdiutil create \
+                    -volname "KeePassXC" \
+                    -size $((1000 * ($(du -sk ./app | cut -f1) + 5000))) \
+                    -srcfolder ./app \
+                    -fs HFS+ \
+                    -fsargs "-c c=64,a=16,e=16" \
+                    -format UDBZ \
+                    "${tmp_dir}/$(basename "${f}")"
+                cd "${orig_dir}"
+                cp -f "${tmp_dir}/$(basename "${f}")" "${f}"
+                rm -Rf ${tmp_dir}
+            else
+                logInfo "Skipping non-DMG file '${f}'..."
+            fi
+        done
+
+    elif [ "$(uname -o)" == "Msys" ]; then
+        checkOsslsigncodeCommandExists
+
+        if [[ ! -f "${key}" ]]; then
+            exitError "Key file was not found!"
+        fi
+
+        read -s -p "Key password: " password
+        echo
+
+        for f in "${sign_files[@]}"; do
+            if [[ ${f: -4} == ".exe" ]]; then
+                logInfo "Signing file '${f}' using osslsigncode..."
+                # output a signed exe; we have to use a different name due to osslsigntool limitations
+                osslsigncode sign -pkcs12 "${key}" -pass "${password}" -n "KeePassXC" \
+                    -t "http://timestamp.comodoca.com/authenticode" -in "${f}" -out "${f}.signed"
+
+                if [ 0 -ne $? ]; then
+                    rm -f "${f}.signed"
+                    exitError "Signing failed!"
+                fi
+
+                # overwrite the original exe with the signed exe
+                mv -f "${f}.signed" "${f}"
+            elif [[ ${f: -4} == ".msi" ]]; then
+                # Make sure we can find the signtool
+                checkSigntoolCommandExists
+
+                # osslsigncode does not succeed at signing MSI files at this time...
+                logInfo "Signing file '${f}' using Microsoft signtool..."
+                signtool sign -f "${key}" -p "${password}" -d "KeePassXC" \
+                    -t "http://timestamp.comodoca.com/authenticode" "${f}"
+
+                if [ 0 -ne $? ]; then
+                    exitError "Signing failed!"
+                fi
+            else
+                logInfo "Skipping non-executable file '${f}'..."
+            fi
+        done
+
+    else
+        exitError "Unsupported platform for code signing!\n"
+    fi
+
+    logInfo "All done!"
+}
 
 # -----------------------------------------------------------------------
 #                       parse global command line
@@ -710,8 +1231,9 @@ if [ "" == "$MODE" ]; then
 elif [ "help" == "$MODE" ]; then
     printUsage "$1"
     exit
-elif [ "check" == "$MODE" ] || [ "merge" == "$MODE" ] || [ "build" == "$MODE" ] || [ "sign" == "$MODE" ]; then
+elif [ "check" == "$MODE" ] || [ "merge" == "$MODE" ] || [ "build" == "$MODE" ] \
-    $MODE "$@"
+    || [ "gpgsign" == "$MODE" ] || [ "appsign" == "$MODE" ] || [ "appimage" == "$MODE" ]; then
+    ${MODE} "$@"
 else
     printUsage "$MODE"
 fi

share/CMakeLists.txt

@@ -25,12 +25,13 @@ install(FILES ${DATABASE_ICONS} DESTINATION ${DATA_INSTALL_DIR}/icons/database)
 
 if(UNIX AND NOT APPLE)
     install(DIRECTORY icons/application/ DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor
-            FILES_MATCHING PATTERN "keepassx*.png" PATTERN "keepassx*.svgz"
+            FILES_MATCHING PATTERN "keepassx*.png" PATTERN "keepassx*.svg"
             PATTERN "status" EXCLUDE PATTERN "actions" EXCLUDE PATTERN "categories" EXCLUDE)
     install(DIRECTORY icons/application/ DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor
-            FILES_MATCHING PATTERN "application-x-keepassxc.png" PATTERN "application-x-keepassxc.svgz"
+            FILES_MATCHING PATTERN "application-x-keepassxc.png" PATTERN "application-x-keepassxc.svg"
             PATTERN "status" EXCLUDE PATTERN "actions" EXCLUDE PATTERN "categories" EXCLUDE)
-    install(FILES linux/keepassxc.desktop DESTINATION ${CMAKE_INSTALL_DATADIR}/applications)
+    install(FILES linux/org.keepassxc.KeePassXC.desktop DESTINATION ${CMAKE_INSTALL_DATADIR}/applications)
+    install(FILES linux/org.keepassxc.KeePassXC.appdata.xml DESTINATION ${CMAKE_INSTALL_DATADIR}/metainfo)
     install(FILES linux/keepassxc.xml DESTINATION ${CMAKE_INSTALL_DATADIR}/mime/packages)
 endif(UNIX AND NOT APPLE)
 
@@ -38,102 +39,102 @@ if(APPLE)
   install(FILES macosx/keepassxc.icns DESTINATION ${DATA_INSTALL_DIR})
 endif()
 
+install(DIRECTORY wizard/ DESTINATION ${DATA_INSTALL_DIR}/wizard FILES_MATCHING PATTERN "*.png")
+
 install(DIRECTORY icons/application/ DESTINATION ${DATA_INSTALL_DIR}/icons/application
-        FILES_MATCHING PATTERN "*.png" PATTERN "*.svgz")
+        FILES_MATCHING PATTERN "*.png" PATTERN "*.svg")
 
 add_custom_target(icons
-                  # SVGZ to PNGs for KeePassXC
+    # SVG to PNGs for KeePassXC
-                  COMMAND inkscape -z -w 16 -h 16
+    COMMAND inkscape -z -w 16 -h 16
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/16x16/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/16x16/apps/keepassxc.png
-                  COMMAND inkscape -z -w  24 -h 24
+    COMMAND inkscape -z -w  24 -h 24
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/24x24/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/24x24/apps/keepassxc.png
-                  COMMAND inkscape -z -w  32 -h 32
+    COMMAND inkscape -z -w  32 -h 32
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/32x32/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/32x32/apps/keepassxc.png
-                  COMMAND inkscape -z -w 48 -h 48
+    COMMAND inkscape -z -w 48 -h 48
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/48x48/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/48x48/apps/keepassxc.png
-                  COMMAND inkscape -z -w 64 -h 64
+    COMMAND inkscape -z -w 64 -h 64
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/64x64/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/64x64/apps/keepassxc.png
-                  COMMAND inkscape -z -w 128 -h 128
+    COMMAND inkscape -z -w 128 -h 128
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/128x128/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/128x128/apps/keepassxc.png
-                  COMMAND inkscape -z -w 256 -h 256
+    COMMAND inkscape -z -w 256 -h 256
-                    icons/application/scalable/apps/keepassxc.svgz -e icons/application/256x256/apps/keepassxc.png
+        icons/application/scalable/apps/keepassxc.svg -e icons/application/256x256/apps/keepassxc.png
 
-                  # SVGZ to PNGs for KeePassXC
+    # SVG to PNGs for KeePassXC
-                  COMMAND inkscape -z -w 16 -h 16
+    COMMAND inkscape -z -w 16 -h 16
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/16x16/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/16x16/apps/keepassxc-dark.png
-                  COMMAND inkscape -z -w  24 -h 24
+    COMMAND inkscape -z -w  24 -h 24
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/24x24/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/24x24/apps/keepassxc-dark.png
-                  COMMAND inkscape -z -w  32 -h 32
+    COMMAND inkscape -z -w  32 -h 32
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/32x32/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/32x32/apps/keepassxc-dark.png
-                  COMMAND inkscape -z -w 48 -h 48
+    COMMAND inkscape -z -w 48 -h 48
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/48x48/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/48x48/apps/keepassxc-dark.png
-                  COMMAND inkscape -z -w 64 -h 64
+    COMMAND inkscape -z -w 64 -h 64
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/64x64/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/64x64/apps/keepassxc-dark.png
-                  COMMAND inkscape -z -w 128 -h 128
+    COMMAND inkscape -z -w 128 -h 128
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/128x128/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/128x128/apps/keepassxc-dark.png
-                  COMMAND inkscape -z -w 256 -h 256
+    COMMAND inkscape -z -w 256 -h 256
-                    icons/application/scalable/apps/keepassxc-dark.svgz -e icons/application/256x256/apps/keepassxc-dark.png
+        icons/application/scalable/apps/keepassxc-dark.svg -e icons/application/256x256/apps/keepassxc-dark.png
 
-                  # SVGZ to PNGs for KeePassXC
+    # SVG to PNGs for KeePassXC
-                  COMMAND inkscape -z -w 16 -h 16
+    COMMAND inkscape -z -w 16 -h 16
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/16x16/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/16x16/apps/keepassxc-locked.png
-                  COMMAND inkscape -z -w  24 -h 24
+    COMMAND inkscape -z -w  24 -h 24
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/24x24/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/24x24/apps/keepassxc-locked.png
-                  COMMAND inkscape -z -w  32 -h 32
+    COMMAND inkscape -z -w  32 -h 32
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/32x32/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/32x32/apps/keepassxc-locked.png
-                  COMMAND inkscape -z -w 48 -h 48
+    COMMAND inkscape -z -w 48 -h 48
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/48x48/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/48x48/apps/keepassxc-locked.png
-                  COMMAND inkscape -z -w 64 -h 64
+    COMMAND inkscape -z -w 64 -h 64
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/64x64/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/64x64/apps/keepassxc-locked.png
-                  COMMAND inkscape -z -w 128 -h 128
+    COMMAND inkscape -z -w 128 -h 128
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/128x128/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/128x128/apps/keepassxc-locked.png
-                  COMMAND inkscape -z -w 256 -h 256
+    COMMAND inkscape -z -w 256 -h 256
-                    icons/application/scalable/apps/keepassxc-locked.svgz -e icons/application/256x256/apps/keepassxc-locked.png
+        icons/application/scalable/apps/keepassxc-locked.svg -e icons/application/256x256/apps/keepassxc-locked.png
 
-                  # SVGZ to PNGs for KeePassXC
+    # SVG to PNGs for KeePassXC
-                  COMMAND inkscape -z -w 16 -h 16
+    COMMAND inkscape -z -w 16 -h 16
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/16x16/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/16x16/apps/keepassxc-unlocked.png
-                  COMMAND inkscape -z -w  24 -h 24
+    COMMAND inkscape -z -w  24 -h 24
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/24x24/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/24x24/apps/keepassxc-unlocked.png
-                  COMMAND inkscape -z -w  32 -h 32
+    COMMAND inkscape -z -w  32 -h 32
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/32x32/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/32x32/apps/keepassxc-unlocked.png
-                  COMMAND inkscape -z -w 48 -h 48
+    COMMAND inkscape -z -w 48 -h 48
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/48x48/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/48x48/apps/keepassxc-unlocked.png
-                  COMMAND inkscape -z -w 64 -h 64
+    COMMAND inkscape -z -w 64 -h 64
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/64x64/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/64x64/apps/keepassxc-unlocked.png
-                  COMMAND inkscape -z -w 128 -h 128
+    COMMAND inkscape -z -w 128 -h 128
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/128x128/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/128x128/apps/keepassxc-unlocked.png
-                  COMMAND inkscape -z -w 256 -h 256
+    COMMAND inkscape -z -w 256 -h 256
-                    icons/application/scalable/apps/keepassxc-unlocked.svgz -e icons/application/256x256/apps/keepassxc-unlocked.png
+        icons/application/scalable/apps/keepassxc-unlocked.svg -e icons/application/256x256/apps/keepassxc-unlocked.png
 
-                  # SVGZ to PNGs for KeePassXC MIME-Type
+    # SVG to PNGs for KeePassXC MIME-Type
-                  COMMAND inkscape -z -w 16 -h 16
+    COMMAND inkscape -z -w 16 -h 16
-                    icons/application/scalable/mimetypes/application-x-keepassxc.svgz -e icons/application/16x16/mimetypes/application-x-keepassxc.png
+        icons/application/scalable/mimetypes/application-x-keepassxc.svg -e icons/application/16x16/mimetypes/application-x-keepassxc.png
-                  COMMAND inkscape -z -w 22 -h 22
+    COMMAND inkscape -z -w 22 -h 22
-                    icons/application/scalable/mimetypes/application-x-keepassxc.svgz -e icons/application/22x22/mimetypes/application-x-keepassxc.png
+        icons/application/scalable/mimetypes/application-x-keepassxc.svg -e icons/application/22x22/mimetypes/application-x-keepassxc.png
-                  COMMAND inkscape -z -w 32 -h 32
+    COMMAND inkscape -z -w 32 -h 32
-                    icons/application/scalable/mimetypes/application-x-keepassxc.svgz -e icons/application/32x32/mimetypes/application-x-keepassxc.png
+        icons/application/scalable/mimetypes/application-x-keepassxc.svg -e icons/application/32x32/mimetypes/application-x-keepassxc.png
-                  COMMAND inkscape -z -w 64 -h 64
+    COMMAND inkscape -z -w 64 -h 64
-                    icons/application/scalable/mimetypes/application-x-keepassxc.svgz -e icons/application/64x64/mimetypes/application-x-keepassxc.png
+        icons/application/scalable/mimetypes/application-x-keepassxc.svg -e icons/application/64x64/mimetypes/application-x-keepassxc.png
-                  COMMAND inkscape -z -w 128 -h 128
+    COMMAND inkscape -z -w 128 -h 128
-                    icons/application/scalable/mimetypes/application-x-keepassxc.svgz -e icons/application/128x128/mimetypes/application-x-keepassxc.png
+        icons/application/scalable/mimetypes/application-x-keepassxc.svg -e icons/application/128x128/mimetypes/application-x-keepassxc.png
 
-                  # ICNS for MacOS
+    # Shrink PNGs using pngcrush
-                  COMMAND png2icns macosx/keepassxc.icns
+    COMMAND bash ./crushpng.sh icons
-                    icons/application/16x16/apps/keepassxc.png
-                    icons/application/32x32/apps/keepassxc.png
-                    icons/application/48x48/apps/keepassxc.png
-                    icons/application/128x128/apps/keepassxc.png
-                    icons/application/256x256/apps/keepassxc.png
 
-                  # ICO for Windows
+    # ICNS for MacOS
-                  COMMAND icotool -c -o windows/keepassxc.ico
+    COMMAND png2icns macosx/keepassxc.icns
-                    icons/application/16x16/apps/keepassxc.png
+        icons/application/16x16/apps/keepassxc.png
-                    icons/application/24x24/apps/keepassxc.png
+        icons/application/32x32/apps/keepassxc.png
-                    icons/application/32x32/apps/keepassxc.png
+        icons/application/48x48/apps/keepassxc.png
-                    icons/application/48x48/apps/keepassxc.png
+        icons/application/128x128/apps/keepassxc.png
-                    icons/application/64x64/apps/keepassxc.png
+        icons/application/256x256/apps/keepassxc.png
-                    icons/application/128x128/apps/keepassxc.png
+
-                    icons/application/256x256/apps/keepassxc.png
+    # ICO for Windows
-                  VERBATIM
+    COMMAND bash ./windows/create-ico.sh icons/application/scalable/apps/keepassxc.svg windows/keepassxc.ico
-                  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+    COMMAND bash ./windows/create-ico.sh icons/application/scalable/mimetypes/application-x-keepassxc.svg windows/keepassxc-kdbx.ico
+
+    VERBATIM
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})

share/crushpng.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+if [[ -z $1 ]]; then
+  echo "You must supply a root folder!"
+  exit 1
+fi
+
+find "$1" -iname '*png' -exec pngcrush -ow -brute {} \;