Fix Docker run cwd

* Fixes #12719 and Fixes #12721
* Also fixes missing <ul> in the appdata xml

.clang-format

@@ -19,7 +19,7 @@ AlwaysBreakBeforeMultilineStrings: false
 AlwaysBreakTemplateDeclarations: false
 BinPackArguments: false
 BinPackParameters: false
-BraceWrapping:   
+BraceWrapping:
   AfterClass:      true
   AfterFunction:   true
   AfterControlStatement: false
@@ -30,7 +30,7 @@ BraceWrapping:
   BeforeCatch:     false
   BeforeElse:      false
   IndentBraces:    false
-BreakBeforeBinaryOperators: None
+BreakBeforeBinaryOperators: NonAssignment
 BreakBeforeBraces: Custom
 BreakBeforeTernaryOperators: true
 BreakConstructorInitializersBeforeComma: true
@@ -44,7 +44,7 @@ DerivePointerAlignment: false
 DisableFormat:   false
 ExperimentalAutoDetectBinPacking: false
 ForEachMacros:   [ foreach, Q_FOREACH, BOOST_FOREACH ]
-IncludeCategories: 
+IncludeCategories:
   - Regex:           '^"(llvm|llvm-c|clang|clang-c)/'
     Priority:        2
   - Regex:           '^(<|"(gtest|isl|json)/)'
@@ -54,6 +54,7 @@ IncludeCategories:
 IndentCaseLabels: false
 IndentWidth:     4
 IndentWrappedFunctionNames: false
+InsertNewlineAtEOF: true
 KeepEmptyLinesAtTheStartOfBlocks: true
 MacroBlockBegin: ''
 MacroBlockEnd:   ''
@@ -81,8 +82,7 @@ SpacesInContainerLiterals: true
 SpacesInCStyleCastParentheses: false
 SpacesInParentheses: false
 SpacesInSquareBrackets: false
-Standard:        Cpp11
+Standard:        c++17
 TabWidth:        4
 UseTab:          Never
 ...
-

.gitattributes

@@ -1,3 +1,14 @@
+# Github-linguist language hints
+*.h linguist-language=C++
+*.cpp linguist-language=C++
+
+# Line endings harmony
+* text=auto eol=lf
+
+# binary files
+*.ai binary
+
+# Export
 src/version.h.cmake export-subst
 .gitattributes export-ignore
 .gitignore export-ignore
@@ -7,7 +18,3 @@ src/version.h.cmake export-subst
 snapcraft.yaml export-ignore
 make_release.sh export-ignore
 AppImage-Recipe.sh export-ignore
-
-# github-linguist language hints
-*.h linguist-language=C++
-*.cpp linguist-language=C++

.github/CONTRIBUTING.md

@@ -15,6 +15,7 @@ These are just guidelines, not rules. Use your best judgment, and feel free to p
   * [Bug reports](#bug-reports)
   * [Discuss with the team](#discuss-with-the-team)
   * [Your first code contribution](#your-first-code-contribution)
+  * [Using AI](#using-ai)
   * [Pull requests](#pull-requests)
   * [Translations](#translations)
 
@@ -38,7 +39,7 @@ We will accept contributions of good code that we can use from anyone.
  - “contributions”: This means just about anything you wish to contribute to the project, as long as it is good code we can use. The easier you make it for us to accept your contribution, the happier we are, but if it’s good enough, we will do a reasonable amount of work to use it.
  - “of good code”: This means that we will accept contributions that work well and efficiently, that fit in with the goals of the project, that match the project’s coding style, and that do not impose an undue maintenance workload on us going forward. This does not mean just program code, either, but documentation and artistic works as appropriate to the project.
  - “that we can use”: This means that your contribution must be given freely and irrevocably, that you must have the right to contribute it for our unrestricted use, and that your contribution is made under a license that is compatible with the license the project has chosen and that permits us to include, distribute, and modify your work without restriction.
- - “from anyone”: This means exactly that. We don’t care about anything but your code. We don’t care about your race, religion, national origin, biological gender, perceived gender, sexual orientation, lifestyle, political viewpoint, or anything extraneous like that. We will neither reject your contribution nor grant it preferential treatment on any basis except the code itself. We do, however, reserve the right to tell you to go away if you behave too obnoxiously toward us.
+ - “from anyone”: This means exactly that. We don’t care about anything but your code. We don’t care about your race, religion, national origin, biological gender, perceived gender, sexual orientation, lifestyle, political viewpoint, or anything extraneous like that. We will neither reject your contribution nor grant it preferential treatment on any basis except the code itself. We do, however, reserve the right to limit your access to our community if you violate our [Code of Conduct](../CODE-OF-CONDUCT.md).
 
 #### If Your Contribution Is Rejected
 
@@ -63,7 +64,7 @@ Before submitting a bug report, check if the problem has already been reported.
 
 ### Discuss with the team
 
-As with feature requests, you can talk to the KeePassXC team about bugs, new features, other issues and pull requests on the dedicated issue tracker, or in the IRC channel on Freenode (`#keepassxc-dev` on `irc.freenode.net`, or use a [webchat link](https://webchat.freenode.net/?channels=%23keepassxc-dev)).
+As with feature requests, you can talk to the KeePassXC team about bugs, new features, other issues and pull requests on the dedicated issue tracker, on the [Matrix development channel](https://matrix.to/#/!RhJPJPGwQIFVQeXqZa:matrix.org?via=matrix.org), or in the IRC channel on Libera.Chat (`#keepassxc-dev` on `irc.libera.chat`, or use a [webchat link](https://web.libera.chat/#keepassxc-dev)).
 
 ### Your first code contribution
 
@@ -74,6 +75,10 @@ Unsure where to begin contributing to KeePassXC? You can start by looking throug
 
 Both issue lists are sorted by total number of comments. While not perfect, looking at the number of comments on an issue can give a general idea of how much an impact a given change will have.
 
+### Using AI
+
+Generative AI is fast becoming a first-party feature in most development environments, including GitHub itself. If you use Generative AI to write the vast majority of your submission (e.g., agent-based or vibe coding) then you **must document your use of AI** in your pull request. Please include the service you used and/or model that generated the code. All code submissions go through a rigorous review process regardless of the development workflow used.
+
 ### Pull requests
 
 Along with our desire to hear your feedback and suggestions, we're also interested in accepting direct assistance in the form of code.
@@ -82,19 +87,26 @@ All pull requests must comply with the above requirements and with the [stylegui
 
 ### Translations
 
-Translations are managed on [Transifex](https://www.transifex.com/keepassxc/keepassxc/) which offers a web interface.
+Translations are managed on [Transifex](https://explore.transifex.com/keepassxc/keepassxc/) which offers a web interface.
 Please join an existing language team or request a new one if there is none.
 
+If you open a Pull Request with new strings that require translations, you will need to run the following:
+```
+./release-tool i18n lupdate
+```
+This will make the new strings available for translation in Transifex.
+
 ## Styleguides
 
 ### Git branch strategy
 
 The Branch Strategy is based on [git-flow-lite](http://nvie.com/posts/a-successful-git-branching-model/).
 
-* **master** – points to the latest public release
 * **develop** – points to the development of the next release, contains tested and reviewed code
 * **feature/**[name] – points to a branch with a new feature, one which is candidate for merge into develop (subject to rebase)
-* **hotfix/**[id]-[description] – points to a branch with a fix for a particular issue ID
+* **fix/**[name] – points to a branch with a fix for a particular issue ID
+
+Note: The **latest** tag is used to point to the most recent stable release.
 
 
 ### Git commit messages
@@ -103,14 +115,16 @@ The Branch Strategy is based on [git-flow-lite](http://nvie.com/posts/a-successf
 * Use the imperative mood ("Move cursor to…" not "Moves cursor to…")
 * Limit the first line to 72 characters or less
 * Reference issues and pull requests liberally
-* If your pull request fixes an existing issue, add "…, resolves #ISSUENUMBER" to your main commit
-* When only changing documentation, include `[ci skip]` in the commit description
+* If your pull request fixes an existing issue, add "Fixes #ISSUENUMBER" to your pull request description
 
 ### Coding styleguide
 
-This project follows the [Qt Coding Style](https://wiki.qt.io/Qt_Coding_Style). All submissions are expected to follow this style.
+The coding style of the project is enforced using llvm's `clang-format` formatting tool. A thorough description
+of the coding style can be found in the `.clang-format` file, but the main conventions are presented here.
 
-In particular, code must stick to the following rules:
+Formatting can be performed automatically by calling `make format` from the `build/` directory.
+
+Note that [formatting can be disabled on a piece of code](https://clang.llvm.org/docs/ClangFormatStyleOptions.html#disabling-formatting-on-a-piece-of-code) if manual formatting is deemed more readable.
 
 #### Naming convention
 `lowerCamelCase`
@@ -119,18 +133,70 @@ For names made of only one word, the first letter should be lowercase.
 For names made of multiple concatenated words, the first letter of the whole is lowercase, and the first letter of each subsequent word is capitalized.
 
 #### Indention
-For **C++ files** (*.cpp .h*): 4 spaces  
+For **C++ files** (*.cpp .h*): 4 spaces
 For **Qt-UI files** (*.ui*): 2 spaces
 
-#### Pointers
-```c
+#### Includes
+```cpp
+// Class includes
+#include "MyWidget.h"
+#include "ui_MyWidget.h"
+
+// Application includes
+#include "core/Config.h"
+#include "core/Resources.h"
+
+// Global includes
+#include <QWidget>
+#include <stdin>
+```
+
+#### Classes
+```cpp
+// Note: order is important, stay organized!
+class MyWidget : public QWidget
+{
+    Q_OBJECT
+
+public:
+    explicit MyWidget(QWidget* parent);
+    ~MyWidget() override;
+
+signals:
+    void alert();
+
+public slots:
+    void processEvent(Event* event);
+
+private slots:
+    void myEvent(Event* event);
+
+private:
+    const QScopedPointer<Ui::MyWidget> m_ui;
+    int m_counter;
+};
+
+// Note: alignment of variable initialization
+MyWidget::MyWidget(QWidget* parent)
+    : QWidget(parent)
+    , m_ui(new Ui::MyWidget())
+{
+
+}
+```
+
+#### Pointers / References
+```cpp
 int* count;
+const QString& string;
 ```
 
 #### Braces
-```c
+```cpp
 if (condition) {
     doSomething();
+} else {
+    doSomethingElse();
 }
 
 void ExampleClass::exampleFunction()
@@ -140,16 +206,19 @@ void ExampleClass::exampleFunction()
 ```
 
 #### Switch statement
-```c
+```cpp
+// Note: avoid declaring variables in a switch statement
 switch (a) {
 case 1:
     doSomething();
     break;
 
-default:
+// Note: use braces if necessary
+default: {
     doSomethingElse();
     break;
 }
+}
 ```
 
 #### Member variables
@@ -164,6 +233,6 @@ Example: `<widget class="QCheckBox" name="rememberCheckBox">`
 
 
 
-[beginner]:https://github.com/keepassxreboot/keepassx/issues?q=is%3Aopen+is%3Aissue+label%3Abeginner+label%3A%22help+wanted%22+sort%3Acomments-desc
+[beginner]:https://github.com/keepassxreboot/keepassxc/issues?utf8=%E2%9C%93&q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22+sort%3Acomments-desc+
 [help-wanted]:https://github.com/keepassxreboot/keepassx/issues?q=is%3Aopen+is%3Aissue+label%3A%22help+wanted%22+sort%3Acomments-desc
 [issues-section]:https://github.com/keepassxreboot/keepassxc/issues

.github/FUNDING.yml

@@ -0,0 +1,5 @@
+github: ["droidmonkey", "phoerious"]
+patreon: keepassxc
+open_collective: keepassxc
+liberapay: keepassxc
+custom: ["https://keepassxc.org/donate"]

.github/ISSUE_TEMPLATE.md

@@ -1,40 +0,0 @@
-<!--- Provide a general summary of the issue in the title above -->
-
-## Expected Behavior
-<!--- If you're describing a bug, tell us what should happen -->
-<!--- If you're suggesting a change/improvement, tell us how it should work -->
-
-## Current Behavior
-<!--- If describing a bug, tell us what happens instead of the expected behavior -->
-<!--- If suggesting a change/improvement, explain the difference from the current behavior -->
-
-## Possible Solution
-<!--- Not obligatory, but suggest a fix/reason for the bug, -->
-<!--- or ideas how to implement the addition or change -->
-
-## Steps to Reproduce (for bugs)
-<!--- Provide a link to a live example, or an unambiguous set of steps to -->
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-1.
-2.
-3.
-4.
-
-## Context
-<!--- How has this issue affected you? What are you trying to accomplish? -->
-<!--- Providing context helps us come up with a solution that is most useful in the real world -->
-
-## Debug Info
-<!--- Paste debug info from Help → About here -->
-KeePassXC - VERSION
-Revision: REVISION
-
-Libraries:
-- LIBS
-
-Operating system: OS
-CPU architecture: ARCH
-Kernel: KERNEL
-
-Enabled extensions:
-- EXTENSIONS

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,83 @@
+name: Bug Report
+description: Provide information about a problem you are experiencing.
+type: Bug
+
+body:
+  - type: checkboxes
+    attributes:
+      label: Have you searched for an existing issue?
+      description: |
+        Use the issue search box to see if one already exists for the bug you encountered.
+        Also take a moment to review our pinned issues.
+      options:
+      - label: Yes, I tried searching and reviewed the pinned issues
+        required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Brief Summary
+      description: |
+        Provide an overview of the problem, include any information that may help us triage this issue.
+        Provide screenshots if possible, but do NOT show sensitive data (use View -> Allow Screen Capture).
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Provide a simple set of steps to reproduce this bug.
+      placeholder: |
+        1. 
+        2. 
+        3. 
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_vs_actual
+    attributes:
+      label: Expected Versus Actual Behavior
+      description: Tell us what you expected to happen and what actually happened.
+
+  - type: textarea
+    id: debug_info
+    attributes:
+      label: KeePassXC Debug Information
+      placeholder: "Paste the output of: Help -> About -> Debug Info"
+      render: Text
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      description: Select your operating system.
+      options:
+        - Windows
+        - Linux
+        - macOS
+        - Other (BSD, Haiku, etc)
+
+  - type: dropdown
+    id: desktop_env
+    attributes:
+      label: Linux Desktop Environment
+      description: If on Linux, please select your desktop environment.
+      options:
+        - Gnome
+        - KDE
+        - XFCE
+        - Mate / Cinnamon
+        - Sway
+        - i3
+        - Other
+
+  - type: dropdown
+    id: window_system
+    attributes:
+      label: Linux Windowing System
+      description: If on Linux, please select your windowing system.
+      options:
+        - X11
+        - Wayland

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature Request
+description: Tell us about a new feature you want.
+type: Feature
+
+body:
+  - type: checkboxes
+    attributes:
+      label: Have you searched for an existing feature request?
+      description: Use the issue search box to see if one already exists for the feature you want.
+      options:
+      - label: Yes, I tried searching
+        required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Brief Summary
+      description: |
+        Provide an overview of the feature you are interested in adding.
+        Provide screenshots if possible, but do NOT show sensitive data (use View -> Allow Screen Capture).
+    validations:
+      required: true
+
+  - type: textarea
+    id: example
+    attributes:
+      label: Example
+      description: Provide an example of how this feature would be used.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+      description: Why does this feature matter to you? What unique circumstances do you have?

.github/ISSUE_TEMPLATE/prerelease_bug_report.yml

@@ -0,0 +1,85 @@
+name: Pre-Release Bug Report
+description: Report an issue with pre-release code (e.g. snapshot builds).
+type: Bug
+labels: PRE-RELEASE BUG
+assignees: droidmonkey
+
+body:
+  - type: checkboxes
+    attributes:
+      label: Have you searched for an existing issue?
+      description: |
+        Use the issue search box to see if one already exists for the bug you encountered.
+        Also take a moment to review our pinned issues.
+      options:
+      - label: Yes, I tried searching and reviewed the pinned issues
+        required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Brief Summary
+      description: |
+        Provide an overview of the problem, include any information that may help us triage this issue.
+        Provide screenshots if possible, but do NOT show sensitive data (use View -> Allow Screen Capture).
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Provide a simple set of steps to reproduce this bug.
+      placeholder: |
+        1. 
+        2. 
+        3. 
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_vs_actual
+    attributes:
+      label: Expected Versus Actual Behavior
+      description: Tell us what you expected to happen and what actually happened.
+
+  - type: textarea
+    id: debug_info
+    attributes:
+      label: KeePassXC Debug Information
+      placeholder: "Paste the output of: Help -> About -> Debug Info"
+      render: Text
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      description: Select your operating system.
+      options:
+        - Windows
+        - Linux
+        - macOS
+        - Other (BSD, Haiku, etc)
+
+  - type: dropdown
+    id: desktop_env
+    attributes:
+      label: Linux Desktop Environment
+      description: If on Linux, please select your desktop environment.
+      options:
+        - Gnome
+        - KDE
+        - XFCE
+        - Mate / Cinnamon
+        - Sway
+        - i3
+        - Other
+
+  - type: dropdown
+    id: window_system
+    attributes:
+      label: Linux Windowing System
+      description: If on Linux, please select your windowing system.
+      options:
+        - X11
+        - Wayland

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,34 +1,22 @@
-<!--- Provide a general summary of your changes in the title above -->
+[NOTE]: # ( Describe your changes in detail. Explain large or complex code modifications. )
+[NOTE]: # ( If it fixes an open issue, please add "Fixes #XXX". )
+[NOTE]: # ( If you used Generative AI to write the majority of your code, you must state this. )
 
-## Description
-<!--- Describe your changes in detail -->
 
-## Motivation and context
-<!--- Why is this change required? What problem does it solve? -->
-<!--- If it fixes an open issue, please link to the issue here. -->
+## Screenshots
+[NOTE]: # ( Do not include screenshots of your actual database! )
+[TIP]:  # ( Use View -> Allow Screen Capture )
 
-## How has this been tested?
-<!--- Please describe in detail how you tested your changes. -->
-<!--- Include details of your testing environment, and the tests you ran to -->
-<!--- see how your change affects other areas of the code, etc. -->
 
-## Screenshots (if appropriate):
+## Testing strategy
+[NOTE]: # ( Please describe in detail how you tested your changes. )
+[TIP]:  # ( We expect new code to be covered by unit tests and include helpful comments. )
 
-## Types of changes
-<!--- What types of changes does your code introduce? -->
-<!--- Please remove all lines which don't apply. -->
-- ✅ Bug fix (non-breaking change which fixes an issue)
-- ✅ New feature (non-breaking change which adds functionality)
-- ✅ Breaking change (fix or feature that would cause existing functionality to change)
 
-## Checklist:
-<!--- Please go over all the following points. -->
-<!--- Again, remove any lines which don't apply. -->
-<!--- Pull Requests that don't fulfill all [REQUIRED] requisites are likely -->
-<!--- to be sent back to you for correction or will be rejected.  -->
-- ✅ I have read the **CONTRIBUTING** document. **[REQUIRED]**
-- ✅ My code follows the code style of this project. **[REQUIRED]**
-- ✅ All new and existing tests passed. **[REQUIRED]**
-- ✅ I have compiled and verified my code with `-DWITH_ASAN=ON`. **[REQUIRED]**
-- ✅ My change requires a change to the documentation and I have updated it accordingly.
-- ✅ I have added tests to cover my changes.
+## Type of change
+[NOTE]: # ( Please remove all lines which don't apply. )
+- ✅ Bug fix (non-breaking change that fixes an issue)
+- ✅ New feature (change that adds functionality)
+- ✅ Breaking change (causes existing functionality to change)
+- ✅ Refactor (significant modification to existing code)
+- ✅ Documentation (non-code change)

.github/copilot-instructions.md

@@ -0,0 +1,44 @@
+This repository is a C++ (C++20) Qt-based password manager. The important domain concepts are
+Database, Group, and Entry (KDBX format). Key areas to know before making changes are below.
+
+Quick reference (common commands)
+- Configure + build (preferred: CMake presets)
+	- Windows (PowerShell): `cmake --preset x64-debug`
+	- Build: `cmake --build --preset x64-debug` or `cmake --build . -j <n>` from the build dir
+- Formatting (required before commits):
+	- `cmake --build . --target format` (runs clang-format)
+- Tests:
+	- Run all tests: `ctest -j <n>` from build dir
+	- Run single test (verbose): `ctest -R <Test Name> -V`
+- Translations & i18n (release tooling):
+	- Update translation sources: `python ./release-tool.py i18n lupdate`
+
+Big-picture architecture (where to look)
+- src/core: core data model (Database, Groups, Entries). Example: `src/core/Database.h`
+- src/format: KDBX readers/writers and import/export logic.  (sensitive - avoid casual edits)
+- src/crypto: cryptographic primitives and key derivation. (sensitive - avoid casual edits)
+- src/gui: Qt UI layers, widgets, main window and app lifecycle (entry: `src/main.cpp`, `src/gui/MainWindow.cpp`)
+- src/sshagent, src/browser, src/fdosecrets, src/quickunlock: integration adapters for external systems
+- tests/ and tests/gui/: QTest-based unit and GUI tests (follow existing test patterns)
+
+Project-specific conventions & patterns
+- Language/features: C++20, heavy use of Qt signal/slot idioms and QObject-derived classes.
+- Build: use provided CMake commands to configure and build the project successfully.
+- Formatting: a CMake target (`format`) runs clang-format — run it before committing.
+- Translations: translation files are generated/updated via the release tool — run it before committing.
+- UI files: .ui changes are non-trivial; prefer proposing .ui edits rather than committing wholesale .ui changes unless very simple.
+- Sensitive areas: `src/crypto` and `src/format` contain security-sensitive logic — avoid refactors that change algorithms without expert review.
+
+Concrete examples (where to copy patterns)
+- Signal connections: see `src/keeshare/ShareObserver.cpp` (connect to Database signals like `groupAdded` / `modified`).
+- Opening/locking DBs: `src/gui/DatabaseTabWidget.*` and `src/gui/DatabaseWidget.*` show typical lifecycle and `emitActiveDatabaseChanged()`.
+- Format/validation: use `src/format/KdbxReader.cpp` and `Kdbx4Reader.cpp` for error handling patterns when reading DBs.
+
+Rules for automated agents
+- Do not change cryptographic or serialization logic unless the change is narrowly scoped and you run tests.
+- When adding features, create relevant unit tests within existing files in `tests/`.
+- Always run code formatting, translation update, and tests before submitting commits.
+- All tests related to your change must pass before committing.
+- Reference real files in PR descriptions (e.g., "changed src/core/Database.h and tests/TestDatabase.cpp").
+
+If anything above is unclear or you want more detail about a specific area (build matrix, CI, or release-tool commands), tell me which part and I will expand.

.github/pull.yml

@@ -0,0 +1,8 @@
+# doc: https://github.com/wei/pull#basic-setup
+# manual trigger: https://pull.git.ci/process/${fork-user}/keepassxc
+# pull from: https://github.com/keepassxreboot/keepassxc
+version: "1"
+rules:
+  - base: develop
+    upstream:  keepassxreboot:develop
+    mergeMethod: rebase

.github/workflows/codeql.yml

@@ -0,0 +1,70 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - 'develop'
+      - 'release/**'
+  pull_request:
+  schedule:
+    - cron: '5 16 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Use only 'java' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - if: matrix.language == 'cpp'
+      name: Install dependencies
+      run: |
+        sudo apt update
+        sudo apt install build-essential cmake g++
+        sudo apt install qtbase5-dev qtbase5-private-dev qttools5-dev qttools5-dev-tools libqt5svg5-dev libargon2-dev libkeyutils-dev libminizip-dev libbotan-2-dev libqrencode-dev zlib1g-dev asciidoctor libreadline-dev libpcsclite-dev libusb-1.0-0-dev libxi-dev libxtst-dev  libqt5x11extras5-dev
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        queries: security-and-quality
+
+    - if: matrix.language == 'cpp'
+      name: Build C++
+      run: |
+        mkdir build && cd build
+        cmake -DWITH_XC_ALL=ON -DWITH_TESTS=OFF ..
+        make -j $(nproc)
+
+    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - if: matrix.language != 'cpp'
+      name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,29 @@
+name: "Copilot Setup Steps"
+
+# Setup the environment for Copilot agents to run in
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    # Needed to clone the repository
+    permissions:
+      contents: read
+
+    # Install dependencies
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt update
+          sudo apt install --no-install-recommends build-essential cmake g++ ninja-build qtbase5-dev qtbase5-private-dev qttools5-dev qttools5-dev-tools libqt5svg5-dev libargon2-dev libkeyutils-dev libminizip-dev libbotan-2-dev libqrencode-dev zlib1g-dev asciidoctor libreadline-dev libpcsclite-dev libusb-1.0-0-dev libxi-dev libxtst-dev libqt5x11extras5-dev

.gitignore

@@ -10,4 +10,25 @@ release*/
 *.swp
 
 .DS_Store
-.version
+.version
+desktop.ini
+\.scannerwork/
+
+/snap/.snapcraft/
+/parts/
+/stage/
+/prime/
+/*.snap
+/*_source.tar.bz2
+
+# MSVC Files
+CMakeSettings.json
+CMakePresets.json
+CMakeUserPresets.json
+.vs/
+out/
+\.clangd
+
+# vcpkg
+vcpkg_installed*/
+

.tx/config

@@ -1,8 +1,21 @@
 [main]
-host = https://www.transifex.com
+host = https://app.transifex.com
+
+[o:keepassxc:p:keepassxc:r:share-translations-keepassxc-en-ts--develop]
+file_filter            = share/translations/keepassxc_<lang>.ts
+source_file            = share/translations/keepassxc_en.ts
+type                   = QT
+minimum_perc           = 60
+resource_name          = keepassxc_en.ts (develop)
+replace_edited_strings = false
+keep_translations      = false
+
+[o:keepassxc:p:keepassxc:r:share-translations-keepassxc-en-ts--master]
+file_filter            = share/translations/keepassxc_<lang>.ts
+source_file            = share/translations/keepassxc_en.ts
+type                   = QT
+minimum_perc           = 60
+resource_name          = keepassxc_en.ts (2.7.x stable)
+replace_edited_strings = false
+keep_translations      = false
 
-[keepassxc.keepassx_ents]
-source_file = share/translations/keepassx_en.ts
-file_filter = share/translations/keepassx_<lang>.ts
-source_lang = en
-type = QT

AppImage-Recipe.sh

@@ -1,114 +0,0 @@
-#!/usr/bin/env bash
-# 
-# KeePassXC AppImage Recipe
-# Copyright (C) 2017-2018 KeePassXC team <https://keepassxc.org/>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 or (at your option)
-# version 3 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-if [ "$1" == "" ] || [ "$2" == "" ]; then
-    echo "Usage: $(basename $0) APP_NAME RELEASE_VERSION" >&2
-    exit 1
-fi
-
-if [ -f CHANGELOG ]; then
-    echo "This recipe must not be run from the sources root." >&2
-    exit 1
-fi
-
-if [ ! -d ../bin-release ]; then
-    echo "../bin-release does not exist." >&2
-    exit 1
-fi
-
-APP="$1"
-LOWERAPP="$(echo "$APP" | tr '[:upper:]' '[:lower:]')"
-VERSION="$2"
-export ARCH=x86_64
-
-mkdir -p $APP.AppDir
-wget -q https://github.com/AppImage/AppImages/raw/master/functions.sh -O ./functions.sh
-. ./functions.sh
-
-LIB_DIR=./usr/lib
-if [ -d ./usr/lib/x86_64-linux-gnu ]; then
-    LIB_DIR=./usr/lib/x86_64-linux-gnu
-elif [ -d ./usr/lib/i386-linux-gnu ]; then
-    LIB_DIR=./usr/lib/i386-linux-gnu
-elif [ -d ./usr/lib64 ]; then
-    LIB_DIR=./usr/lib64
-fi
-
-cd $APP.AppDir
-cp -a ../../bin-release/* .
-cp -a ./usr/local/* ./usr
-rm -R ./usr/local
-rmdir ./opt 2> /dev/null
-
-# bundle Qt platform plugins and themes
-QXCB_PLUGIN="$(find /usr/lib* -name 'libqxcb.so' 2> /dev/null)"
-if [ "$QXCB_PLUGIN" == "" ]; then
-    QXCB_PLUGIN="$(find /opt/qt*/plugins -name 'libqxcb.so' 2> /dev/null)"
-fi
-QT_PLUGIN_PATH="$(dirname $(dirname $QXCB_PLUGIN))"
-mkdir -p ".${QT_PLUGIN_PATH}/platforms"
-cp -a "$QXCB_PLUGIN" ".${QT_PLUGIN_PATH}/platforms/"
-cp -a "${QT_PLUGIN_PATH}/platforminputcontexts/" ".${QT_PLUGIN_PATH}/platforminputcontexts/"
-cp -a "${QT_PLUGIN_PATH}/imageformats/" ".${QT_PLUGIN_PATH}/imageformats/"
-
-get_apprun
-copy_deps
-
-# protect our libgpg-error from being deleted
-mv ./opt/keepassxc-libs/lib/x86_64-linux-gnu/libgpg-error.so.0 ./protected.so
-delete_blacklisted
-mv ./protected.so ./opt/keepassxc-libs/lib/x86_64-linux-gnu/libgpg-error.so.0
-
-get_desktop
-get_icon
-cat << EOF > ./usr/bin/keepassxc_env
-#!/usr/bin/env bash
-export LD_LIBRARY_PATH="..$(dirname ${QT_PLUGIN_PATH})/lib:\${LD_LIBRARY_PATH}"
-export LD_LIBRARY_PATH="../opt/keepassxc-libs/lib/x86_64-linux-gnu:\${LD_LIBRARY_PATH}"
-
-export QT_PLUGIN_PATH="..${QT_PLUGIN_PATH}:\${KPXC_QT_PLUGIN_PATH}"
-
-# unset XDG_DATA_DIRS to make tray icon work in Ubuntu Unity
-# see https://github.com/AppImage/AppImageKit/issues/351
-unset XDG_DATA_DIRS
-
-if [ "\${1}" == "cli" ]; then
-    shift
-    exec keepassxc-cli "\$@"
-elif [ "\${1}" == "proxy" ]; then
-    shift
-    exec keepassxc-proxy "\$@"
-elif [ -v CHROME_WRAPPER ] || [ -v MOZ_LAUNCHED_CHILD ]; then
-    exec keepassxc-proxy "\$@"
-else
-    exec keepassxc "\$@"
-fi
-EOF
-chmod +x ./usr/bin/keepassxc_env
-sed -i 's/Exec=keepassxc/Exec=keepassxc_env/' org.${LOWERAPP}.${APP}.desktop
-get_desktopintegration "org.${LOWERAPP}.${APP}"
-
-cd ..
-
-GLIBC_NEEDED=$(glibc_needed)
-NO_GLIBC_VERSION=true
-
-generate_type2_appimage -u "gh-releases-zsync|keepassxreboot|keepassxc|latest|KeePassXC-*-${ARCH}.AppImage.zsync"
-
-mv ../out/*.AppImage* ../
-rm -rf ../out

CHANGELOG

@@ -1,323 +0,0 @@
-2.3.0 (2018-02-27)
-=========================
-
-- Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494]
-- Add SSH Agent feature [#1098, #1450, #1463]
-- Add preview panel with details of the selected entry [#879, #1338]
-- Add more and configurable columns to entry table and allow copying of values by double click [#1305]
-- Add KeePassXC-Browser API as a replacement for KeePassHTTP [#608]
-- Deprecate KeePassHTTP [#1392]
-- Add support for Steam one-time passwords [#1206]
-- Add support for multiple Auto-Type sequences for a single entry [#1390]
-- Adjust YubiKey HMAC-SHA1 challenge-response key generation for KDBX 4.0 [#1060]
-- Replace qHttp with cURL for website icon downloads [#1460]
-- Remove lock file [#1231]
-- Add option to create backup file before saving [#1385]
-- Ask to save a generated password before closing the entry password generator [#1499]
-- Resolve placeholders recursively [#1078]
-- Add Auto-Type button to the toolbar [#1056]
-- Improve window focus handling for Auto-Type dialogs [#1204, #1490]
-- Auto-Type dialog and password generator can now be exited with ESC [#1252, #1412]
-- Add optional dark tray icon [#1154]
-- Add new "Unsafe saving" option to work around saving problems with file sync services [#1385]
-- Add IBus support to AppImage and additional image formats to Windows builds [#1534, #1537]
-- Add diceware password generator to CLI [#1406]
-- Add --key-file option to CLI [#816, #824]
-- Add DBus interface for opening and closing KeePassXC databases [#283]
-- Add KDBX compression options to database settings [#1419]
-- Discourage use of old fixed-length key files in favor of arbitrary files [#1326, #1327]
-- Correct reference resolution in entry fields [#1486]
-- Fix window state and recent databases not being remembered on exit [#1453]
-- Correct history item generation when configuring TOTP for an entry [#1446]
-- Correct multiple TOTP bugs [#1414]
-- Automatic saving after every change is now a default [#279]
-- Allow creation of new entries during search [#1398]
-- Correct menu issues on macOS [#1335]
-- Allow compilation on OpenBSD [#1328]
-- Improve entry attachments view [#1139, #1298]
-- Fix auto lock for Gnome and Xfce [#910, #1249]
-- Don't remember key files in file dialogs when the setting is disabled [#1188]
-- Improve database merging and conflict resolution [#807, #1165]
-- Fix macOS pasteboard issues [#1202]
-- Improve startup times on some platforms [#1205]
-- Hide the notes field by default [#1124]
-- Toggle main window by clicking tray icon with the middle mouse button [#992]
-- Fix custom icons not copied over when databases are merged [#1008]
-- Allow use of DEL key to delete entries [#914]
-- Correct intermittent crash due to stale history items [#1527]
-- Sanitize newline characters in title, username and URL fields [#1502]
-- Reopen previously opened databases in correct order [#774]
-- Use system's zxcvbn library if available [#701]
-- Implement various i18n improvements [#690, #875, #1436]
-
-2.2.4 (2017-12-13)
-=========================
-
-- Prevent database corruption when locked [#1219]
-- Fixes apply button not saving new entries [#1141]
-- Switch to Consolas font on Windows for password edit [#1229]
-- Multiple fixes to AppImage deployment [#1115, #1228]
-- Fixes multiple memory leaks [#1213]
-- Resize message close to 16x16 pixels [#1253]
-
-2.2.2 (2017-10-22)
-=========================
-
-- Fixed entries with empty URLs being reported to KeePassHTTP clients [#1031]
-- Fixed YubiKey detection and enabled CLI tool for AppImage binary [#1100]
-- Added AppStream description [#1082]
-- Improved TOTP compatibility and added new Base32 implementation [#1069]
-- Fixed error handling when processing invalid cipher stream [#1099]
-- Fixed double warning display when opening a database [#1037]
-- Fixed unlocking databases with --pw-stdin [#1087]
-- Added ability to override QT_PLUGIN_PATH environment variable for AppImages [#1079]
-- Fixed transform seed not being regenerated when saving the database [#1068]
-- Fixed only one YubiKey slot being polled [#1048]
-- Corrected an issue with entry icons while merging [#1008]
-- Corrected desktop and tray icons in Snap package [#1030]
-- Fixed screen lock and Google fallback settings [#1029]
-
-2.2.1 (2017-10-01)
-=========================
-
-- Corrected multiple snap issues [#934, #1011]
-- Corrected multiple custom icon issues [#708, #719, #994]
-- Corrected multiple Yubikey issues [#880]
-- Fixed single instance preventing load on occasion [#997]
-- Keep entry history when merging databases [#970]
-- Prevent data loss if passwords were mismatched [#1007]
-- Fixed crash after merge [#941]
-- Added configurable auto-type default delay [#703]
-- Unlock database dialog window comes to front [#663]
-- Translation and compiling fixes
-
-2.2.0 (2017-06-23)
-=========================
-
-- Added YubiKey 2FA integration for unlocking databases [#127]
-- Added TOTP support [#519]
-- Added CSV import tool [#146, #490]
-- Added KeePassXC CLI tool [#254]
-- Added diceware password generator [#373]
-- Added support for entry references [#370, #378]
-- Added support for Twofish encryption [#167]
-- Enabled DEP and ASLR for in-memory protection [#371]
-- Enabled single instance mode [#510]
-- Enabled portable mode [#645]
-- Enabled database lock on screensaver and session lock [#545]
-- Redesigned welcome screen with common features and recent databases [#292]
-- Multiple updates to search behavior [#168, #213, #374, #471, #603, #654]
-- Added auto-type fields {CLEARFIELD}, {SPACE}, {{}, {}} [#267, #427, #480]
-- Fixed auto-type errors on Linux [#550]
-- Prompt user prior to executing a cmd:// URL [#235]
-- Entry attributes can be protected (hidden) [#220]
-- Added extended ascii to password generator [#538]
-- Added new database icon to toolbar [#289]
-- Added context menu entry to empty recycle bin in databases [#520]
-- Added "apply" button to entry and group edit windows [#624]
-- Added macOS tray icon and enabled minimize on close [#583]
-- Fixed issues with unclean shutdowns [#170, #580]
-- Changed keyboard shortcut to create new database to CTRL+SHIFT+N [#515]
-- Compare window title to entry URLs [#556]
-- Implemented inline error messages [#162]
-- Ignore group expansion and other minor changes when making database "dirty" [#464]
-- Updated license and copyright information on souce files [#632]
-- Added contributors list to about dialog [#629]
-
-2.1.4 (2017-04-09)
-=========================
-
-- Bumped KeePassHTTP version to 1.8.4.2
-- KeePassHTTP confirmation window comes to foreground [#466]
-
-2.1.3 (2017-03-03)
-=========================
-
-- Fix possible overflow in zxcvbn library [#363]
-- Revert HiDPI setting to avoid problems on laptop screens [#332]
-- Set file meta properties in Windows executable [#330]
-- Suppress error message when auto-reloading a locked database [#345]
-- Improve usability of question dialog when database is already locked by a different instance [#346]
-- Fix compiler warnings in QHttp library [#351]
-- Use unified toolbar on Mac OS X [#361]
-- Fix an issue on X11 where the main window would be raised instead of closed on Alt+F4 [#362]
-
-2.1.2 (2017-02-17)
-=========================
-
-- Ask for save location when creating a new database [#302]
-- Remove Libmicrohttpd dependency to clean up the code and ensure better OS X compatibility [#317, #265]
-- Prevent Qt from degrading Wifi network performance on certain platforms [#318]
-- Visually refine user interface on OS X and other platforms [#299]
-- Remove unusable tray icon setting on OS X [#293]
-- Fix compositing glitches on Ubuntu and prevent flashing when minimizing to the tray at startup [#307]
-- Fix AppImage tray icon on Ubuntu [#277, #273]
-- Fix global menu disappearing after restoring KeePassXC from the tray on Ubuntu [#276]
-- Fix result order in entry search [#320]
-- Enable HiDPI scaling on supported platforms [#315]
-- Remove empty directories from installation target [#282]
-
-2.1.1 (2017-02-06)
-=========================
-
-- Enabled HTTP plugin build; plugin is disabled by default and limited to localhost [#147]
-- Escape HTML in dialog boxes [#247]
-- Corrected crashes in favicon download and password generator [#233, #226]
-- Increase font size of password meter [#228]
-- Fixed compatibility with Qt 5.8 [#211]
-- Use consistent button heights in password generator [#229]
-
-2.1.0 (2017-01-22)
-=========================
-
-- Show unlock dialog when using autotype on a closed database [#10, #89]
-- Show different tray icon when database is locked [#37, #46]
-- Support autotype on Windows and OS X [#42, #60, #63]
-- Add delay feature to autotype [#76, #77]
-- Add password strength meter [#84, #92]
-- Add option for automatically locking the database when minimizing
-  the window [#57]
-- Add feature to download favicons and use them as entry icons [#30]
-- Automatically reload and merge database when the file changed on
-  disk [#22, #33, #93]
-- Add tool for merging two databases [#22, #47, #143]
-- Add --pw-stdin commandline option to unlock the database by providing
-  a password on STDIN [#54]
-- Add utility script for reading the database password from KWallet [#55]
-- Fix some KeePassHTTP settings not being remembered [#34, #65]
-- Make search box persistent [#15, #67, #157]
-- Enhance search feature by scoping the search to selected group [#16, #118]
-- Improve interaction between search field and entry list [#131, #141]
-- Add stand-alone password-generator [#18, #92]
-- Don't require password repetition when password is visible [#27, #92]
-- Add support for entry attributes in autotype sequences [#107]
-- Always focus password field when opening the database unlock widget [#116, #117]
-- Fix compilation errors on various platforms [#53, #126, #130]
-- Restructure and improve kdbx-extract utility [#160]
-
-2.0.3 (2016-09-04)
-=========================
-
-- Improved error reporting when reading / writing databases fails. [#450, #462]
-- Display an error message when opening a custom icon fails.
-- Detect custom icon format based on contents instead of the filename. [#512]
-- Keep symlink intact when saving databases. [#442].
-- Fix a crash when deleting parent group of recycle bin. [#520]
-- Display a confirm dialog before moving an entry to the recycle bin. [#447]
-- Repair UUIDs of inconsistent history items. [#130]
-- Only include top-level windows in auto-type window list when using gnome-shell.
-- Update translations.
-
-2.0.2 (2016-02-02)
-=========================
-
-- Fix regression in database writer that caused it to strip certain special
-  characters (characters from Unicode plane > 0).
-- Fix bug in repair function that caused it to strip non-ASCII characters.
-
-2.0.1 (2016-01-31)
-=========================
-
-- Flush temporary file before opening attachment. [#390]
-- Disable password generator when showing entry in history mode. [#422]
-- Strip invalid XML chars when writing databases. [#392]
-- Add repair function to fix databases with invalid XML chars. [#392]
-- Display custom icons scaled. [#322]
-- Allow opening databases that have no password and keyfile. [#391]
-- Fix crash when importing .kdb files with invalid icon ids. [#425]
-- Update translations.
-
-2.0 (2015-12-06)
-=========================
-
-- Improve UI of the search edit.
-- Clear clipboard when locking databases. [#342]
-- Enable Ctrl+M shortcut to minimize the window on all platforms. [#329]
-- Show a better message when trying to open an old database format. [#338]
-- Fix global auto-type behavior with some window managers.
-- Show global auto-type window on the active desktop. [#359]
-- Disable systray on OS X. [#326]
-- Restore main window when clicking on the OS X docker icon. [#326]
-
-2.0 Beta 2 (2015-09-06)
-=========================
-
-- Fix crash when locking with search UI open [#309]
-- Fix file locking on Mac OS X [#327]
-- Set default extension when saving a database [#79, #308]
-
-2.0 Beta 1 (2015-07-18)
-=========================
-
-- Remember entry column sizes [#159]
-- Add translations
-- Support opening attachments directly
-- Support cmd:// URLs [#244]
-- Protect opened databases with a file lock [#18]
-- Export to csv files [#57]
-- Add optional tray icon [#153]
-- Allow setting the default auto-type sequence for groups [#175]
-- Make the kdbx parser more lenient
-- Remove --password command line option [#285]
-
-2.0 Alpha 6 (2014-04-12)
-=========================
-
-- Add option to lock databases after user inactivity [#62]
-- Add compatibility with libgcrypt 1.6 [#129]
-- Display passwords in monospace font [#51]
-- Use an icon for the button that shows/masks passwords [#38]
-- Add an option to show passwords by default [#93]
-- Improve password generator design [#122]
-- On Linux link .kdbx files with KeePassX
-- Remember window size [#154]
-- Disallow global auto-typing when the database is locked
-
-2.0 Alpha 5 (2013-12-20)
-=========================
-
-- Support copying entries and groups using drag'n'drop [#74]
-- Open last used databases on startup [#36]
-- Made the kdbx file parser more robust
-- Only edit entries on doubleclick (not single) or with enter key
-- Allow removing multiple entries
-- Added option to minimize window when copying data to clipboard
-- Save password generator settings
-- Fixed auto-type producing wrong chars in some keyboard configurations [#116]
-- Added some more actions to the toolbar
-
-2.0 Alpha 4 (2013-03-29)
-=========================
-
-- Add random password generator [#52]
-- Merge the 'Description' tab into the 'Entry' tab [#59]
-- Fix crash when deleting history items [#56]
-- Fix crash on Mac OS X Mountain Lion during startup [#50]
-- Improved KeePassX application icon [#58]
-
-2.0 Alpha 3 (2012-10-27)
-=========================
-
-- Auto-Type on Linux / X11
-- Database locking
-- Fix database corruption when changing key transformation rounds [#34]
-- Verify header data of kdbx files
-- Add menu entry to open URLs in the browser
-- Add menu entry to copy an entry attribute to clipboard
-
-2.0 Alpha 2 (2012-07-02)
-=========================
-
-- Import kdb (KeePass 1) files [#2]
-- Display history items [#23]
-- Implement history item limits [#16]
-- Group and entry icons can be set [#22]
-- Add keyboard shortcuts
-- Search in databases [#24]
-- Sortable entry view
-- Support building Mac OS X bundles
-
-2.0 Alpha 1 (2012-05-07)
-=========================
-
-- First release.

CMakeLists.txt

@@ -1,4 +1,4 @@
-#  Copyright (C) 2017 KeePassXC Team <team@keepassxc.org>
+#  Copyright (C) 2018 KeePassXC Team <team@keepassxc.org>
 #  Copyright (C) 2010 Felix Geyer <debfx@fobos.de>
 #
 #  This program is free software: you can redistribute it and/or modify
@@ -14,20 +14,27 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-cmake_minimum_required(VERSION 3.1.0)
+cmake_minimum_required(VERSION 3.10.0)
 
 project(KeePassXC)
+set(APP_ID "org.keepassxc.${PROJECT_NAME}")
 
 if(NOT CMAKE_BUILD_TYPE)
-  set(CMAKE_BUILD_TYPE "RelWithDebInfo" CACHE STRING
-      "Choose the type of build, options are: None Debug Release RelWithDebInfo Debug DebugFull Profile MinSizeRel."
-      FORCE)
+    set(CMAKE_BUILD_TYPE "RelWithDebInfo" CACHE STRING
+            "Choose the type of build, options are: Debug Release RelWithDebInfo Profile"
+            FORCE)
+endif()
+string(TOLOWER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE_LOWER)
+if(CMAKE_BUILD_TYPE_LOWER STREQUAL "debug" OR CMAKE_BUILD_TYPE_LOWER STREQUAL "relwithdebinfo")
+    set(IS_DEBUG_BUILD TRUE)
 endif()
 
 set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
 
 # Support Visual Studio Code
 include(CMakeToolsHelpers OPTIONAL)
+include(FeatureSummary)
+include(KPXCMacDeployHelpers)
 
 include(CheckCCompilerFlag)
 include(CheckCXXCompilerFlag)
@@ -39,74 +46,148 @@ option(WITH_DEV_BUILD "Use only for development. Disables/warns about deprecated
 option(WITH_ASAN "Enable address sanitizer checks (Linux / macOS only)" OFF)
 option(WITH_COVERAGE "Use to build with coverage tests (GCC only)." OFF)
 option(WITH_APP_BUNDLE "Enable Application Bundle for macOS" ON)
+option(WITH_CCACHE "Use ccache for build" OFF)
 
-set(WITH_XC_ALL OFF CACHE BOOLEAN "Build in all available plugins")
+set(WITH_XC_ALL OFF CACHE BOOL "Build in all available plugins")
 
 option(WITH_XC_AUTOTYPE "Include Auto-Type." ON)
-option(WITH_XC_NETWORKING "Include networking code (e.g. for downlading website icons)." OFF)
+option(WITH_XC_NETWORKING "Include networking code (e.g. for downloading website icons)." OFF)
 option(WITH_XC_BROWSER "Include browser integration with keepassxc-browser." OFF)
-option(WITH_XC_HTTP "Include KeePassHTTP-compatible browser integration (deprecated, implies WITH_NETWORKING)." OFF)
+option(WITH_XC_BROWSER_PASSKEYS "Passkeys support for browser integration." OFF)
 option(WITH_XC_YUBIKEY "Include YubiKey support." OFF)
 option(WITH_XC_SSHAGENT "Include SSH agent support." OFF)
+option(WITH_XC_KEESHARE "Sharing integration with KeeShare" OFF)
+option(WITH_XC_UPDATECHECK "Include automatic update checks; disable for controlled distributions" ON)
+if(UNIX AND NOT APPLE)
+    option(WITH_XC_FDOSECRETS "Implement freedesktop.org Secret Storage Spec server side API." OFF)
+    set(WITH_XC_X11 ON CACHE BOOL "Enable building with X11 deps")
+endif()
+option(WITH_XC_DOCS "Enable building of documentation" ON)
+if(WIN32 OR APPLE)
+    set(WITH_XC_CODESIGN_IDENTITY "" CACHE STRING "Certificate to be used for signing binaries before packaging.")
+    if(WIN32)
+        set(WITH_XC_CODESIGN_TIMESTAMP_URL "http://timestamp.sectigo.com" CACHE STRING "Timestamp URL for Windows code signing.")
+    elseif(APPLE)
+        set(WITH_XC_NOTARY_KEYCHAIN_PROFILE "" CACHE STRING "Keychain profile name for stored Apple notarization credentials.")
+    endif()
+endif()
 
-if(WITH_XC_HTTP)
-  message(WARNING "KeePassHTTP support has been deprecated and will be removed in a future version. Please use WITH_XC_BROWSER instead!\n"
-          "For enabling / disabling network access code, WITH_XC_HTTP has been replaced by WITH_XC_NETWORKING.")
-  set(WITH_XC_NETWORKING ON CACHE BOOL "Include networking code (e.g. for downlading website icons)." FORCE)
+if(APPLE)
+    # Perform the platform checks before applying the stricter compiler flags.
+    # Otherwise the kSecAccessControlTouchIDCurrentSet deprecation warning will result in an error.
+    try_compile(XC_APPLE_COMPILER_SUPPORT_BIOMETRY
+       ${CMAKE_CURRENT_BINARY_DIR}/tiometry_test/
+       ${CMAKE_CURRENT_SOURCE_DIR}/cmake/compiler-checks/macos/control_biometry_support.mm)
+    message(STATUS "Biometry compiler support: ${XC_APPLE_COMPILER_SUPPORT_BIOMETRY}")
+
+    try_compile(XC_APPLE_COMPILER_SUPPORT_TOUCH_ID
+       ${CMAKE_CURRENT_BINARY_DIR}/touch_id_test/
+       ${CMAKE_CURRENT_SOURCE_DIR}/cmake/compiler-checks/macos/control_touch_id_support.mm)
+    message(STATUS "Touch ID compiler support: ${XC_APPLE_COMPILER_SUPPORT_TOUCH_ID}")
+
+    try_compile(XC_APPLE_COMPILER_SUPPORT_WATCH
+       ${CMAKE_CURRENT_BINARY_DIR}/tiometry_test/
+       ${CMAKE_CURRENT_SOURCE_DIR}/cmake/compiler-checks/macos/control_watch_support.mm)
+    message(STATUS "Apple watch compiler support: ${XC_APPLE_COMPILER_SUPPORT_WATCH}")
+endif()
+
+if(WITH_CCACHE)
+    # Use the Compiler Cache (ccache) program
+    # (install with: sudo apt get ccache)
+    find_program(CCACHE_FOUND ccache)
+    if(NOT CCACHE_FOUND)
+        message(FATAL_ERROR "ccache requested but cannot be found.")
+    endif()
+    set_property(GLOBAL PROPERTY RULE_LAUNCH_COMPILE ${CCACHE_FOUND})
 endif()
 
 if(WITH_XC_ALL)
-  # Enable all options
-  set(WITH_XC_AUTOTYPE ON)
-  set(WITH_XC_NETWORKING ON)
-  set(WITH_XC_BROWSER ON)
-  set(WITH_XC_HTTP ON) # Deprecated
-  set(WITH_XC_YUBIKEY ON)
-  set(WITH_XC_SSHAGENT ON)
+    # Enable all options (except update check and docs)
+    set(WITH_XC_AUTOTYPE ON)
+    set(WITH_XC_NETWORKING ON)
+    set(WITH_XC_BROWSER ON)
+    set(WITH_XC_BROWSER_PASSKEYS ON)
+    set(WITH_XC_YUBIKEY ON)
+    set(WITH_XC_SSHAGENT ON)
+    set(WITH_XC_KEESHARE ON)
+    if(UNIX AND NOT APPLE)
+        set(WITH_XC_FDOSECRETS ON)
+    endif()
 endif()
 
-# Process ui files automatically from source files
-set(CMAKE_AUTOUIC ON)
+# Prefer WITH_XC_NETWORKING setting over WITH_XC_UPDATECHECK
+if(NOT WITH_XC_NETWORKING AND WITH_XC_UPDATECHECK)
+    message(STATUS "Disabling WITH_XC_UPDATECHECK because WITH_XC_NETWORKING is disabled")
+    set(WITH_XC_UPDATECHECK OFF)
+endif()
+
+if(UNIX AND NOT APPLE AND NOT WITH_XC_X11)
+    message(STATUS "Disabling WITH_XC_AUTOTYPE because WITH_XC_X11 is disabled")
+    set(WITH_XC_AUTOTYPE OFF)
+endif()
 
 set(KEEPASSXC_VERSION_MAJOR "2")
-set(KEEPASSXC_VERSION_MINOR "3")
+set(KEEPASSXC_VERSION_MINOR "8")
 set(KEEPASSXC_VERSION_PATCH "0")
 set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION_MAJOR}.${KEEPASSXC_VERSION_MINOR}.${KEEPASSXC_VERSION_PATCH}")
+set(OVERRIDE_VERSION "" CACHE STRING "Override the KeePassXC Version for Snapshot builds")
 
 set(KEEPASSXC_BUILD_TYPE "Snapshot" CACHE STRING "Set KeePassXC build type to distinguish between stable releases and snapshots")
 set_property(CACHE KEEPASSXC_BUILD_TYPE PROPERTY STRINGS Snapshot Release PreRelease)
 
+# Retrieve git HEAD revision hash
+set(GIT_HEAD_OVERRIDE "" CACHE STRING "Manually set the Git HEAD hash when missing (eg, when no .git folder exists)")
+execute_process(COMMAND git rev-parse --short=7 HEAD
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+        OUTPUT_VARIABLE GIT_HEAD
+        ERROR_QUIET)
+string(STRIP "${GIT_HEAD}" GIT_HEAD)
+if(GIT_HEAD STREQUAL "" AND NOT GIT_HEAD_OVERRIDE STREQUAL "")
+    string(SUBSTRING "${GIT_HEAD_OVERRIDE}" 0 7 GIT_HEAD)
+elseif(EXISTS ${CMAKE_SOURCE_DIR}/.gitrev)
+    file(READ ${CMAKE_SOURCE_DIR}/.gitrev GIT_HEAD)
+endif()
+message(STATUS "Found Git HEAD Revision: ${GIT_HEAD}\n")
+
 # Check if on a tag, if so build as a release
 execute_process(COMMAND git tag --points-at HEAD
         WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
-        OUTPUT_VARIABLE GIT_TAG)
-if(NOT GIT_TAG AND EXISTS ${CMAKE_SOURCE_DIR}/.version)
-  file(READ ${CMAKE_SOURCE_DIR}/.version OVERRIDE_VERSION)
+        OUTPUT_VARIABLE GIT_TAG
+        ERROR_QUIET)
+string(REGEX REPLACE "latest" "" GIT_TAG "${GIT_TAG}")
+if(GIT_TAG MATCHES "[0-9]+\.[0-9]+\.[0-9]+")
+    string(STRIP "${GIT_TAG}" GIT_TAG)
+    set(OVERRIDE_VERSION ${GIT_TAG})
+elseif(EXISTS ${CMAKE_SOURCE_DIR}/.version)
+    file(READ ${CMAKE_SOURCE_DIR}/.version OVERRIDE_VERSION)
 endif()
 
 string(REGEX REPLACE "(\r?\n)+" "" OVERRIDE_VERSION "${OVERRIDE_VERSION}")
 if(OVERRIDE_VERSION)
-  if(OVERRIDE_VERSION MATCHES "^[\\.0-9]+-(alpha|beta)[0-9]+$")
-    set(KEEPASSXC_BUILD_TYPE PreRelease)
-    set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
-  elseif(OVERRIDE_VERSION MATCHES "^[\\.0-9]+$")
-    set(KEEPASSXC_BUILD_TYPE Release)
-    set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
-  endif()
-endif()
-
-if(KEEPASSXC_BUILD_TYPE STREQUAL "PreRelease" AND NOT OVERRIDE_VERSION)
-  set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION}-preview")
-elseif(KEEPASSXC_BUILD_TYPE STREQUAL "Snapshot")
-  set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION}-snapshot")
+    if(OVERRIDE_VERSION MATCHES "^[\\.0-9]+-beta[0-9]*")
+        set(KEEPASSXC_BUILD_TYPE "PreRelease")
+        set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
+    elseif(OVERRIDE_VERSION MATCHES "^[\\.0-9]+$")
+        set(KEEPASSXC_BUILD_TYPE "Release")
+        set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
+    else()
+        set(KEEPASSXC_BUILD_TYPE "Snapshot")
+        set(KEEPASSXC_VERSION ${OVERRIDE_VERSION})
+    endif()
+else()
+    if(KEEPASSXC_BUILD_TYPE STREQUAL "PreRelease")
+        set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION}-preview")
+    elseif(KEEPASSXC_BUILD_TYPE STREQUAL "Snapshot")
+        set(KEEPASSXC_VERSION "${KEEPASSXC_VERSION}-snapshot")
+    endif()
 endif()
 
 if(KEEPASSXC_BUILD_TYPE STREQUAL "Release")
-  set(KEEPASSXC_BUILD_TYPE_RELEASE ON)
+    set(KEEPASSXC_BUILD_TYPE_RELEASE ON)
 elseif(KEEPASSXC_BUILD_TYPE STREQUAL "PreRelease")
-  set(KEEPASSXC_BUILD_TYPE_PRE_RELEASE ON)
+    set(KEEPASSXC_BUILD_TYPE_PRE_RELEASE ON)
 else()
-  set(KEEPASSXC_BUILD_TYPE_SNAPSHOT ON)
+    set(KEEPASSXC_BUILD_TYPE_SNAPSHOT ON)
 endif()
 
 message(STATUS "Setting up build for KeePassXC v${KEEPASSXC_VERSION}\n")
@@ -114,235 +195,419 @@ message(STATUS "Setting up build for KeePassXC v${KEEPASSXC_VERSION}\n")
 # Distribution info
 set(KEEPASSXC_DIST ON)
 set(KEEPASSXC_DIST_TYPE "Other" CACHE STRING "KeePassXC Distribution Type")
-set_property(CACHE KEEPASSXC_DIST_TYPE PROPERTY STRINGS Snap AppImage Other)
+set_property(CACHE KEEPASSXC_DIST_TYPE PROPERTY STRINGS Snap AppImage Flatpak Other)
 if(KEEPASSXC_DIST_TYPE STREQUAL "Snap")
-  set(KEEPASSXC_DIST_SNAP ON)
+    set(KEEPASSXC_DIST_SNAP ON)
 elseif(KEEPASSXC_DIST_TYPE STREQUAL "AppImage")
-  set(KEEPASSXC_DIST_APPIMAGE ON)
+    set(KEEPASSXC_DIST_APPIMAGE ON)
+elseif(KEEPASSXC_DIST_TYPE STREQUAL "Flatpak")
+    set(KEEPASSXC_DIST_FLATPAK ON)
 elseif(KEEPASSXC_DIST_TYPE STREQUAL "Other")
-  unset(KEEPASSXC_DIST)
+    unset(KEEPASSXC_DIST)
 endif()
 
-if("${CMAKE_C_COMPILER}" MATCHES "clang$" OR "${CMAKE_C_COMPILER_ID}" STREQUAL "Clang")
-  set(CMAKE_COMPILER_IS_CLANG 1)
+if(${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.14.0")
+    cmake_policy(SET CMP0083 NEW)
+    include(CheckPIESupported)
+    check_pie_supported()
 endif()
 
-if("${CMAKE_CXX_COMPILER}" MATCHES "clang(\\+\\+)?$" OR "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
-  set(CMAKE_COMPILER_IS_CLANGXX 1)
+# Find Botan early since the version affects subsequent compiler options
+find_package(Botan REQUIRED)
+if(BOTAN_VERSION VERSION_GREATER_EQUAL "3.0.0")
+    set(WITH_XC_BOTAN3 TRUE)
+elseif(BOTAN_VERSION VERSION_LESS "2.11.0")
+    # Check for minimum Botan version
+    message(FATAL_ERROR "Botan 2.11.0 or higher is required")   
+endif()
+include_directories(SYSTEM ${BOTAN_INCLUDE_DIR})
+
+# Create position independent code for shared libraries and executables
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+
+if("${CMAKE_SIZEOF_VOID_P}" EQUAL "4")
+    set(IS_32BIT TRUE)
+endif()
+
+if("${CMAKE_CXX_COMPILER}" MATCHES "clang-cl(.exe)?$")
+    # clang-cl uses MSVC compiler flags
+    set(MSVC 1)
+    set(CMAKE_COMPILER_IS_CLANG_MSVC 1)
+else()
+    set(CLANG_COMPILER_ID_REGEX "^(Apple)?[Cc]lang$")
+    if("${CMAKE_C_COMPILER}" MATCHES "clang$"
+            OR "${CMAKE_EXTRA_GENERATOR_C_SYSTEM_DEFINED_MACROS}" MATCHES "__clang__"
+            OR "${CMAKE_C_COMPILER_ID}" MATCHES ${CLANG_COMPILER_ID_REGEX})
+        set(CMAKE_COMPILER_IS_CLANG 1)
+    endif()
+
+    if("${CMAKE_CXX_COMPILER}" MATCHES "clang(\\+\\+)?$"
+            OR "${CMAKE_EXTRA_GENERATOR_CXX_SYSTEM_DEFINED_MACROS}" MATCHES "__clang__"
+            OR "${CMAKE_CXX_COMPILER_ID}" MATCHES ${CLANG_COMPILER_ID_REGEX})
+        set(CMAKE_COMPILER_IS_CLANGXX 1)
+    endif()
 endif()
 
 macro(add_gcc_compiler_cxxflags FLAGS)
-  if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_COMPILER_IS_CLANGXX)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${FLAGS}")
-  endif()
+    if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_COMPILER_IS_CLANGXX)
+        set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${FLAGS}")
+    endif()
 endmacro(add_gcc_compiler_cxxflags)
 
 macro(add_gcc_compiler_cflags FLAGS)
-  if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${FLAGS}")
-  endif()
+    if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
+        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${FLAGS}")
+    endif()
 endmacro(add_gcc_compiler_cflags)
 
 macro(add_gcc_compiler_flags FLAGS)
-  add_gcc_compiler_cxxflags("${FLAGS}")
-  add_gcc_compiler_cflags("${FLAGS}")
+    add_gcc_compiler_cxxflags("${FLAGS}")
+    add_gcc_compiler_cflags("${FLAGS}")
 endmacro(add_gcc_compiler_flags)
 
+# Copies of above macros that first ensure the compiler understands a given flag
+# Because check_*_compiler_flag() sets -D with name, need to provide "safe" FLAGNAME
+macro(check_add_gcc_compiler_cxxflag FLAG FLAGNAME)
+    check_cxx_compiler_flag("${FLAG}" CXX_HAS${FLAGNAME})
+    if(CXX_HAS${FLAGNAME})
+        add_gcc_compiler_cxxflags("${FLAG}")
+    endif()
+endmacro(check_add_gcc_compiler_cxxflag)
+
+macro(check_add_gcc_compiler_cflag FLAG FLAGNAME)
+    check_c_compiler_flag("${FLAG}" CC_HAS${FLAGNAME})
+    if(CC_HAS${FLAGNAME})
+        add_gcc_compiler_cflags("${FLAG}")
+    endif()
+endmacro(check_add_gcc_compiler_cflag)
+
+# This is the "front-end" for the above macros
+# Optionally takes additional parameter(s) with language to check (currently "C" or "CXX")
+macro(check_add_gcc_compiler_flag FLAG)
+    string(REGEX REPLACE "[-=]" "_" FLAGNAME "${FLAG}")
+    set(check_lang_spec ${ARGN})
+    list(LENGTH check_lang_spec num_extra_args)
+    set(langs C CXX)
+    if(num_extra_args GREATER 0)
+        set(langs "${check_lang_spec}")
+    endif()
+    if("C" IN_LIST langs)
+        check_add_gcc_compiler_cflag("${FLAG}" "${FLAGNAME}")
+    endif()
+    if("CXX" IN_LIST langs)
+        check_add_gcc_compiler_cxxflag("${FLAG}" "${FLAGNAME}")
+    endif()
+endmacro(check_add_gcc_compiler_flag)
+
 add_definitions(-DQT_NO_EXCEPTIONS -DQT_STRICT_ITERATORS -DQT_NO_CAST_TO_ASCII)
+if(NOT IS_DEBUG_BUILD)
+    add_definitions(-DQT_NO_DEBUG_OUTPUT)
+endif()
 
 if(WITH_APP_BUNDLE)
-  add_definitions(-DWITH_APP_BUNDLE)
+    add_definitions(-DWITH_APP_BUNDLE)
 endif()
 
 add_gcc_compiler_flags("-fno-common")
-add_gcc_compiler_flags("-Wall -Werror -Wextra -Wundef -Wpointer-arith -Wno-long-long")
+find_package(OpenMP)
+if(OpenMP_FOUND)
+    add_gcc_compiler_cflags(${OpenMP_C_FLAGS})
+    add_gcc_compiler_cxxflags(${OpenMP_CXX_FLAGS})
+endif()
+add_gcc_compiler_flags("-Wall -Wextra -Wundef -Wpointer-arith -Wno-long-long")
 add_gcc_compiler_flags("-Wformat=2 -Wmissing-format-attribute")
 add_gcc_compiler_flags("-fvisibility=hidden")
 add_gcc_compiler_cxxflags("-fvisibility-inlines-hidden")
 
-if((CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER 4.8.999) OR CMAKE_COMPILER_IS_CLANGXX)
-    add_gcc_compiler_flags("-fstack-protector-strong")
-else()
-    add_gcc_compiler_flags("-fstack-protector --param=ssp-buffer-size=4")
+if(CMAKE_BUILD_TYPE_LOWER STREQUAL "debug")
+    check_add_gcc_compiler_flag("-Wshadow-compatible-local")
+    check_add_gcc_compiler_flag("-Wshadow-local")
+    add_gcc_compiler_flags("-Werror")
+    # This is needed since compiling against Botan3 requires compiling against C++20
+    if(WITH_XC_BOTAN3)
+        add_gcc_compiler_cxxflags("-Wno-error=deprecated-enum-enum-conversion -Wno-error=deprecated")
+    endif()
+endif()
+
+if (NOT HAIKU)
+    if((CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER 4.8.999) OR CMAKE_COMPILER_IS_CLANGXX)
+        add_gcc_compiler_flags("-fstack-protector-strong")
+    else()
+        add_gcc_compiler_flags("-fstack-protector --param=ssp-buffer-size=4")
+    endif()
 endif()
 
-add_gcc_compiler_cxxflags("-fno-exceptions -fno-rtti")
 add_gcc_compiler_cxxflags("-Wnon-virtual-dtor -Wold-style-cast -Woverloaded-virtual")
 add_gcc_compiler_cflags("-Wchar-subscripts -Wwrite-strings")
 
 if(WITH_ASAN)
-  if(NOT (CMAKE_SYSTEM_NAME STREQUAL "Linux" OR APPLE))
-      message(FATAL_ERROR "WITH_ASAN is only supported on Linux / macOS at the moment.")
-  endif()
-
-  add_gcc_compiler_flags("-fsanitize=address -DWITH_ASAN")
-
-  if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-    if(NOT (CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 4.9))
-      add_gcc_compiler_flags("-fsanitize=leak -DWITH_LSAN")
+    if(NOT (CMAKE_SYSTEM_NAME STREQUAL "Linux" OR APPLE))
+        message(FATAL_ERROR "WITH_ASAN is only supported on Linux / macOS at the moment.")
+    endif()
+
+    add_gcc_compiler_flags("-fsanitize=address -DWITH_ASAN")
+
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        if(NOT (CMAKE_COMPILER_IS_GNUCXX AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 4.9))
+            add_gcc_compiler_flags("-fsanitize=leak -DWITH_LSAN")
+        endif()
     endif()
-  endif()
 
 endif()
 
-string(TOLOWER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE_LOWER)
-if (CMAKE_BUILD_TYPE_LOWER MATCHES "(release|relwithdebinfo|minsizerel)")
-  add_gcc_compiler_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2")
+if(CMAKE_BUILD_TYPE_LOWER MATCHES "(release|relwithdebinfo|minsizerel)")
+    add_gcc_compiler_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2")
 endif()
 
-check_c_compiler_flag("-Werror=format-security -Werror=implicit-function-declaration" WERROR_C_AVAILABLE)
-check_cxx_compiler_flag("-Werror=format-security" WERROR_CXX_AVAILABLE)
-if(WERROR_C_AVAILABLE AND WERROR_CXX_AVAILABLE)
-  add_gcc_compiler_flags("-Werror=format-security")
-  add_gcc_compiler_cflags("-Werror=implicit-function-declaration")
+check_add_gcc_compiler_flag("-Werror=format-security")
+check_add_gcc_compiler_flag("-Werror=implicit-function-declaration" C)
+check_add_gcc_compiler_flag("-Wcast-align")
+
+if(UNIX AND NOT APPLE)
+    check_add_gcc_compiler_flag("-Qunused-arguments")
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--as-needed -Wl,--no-undefined")
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro,-z,now -pie")
+    set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--as-needed")
+    set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
 endif()
 
-if(CMAKE_COMPILER_IS_GNUCXX)
-  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wcast-align")
+set(CMAKE_C_STANDARD 99)
+if(WITH_XC_BOTAN3)
+    set(CMAKE_CXX_STANDARD 20)
+else()
+    set(CMAKE_CXX_STANDARD 17)
+endif()
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
-  if(WITH_COVERAGE)
-    # Include code coverage, use with -DCMAKE_BUILD_TYPE=Coverage
-    include(CodeCoverage)
-    setup_target_for_coverage(kp_coverage "make test" coverage)
-  endif()
+check_cxx_compiler_flag("-fsized-deallocation" CXX_HAS_fsized_deallocation)
+if(CXX_HAS_fsized_deallocation)
+    # Do additional check: the deallocation functions must be there too.
+    set(CMAKE_REQUIRED_FLAGS "-fsized-deallocation")
+    check_cxx_source_compiles("#include <new>
+        int main() { void * ptr = nullptr; std::size_t size = 1; ::operator delete(ptr, size); }"
+        HAVE_DEALLOCATION_FUNCTIONS)
+    if(HAVE_DEALLOCATION_FUNCTIONS)
+        check_add_gcc_compiler_flag("-fsized-deallocation" CXX)
+    endif()
+    unset(CMAKE_REQUIRED_FLAGS)
 endif()
 
-if(CMAKE_COMPILER_IS_GNUCC)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wcast-align")
-endif()
-
-if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  if (CMAKE_COMPILER_IS_CLANGXX)
-      add_gcc_compiler_flags("-Qunused-arguments")
-  endif()
-  add_gcc_compiler_flags("-pie -fPIE")
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--no-add-needed -Wl,--as-needed -Wl,--no-undefined")
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
-  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--no-add-needed -Wl,--as-needed")
-  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
-endif()
-
-add_gcc_compiler_cflags("-std=c99")
-add_gcc_compiler_cxxflags("-std=c++11")
-
-if(APPLE)
-  add_gcc_compiler_cxxflags("-stdlib=libc++")
+if(APPLE AND CMAKE_COMPILER_IS_CLANGXX)
+    add_gcc_compiler_cxxflags("-stdlib=libc++")
 endif()
 
 if(WITH_DEV_BUILD)
-  add_definitions(-DQT_DEPRECATED_WARNINGS -DGCRYPT_NO_DEPRECATED)
-endif()
-
-if(MINGW)
-  set(CMAKE_RC_COMPILER_INIT windres)
-  enable_language(RC)
-  set(CMAKE_RC_COMPILE_OBJECT "<CMAKE_RC_COMPILER> <FLAGS> -O coff <DEFINES> -i <SOURCE> -o <OBJECT>")
-  if(NOT (CMAKE_BUILD_TYPE STREQUAL "Debug" OR CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo"))
-    # Enable DEP and ASLR
-    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
-    set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
-  endif()
-endif()
-
-if(APPLE AND WITH_APP_BUNDLE OR MINGW)
-  set(PROGNAME KeePassXC)
+    add_definitions(-DQT_DEPRECATED_WARNINGS)
 else()
-  set(PROGNAME keepassxc)
+    add_definitions(-DQT_NO_DEPRECATED_WARNINGS)
+    add_gcc_compiler_cxxflags("-Wno-deprecated-declarations")
 endif()
 
-if(APPLE AND WITH_APP_BUNDLE AND "${CMAKE_INSTALL_PREFIX}" STREQUAL "/usr/local")
-  set(CMAKE_INSTALL_PREFIX "/Applications")
-  set(CMAKE_INSTALL_MANDIR "/usr/local/share/man")
+# MSVC specific options
+if (MSVC)
+    if(MSVC_TOOLSET_VERSION LESS 141)
+        message(FATAL_ERROR "Only Microsoft Visual Studio 17 and newer are supported!")
+    endif()
+    add_compile_options(/permissive- /utf-8)
+    # Clang-cl does not support /MP, /Zf, or /fsanitize=address
+    if (NOT CMAKE_COMPILER_IS_CLANG_MSVC)
+        add_compile_options(/MP)
+        if(IS_DEBUG_BUILD)
+            add_compile_options(/Zf)
+            if(MSVC_TOOLSET_VERSION GREATER 141)
+                add_compile_definitions(/fsanitize=address)
+            endif()
+        endif()
+    endif()
 endif()
 
-if(MINGW)
-  set(CLI_INSTALL_DIR    ".")
-  set(PROXY_INSTALL_DIR  ".")
-  set(BIN_INSTALL_DIR    ".")
-  set(PLUGIN_INSTALL_DIR ".")
-  set(DATA_INSTALL_DIR   "share")
+if(WIN32)
+    set(CMAKE_RC_COMPILER_INIT windres)
+    enable_language(RC)
+    if(MINGW)
+        set(CMAKE_RC_COMPILE_OBJECT "<CMAKE_RC_COMPILER> <FLAGS> -O coff <DEFINES> -i <SOURCE> -o <OBJECT>")
+    endif()
+    if(NOT IS_DEBUG_BUILD)
+        if(MSVC)
+            # By default MSVC enables NXCOMPAT
+            add_compile_options(/guard:cf)
+            add_link_options(/DYNAMICBASE /HIGHENTROPYVA /GUARD:CF)
+        else()
+            set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
+            set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--nxcompat -Wl,--dynamicbase")
+            # Enable high entropy ASLR for 64-bit builds
+            if(NOT IS_32BIT)
+                set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--high-entropy-va")
+                set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,--high-entropy-va")
+            endif()
+        endif()
+    endif()
+    # Determine if we can link against the Windows SDK, used for Windows Hello support
+    find_library(WINSDK WindowsApp.lib)
+endif()
+
+if(APPLE AND WITH_APP_BUNDLE OR WIN32)
+    set(PROGNAME KeePassXC)
+else()
+    set(PROGNAME keepassxc)
+endif()
+
+if(WIN32)
+    set(CLI_INSTALL_DIR ".")
+    set(PROXY_INSTALL_DIR ".")
+    set(BIN_INSTALL_DIR ".")
+    set(PLUGIN_INSTALL_DIR ".")
+    set(DATA_INSTALL_DIR "share")
 elseif(APPLE AND WITH_APP_BUNDLE)
-  set(CLI_INSTALL_DIR    "/usr/local/bin")
-  set(PROXY_INSTALL_DIR  "/usr/local/bin")
-  set(BIN_INSTALL_DIR    ".")
-  set(PLUGIN_INSTALL_DIR "${PROGNAME}.app/Contents/PlugIns")
-  set(DATA_INSTALL_DIR   "${PROGNAME}.app/Contents/Resources")
+    set(BUNDLE_INSTALL_DIR "${PROGNAME}.app/Contents")
+    set(CMAKE_INSTALL_MANDIR "${BUNDLE_INSTALL_DIR}/Resources/man")
+    set(CLI_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS")
+    set(PROXY_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS")
+    set(BIN_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS")
+    set(PLUGIN_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/PlugIns")
+    set(DATA_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/Resources")
 else()
-  include(GNUInstallDirs)
+    include(GNUInstallDirs)
 
-  set(CLI_INSTALL_DIR    "${CMAKE_INSTALL_BINDIR}")
-  set(PROXY_INSTALL_DIR  "${CMAKE_INSTALL_BINDIR}")
-  set(BIN_INSTALL_DIR    "${CMAKE_INSTALL_BINDIR}")
-  set(PLUGIN_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/keepassxc")
-  set(DATA_INSTALL_DIR   "${CMAKE_INSTALL_DATADIR}/keepassxc")
+    set(CLI_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}")
+    set(PROXY_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}")
+    set(BIN_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}")
+    set(PLUGIN_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/keepassxc")
+    set(DATA_INSTALL_DIR "${CMAKE_INSTALL_DATADIR}/keepassxc")
 endif()
 
 if(WITH_TESTS)
-  enable_testing()
+    enable_testing()
 endif(WITH_TESTS)
 
-if(UNIX AND NOT APPLE)
-  find_package(Qt5 COMPONENTS Core Network Concurrent Widgets Test LinguistTools DBus REQUIRED)
-elseif(APPLE)
-  find_package(Qt5 COMPONENTS Core Network Concurrent Widgets Test LinguistTools REQUIRED
-    HINTS /usr/local/Cellar/qt/*/lib/cmake ENV PATH
-  )
-  find_package(Qt5 COMPONENTS MacExtras
-    HINTS /usr/local/Cellar/qt/*/lib/cmake ENV PATH
-  )
-else()
-  find_package(Qt5 COMPONENTS Core Network Concurrent Widgets Test LinguistTools REQUIRED)
+if(WITH_COVERAGE)
+    # Include code coverage, use with -DCMAKE_BUILD_TYPE=Debug
+    include(CodeCoverage)
+    append_coverage_compiler_flags()
+
+    set(COVERAGE_EXCLUDES
+            "'^(.+/)?thirdparty/.*'"
+            "'^(.+/)?main\\.cpp$$'"
+            "'^(.+/)?cli/keepassxc-cli\\.cpp$$'"
+            "'^(.+/)?proxy/keepassxc-proxy\\.cpp$$'")
+    if(WITH_COVERAGE AND CMAKE_COMPILER_IS_CLANGXX)
+        set(MAIN_BINARIES
+                "$<TARGET_FILE:${PROGNAME}>"
+                "$<TARGET_FILE:keepassxc-cli>"
+                "$<TARGET_FILE:keepassxc-proxy>")
+        setup_target_for_coverage_llvm(
+                NAME coverage
+                BINARY ${MAIN_BINARIES}
+                SOURCES_ROOT ${CMAKE_SOURCE_DIR}/src
+        )
+    else()
+        setup_target_for_coverage_gcovr(
+                NAME coverage
+                SOURCES_ROOT ${CMAKE_SOURCE_DIR}/src
+        )
+    endif()
 endif()
 
-if(Qt5Core_VERSION VERSION_LESS "5.2.0")
-  message(FATAL_ERROR "Qt version 5.2.0 or higher is required")
+include(CLangFormat)
+
+set(QT_COMPONENTS Core Network Concurrent Gui Svg Widgets Test LinguistTools)
+if(UNIX AND NOT APPLE)
+    if(WITH_XC_X11)
+        list(APPEND QT_COMPONENTS X11Extras)
+    endif()
+    find_package(Qt5 COMPONENTS ${QT_COMPONENTS} DBus REQUIRED)
+elseif(APPLE)
+    find_package(Qt5 COMPONENTS ${QT_COMPONENTS} REQUIRED HINTS
+            /usr/local/opt/qt@5/lib/cmake
+            /usr/local/Cellar/qt@5/*/lib/cmake
+            /opt/homebrew/opt/qt@5/lib/cmake
+            ENV PATH)
+    find_package(Qt5 COMPONENTS MacExtras HINTS
+            /usr/local/opt/qt@5/lib/cmake
+            /usr/local/Cellar/qt@5/*/lib/cmake
+            /opt/homebrew/opt/qt@5/lib/cmake
+            ENV PATH)
+else()
+    find_package(Qt5 COMPONENTS ${QT_COMPONENTS} REQUIRED)
+endif()
+
+if(Qt5Core_VERSION VERSION_LESS "5.12.0")
+    message(FATAL_ERROR "Qt version 5.12.0 or higher is required")
 endif()
 
 get_filename_component(Qt5_PREFIX ${Qt5_DIR}/../../.. REALPATH)
+if(APPLE)
+    # Add includes under Qt5 Prefix in case Qt6 is also installed
+    include_directories(SYSTEM ${Qt5_PREFIX}/include)
+endif()
 
+# Process moc automatically
 set(CMAKE_AUTOMOC ON)
+# Process .ui files automatically
 set(CMAKE_AUTOUIC ON)
+# Process .qrc files automatically
 set(CMAKE_AUTORCC ON)
 
 if(APPLE)
-  set(CMAKE_MACOSX_RPATH TRUE)
-  find_program(MACDEPLOYQT_EXE macdeployqt HINTS ${Qt5_PREFIX}/bin ENV PATH)
-  if(NOT MACDEPLOYQT_EXE)
-    message(FATAL_ERROR "macdeployqt is required to build in macOS")
-  else()
+    set(CMAKE_MACOSX_RPATH TRUE)
+    find_program(MACDEPLOYQT_EXE macdeployqt HINTS ${Qt5_PREFIX}/bin ${Qt5_PREFIX}/tools/qt5/bin ENV PATH)
+    if(NOT MACDEPLOYQT_EXE)
+        message(FATAL_ERROR "macdeployqt is required to build on macOS")
+    endif()
     message(STATUS "Using macdeployqt: ${MACDEPLOYQT_EXE}")
-  endif()
+    set(MACDEPLOYQT_EXTRA_BINARIES "")
+elseif(WIN32)
+    find_program(WINDEPLOYQT_EXE windeployqt HINTS ${Qt5_PREFIX}/bin ${Qt5_PREFIX}/tools/qt5/bin ENV PATH)
+    if(NOT WINDEPLOYQT_EXE)
+        message(FATAL_ERROR "windeployqt is required to build on Windows")
+    endif()
+    message(STATUS "Using windeployqt: ${WINDEPLOYQT_EXE}")
 endif()
 
-# Debian sets the the build type to None for package builds.
+# Debian sets the build type to None for package builds.
 # Make sure we don't enable asserts there.
 set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS_NONE QT_NO_DEBUG)
 
-find_package(LibGPGError REQUIRED)
-find_package(Gcrypt 1.7.0 REQUIRED)
-find_package(Argon2 REQUIRED)
+# Find Argon2 -- Botan 2.18 and below does not support threaded Argon2
+find_library(ARGON2_LIBRARIES NAMES argon2)
+find_path(ARGON2_INCLUDE_DIR NAMES argon2.h PATH_SUFFIXES local/include)
+include_directories(SYSTEM ${ARGON2_INCLUDE_DIR})
 
+# Find zlib
 find_package(ZLIB REQUIRED)
-
-set(CMAKE_REQUIRED_INCLUDES ${ZLIB_INCLUDE_DIR})
-
 if(ZLIB_VERSION_STRING VERSION_LESS "1.2.0")
-  message(FATAL_ERROR "zlib 1.2.0 or higher is required to use the gzip format")
+    message(FATAL_ERROR "zlib 1.2.0 or higher is required to use the gzip format")
 endif()
+include_directories(SYSTEM ${ZLIB_INCLUDE_DIR})
+
+# Find Minizip
+find_package(Minizip REQUIRED)
 
-# Optional
 if(WITH_XC_YUBIKEY)
-  find_package(YubiKey REQUIRED)
+    find_package(PCSC REQUIRED)
+    include_directories(SYSTEM ${PCSC_INCLUDE_DIRS})
 
-  include_directories(SYSTEM ${YUBIKEY_INCLUDE_DIRS})
+    if(UNIX AND NOT APPLE)
+        find_library(LIBUSB_LIBRARIES NAMES usb-1.0 REQUIRED)
+        find_path(LIBUSB_INCLUDE_DIR NAMES libusb.h PATH_SUFFIXES "libusb-1.0" "libusb" REQUIRED)
+        include_directories(SYSTEM ${LIBUSB_INCLUDE_DIR})
+    endif()
 endif()
 
 if(UNIX)
-  check_cxx_source_compiles("#include <sys/prctl.h>
+    check_cxx_source_compiles("#include <sys/prctl.h>
     int main() { prctl(PR_SET_DUMPABLE, 0); return 0; }"
-    HAVE_PR_SET_DUMPABLE)
+            HAVE_PR_SET_DUMPABLE)
 
-  check_cxx_source_compiles("#include <sys/resource.h>
+    check_cxx_source_compiles("#include <malloc.h>
+    int main() { return 0; }"
+            HAVE_MALLOC_H)
+
+    check_cxx_source_compiles("#include <malloc.h>
+    int main() { malloc_usable_size(NULL); return 0; }"
+            HAVE_MALLOC_USABLE_SIZE)
+
+    check_cxx_source_compiles("#include <sys/resource.h>
     int main() {
       struct rlimit limit;
       limit.rlim_cur = 0;
@@ -351,29 +616,37 @@ if(UNIX)
       return 0;
     }" HAVE_RLIMIT_CORE)
 
-  if(APPLE)
-    check_cxx_source_compiles("#include <sys/types.h>
+    if(APPLE)
+        check_cxx_source_compiles("#include <sys/types.h>
       #include <sys/ptrace.h>
       int main() { ptrace(PT_DENY_ATTACH, 0, 0, 0); return 0; }"
-      HAVE_PT_DENY_ATTACH)
-  endif()
+                HAVE_PT_DENY_ATTACH)
+    endif()
 endif()
 
-include_directories(SYSTEM ${GCRYPT_INCLUDE_DIR} ${ZLIB_INCLUDE_DIR})
+include_directories(SYSTEM ${ZLIB_INCLUDE_DIR})
 
-include(FeatureSummary)
+find_library(ZXCVBN_LIBRARIES zxcvbn)
+if(NOT ZXCVBN_LIBRARIES)
+    add_subdirectory(src/thirdparty/zxcvbn)
+    set(ZXCVBN_LIBRARIES zxcvbn)
+endif(NOT ZXCVBN_LIBRARIES)
 
 add_subdirectory(src)
 add_subdirectory(share)
 if(WITH_TESTS)
-  add_subdirectory(tests)
+    add_subdirectory(tests)
 endif(WITH_TESTS)
 
-if(PRINT_SUMMARY)
-  # This will print ENABLED, REQUIRED and DISABLED
-  feature_summary(WHAT ALL)
-else()
-  # This will only print ENABLED and DISABLED feature
-  feature_summary(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
-  feature_summary(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
+if(WITH_XC_DOCS)
+    add_subdirectory(docs)
+endif()
+
+if(PRINT_SUMMARY)
+    # This will print ENABLED, REQUIRED and DISABLED
+    feature_summary(WHAT ALL)
+else()
+    # This will only print ENABLED and DISABLED feature
+    feature_summary(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
+    feature_summary(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
 endif()

CODE-OF-CONDUCT.md

@@ -0,0 +1,20 @@
+# Contributor Code of Conduct
+
+KeePassXC is an open project that welcomes everybody no matter their ethnicity, sex,
+sexual identity or orientation, age, socio-economic status, nationality, or religion.
+Regardless of what background you come from, feel encouraged to participate in
+the project and express your views as long you are respectful to others.
+
+We value all members of our community and so in order to ensure a harassment-free
+experience for everyone and mutual respect among members of this community, we
+impose the following simple rules:
+
+- No bullying, no insults. Any form of harassment will not be tolerated.
+- No racism, no sexism, no homophobia, no hurtful extremist views of any kind.
+- Be mindful of what you say, be diligent in how you say it.
+- Show respect and, as always, be excellent to each other.
+
+Violations of these rules or any other form of abuse can be reported confidentially
+to conduct AT keepassxc DOT org. Members who do not adhere to our code of conduct
+will be banned either permanently or until they change their ways so as to be
+compatible with a friendly, open, and inclusive community.

COPYING

@@ -1,5 +1,5 @@
 KeePassXC - http://www.keepassxc.org/
-Copyright (C) 2016-2017 KeePassXC Team <team@keepassxc.org>
+Copyright (C) 2016-2023 KeePassXC Team <team@keepassxc.org>
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -27,190 +27,230 @@ Copyright: 2010-2012, Felix Geyer <debfx@fobos.de>
            2000-2008, Tom Sato <VEF00200@nifty.ne.jp>
            2013, Laszlo Papp <lpapp@kde.org>
            2013, David Faure <faure@kde.org>
-           2016-2018, KeePassXC Team <team@keepassxc.org>
+           2016-2023, KeePassXC Team <team@keepassxc.org>
 License: GPL-2 or GPL-3
 
 Comment: The "KeePassXC Team" in every copyright notice is formed by the following people:
            - droidmonkey
            - phoerious
-           - TheZ3ro <io@thezero.org>
+           - varjolintu
+           - hifi
            - louib
-           - weslly
          Every other contributor is listed on https://github.com/keepassxreboot/keepassxc/graphs/contributors
 
-Files: cmake/GNUInstallDirs.cmake
-Copyright: 2011 Nikita Krupen'ko <krnekit@gmail.com>
-           2011 Kitware, Inc.
-License: BSD-3-clause
-
 Files: cmake/CodeCoverage.cmake
 Copyright: 2012 - 2015, Lars Bilke
 License: BSD-3-clause
 
-Files: cmake/FindYubiKey.cmake
-Copyright: 2014 Kyle Manna <kyle@kylemanna.com>
-License: GPL-2 or GPL-3
+Files: cmake/FindBotan.cmake
+Copyright: none
+License: LGPL-2.1
 
 Files: cmake/GenerateProductVersion.cmake
 Copyright: 2015 halex2005 <akharlov@gmail.com>
 License: MIT
 
-Files: share/icons/application/*/apps/keepassxc.png
-       share/icons/application/scalable/apps/keepassxc.svgz
-       share/icons/application/*/apps/keepassxc-dark.png
-       share/icons/application/scalable/apps/keepassxc-dark.svgz
-       share/icons/application/*/apps/keepassxc-locked.png
-       share/icons/application/scalable/apps/keepassxc-locked.svgz
-       share/icons/application/*/apps/keepassxc-unlocked.png
-       share/icons/application/scalable/apps/keepassxc-unlocked.svgz
-       share/icons/application/*/mimetypes/application-x-keepassxc.png
-       share/icons/application/scalable/mimetypes/application-x-keepassxc.svgz
+Files: share/icons/application/scalable/apps/keepassxc.svg
+       share/icons/application/scalable/apps/keepassxc-dark.svg
+       share/icons/application/scalable/apps/keepassxc-locked.svg
+       share/icons/application/scalable/apps/keepassxc-unlocked.svg
+       share/icons/application/scalable/mimetypes/application-x-keepassxc.svg
 Copyright: 2016, Lorenzo Stella <lorenzo.stl@gmail.com>
 License: LGPL-2
 
-Files: share/icons/application/*/actions/auto-type.png
-       share/icons/application/*/actions/database-change-key.png
-       share/icons/application/*/actions/entry-clone.png
-       share/icons/application/*/actions/entry-edit.png
-       share/icons/application/*/actions/entry-new.png
-       share/icons/application/*/actions/group-empty-trash.png
-       share/icons/application/*/actions/help-about.png
-       share/icons/application/*/actions/password-generate.png
-       share/icons/database/C00_Password.png
-       share/icons/database/C01_Package_Network.png
-       share/icons/database/C02_MessageBox_Warning.png
-       share/icons/database/C03_Server.png
-       share/icons/database/C04_Klipper.png
-       share/icons/database/C05_Edu_Languages.png
-       share/icons/database/C06_KCMDF.png
-       share/icons/database/C07_Kate.png
-       share/icons/database/C08_Socket.png
-       share/icons/database/C09_Identity.png
-       share/icons/database/C10_Kontact.png
-       share/icons/database/C11_Camera.png
-       share/icons/database/C12_IRKickFlash.png
-       share/icons/database/C13_KGPG_Key3.png
-       share/icons/database/C14_Laptop_Power.png
-       share/icons/database/C15_Scanner.png
-       share/icons/database/C16_Mozilla_Firebird.png
-       share/icons/database/C17_CDROM_Unmount.png
-       share/icons/database/C18_Display.png
-       share/icons/database/C19_Mail_Generic.png
-       share/icons/database/C20_Misc.png
-       share/icons/database/C21_KOrganizer.png
-       share/icons/database/C22_ASCII.png
-       share/icons/database/C23_Icons.png
-       share/icons/database/C24_Connect_Established.png
-       share/icons/database/C25_Folder_Mail.png
-       share/icons/database/C26_FileSave.png
-       share/icons/database/C27_NFS_Unmount.png
-       share/icons/database/C28_QuickTime.png
-       share/icons/database/C29_KGPG_Term.png
-       share/icons/database/C30_Konsole.png
-       share/icons/database/C31_FilePrint.png
-       share/icons/database/C32_FSView.png
-       share/icons/database/C33_Run.png
-       share/icons/database/C34_Configure.png
-       share/icons/database/C35_KRFB.png
-       share/icons/database/C36_Ark.png
-       share/icons/database/C37_KPercentage.png
-       share/icons/database/C38_Samba_Unmount.png
-       share/icons/database/C39_History.png
-       share/icons/database/C40_Mail_Find.png
-       share/icons/database/C41_VectorGfx.png
-       share/icons/database/C42_KCMMemory.png
-       share/icons/database/C43_EditTrash.png
-       share/icons/database/C44_KNotes.png
-       share/icons/database/C45_Cancel.png
-       share/icons/database/C46_Help.png
-       share/icons/database/C47_KPackage.png
-       share/icons/database/C48_Folder.png
-       share/icons/database/C49_Folder_Blue_Open.png
-       share/icons/database/C50_Folder_Tar.png
-       share/icons/database/C51_Decrypted.png
-       share/icons/database/C52_Encrypted.png
-       share/icons/database/C53_Apply.png
-       share/icons/database/C54_Signature.png
-       share/icons/database/C55_Thumbnail.png
-       share/icons/database/C56_KAddressBook.png
-       share/icons/database/C57_View_Text.png
-       share/icons/database/C58_KGPG.png
-       share/icons/database/C59_Package_Development.png
-       share/icons/database/C60_KFM_Home.png
-       share/icons/database/C61_Services.png
-Copyright: 2003-2004, David Vignoni <david@icon-king.com>
-License: LGPL-2.1
-Comment: from Nuvola icon theme
-
-Files: share/icons/application/*/actions/entry-delete.png
-       share/icons/application/*/actions/group-delete.png
-       share/icons/application/*/actions/group-edit.png
-       share/icons/application/*/actions/group-new.png
-Copyright: 2003-2004, David Vignoni <david@icon-king.com>
-           2012, Felix Geyer <debfx@fobos.de>
-License: LGPL-2.1
-Comment: based on Nuvola icon theme
-
-Files: share/icons/application/*/actions/application-exit.png
-       share/icons/application/*/actions/chronometer.png
-       share/icons/application/*/actions/configure.png
-       share/icons/application/*/actions/dialog-close.png
-       share/icons/application/*/actions/dialog-ok.png
-       share/icons/application/*/actions/document-close.png
-       share/icons/application/*/actions/document-edit.png
-       share/icons/application/*/actions/document-encrypt.png
-       share/icons/application/*/actions/document-new.png
-       share/icons/application/*/actions/document-open.png
-       share/icons/application/*/actions/document-properties.png
-       share/icons/application/*/actions/document-save.png
-       share/icons/application/*/actions/document-save-as.png
-       share/icons/application/*/actions/edit-clear-locationbar-ltr.png
-       share/icons/application/*/actions/edit-clear-locationbar-rtl.png
-       share/icons/application/*/actions/key-enter.png
-       share/icons/application/*/actions/password-generator.png
-       share/icons/application/*/actions/password-copy.png
-       share/icons/application/*/actions/password-show-*.png
-       share/icons/application/*/actions/system-search.png
-       share/icons/application/*/actions/username-copy.png
-       share/icons/application/*/actions/view-history.png
-       share/icons/application/*/apps/internet-web-browser.png
-       share/icons/application/*/apps/preferences-desktop-icons.png
-       share/icons/application/*/apps/utilities-terminal.png
-       share/icons/application/*/categories/preferences-other.png
-       share/icons/application/*/status/dialog-error.png
-       share/icons/application/*/status/dialog-information.png
-       share/icons/application/*/status/dialog-warning.png
-       share/icons/application/*/status/security-high.png
-       share/icons/svg/*.svgz
-Copyright: 2007, Nuno Pinheiro <nuno@oxygen-icons.org>
-           2007, David Vignoni <david@icon-king.com>
-           2007, David Miller <miller@oxygen-icons.org>
-           2007, Johann Ollivier Lapeyre <johann@oxygen-icons.org>
-           2007, Kenneth Wimer <kwwii@bootsplash.org>
-           2007, Riccardo Iaconelli <riccardo@oxygen-icons.org>
-License: LGPL-3+
-Comment: from Oxygen icon theme (http://www.oxygen-icons.org/)
-
-Files: share/icons/database/C62_Tux.png
-       share/icons/database/C63_Feather.png
-       share/icons/database/C64_Apple.png
-       share/icons/database/C67_Certificate.png
-       share/icons/database/C68_BlackBerry.png
-Copyright: Mairin Duffy
-           Sarah Owens
-           James Birkett
-           Dominik Reichl
-License: CC0
-Comment: C62_Tux.png from https://openclipart.org/detail/103855
-         C63_Feather.png from http://openclipart.org/detail/122017
-         C64_Apple.png based on http://openclipart.org/detail/24319
-         C67_Certificate.png based on https://openclipart.org/detail/16729
-         C68_BlackBerry.png from https://openclipart.org/detail/4465
-
-Files: share/icons/database/C65_W.png
-       share/icons/database/C66_Money.png
+Files: share/icons/database/C00_Password.svg
+       share/icons/database/C01_Package_Network.svg
+       share/icons/database/C02_MessageBox_Warning.svg
+       share/icons/database/C03_Server.svg
+       share/icons/database/C04_Klipper.svg
+       share/icons/database/C05_Edu_Languages.svg
+       share/icons/database/C06_KCMDF.svg
+       share/icons/database/C08_Socket.svg
+       share/icons/database/C09_Identity.svg
+       share/icons/database/C10_Kontact.svg
+       share/icons/database/C11_Camera.svg
+       share/icons/database/C12_IRKickFlash.svg
+       share/icons/database/C13_KGPG_Key3.svg
+       share/icons/database/C14_Laptop_Power.svg
+       share/icons/database/C15_Scanner.svg
+       share/icons/database/C16_Mozilla_Firebird.svg
+       share/icons/database/C19_Mail_Generic.svg
+       share/icons/database/C20_Misc.svg
+       share/icons/database/C21_KOrganizer.svg
+       share/icons/database/C22_ASCII.svg
+       share/icons/database/C23_Icons.svg
+       share/icons/database/C24_Connect_Established.svg
+       share/icons/database/C25_Folder_Mail.svg
+       share/icons/database/C28_QuickTime.svg
+       share/icons/database/C29_KGPG_Term.svg
+       share/icons/database/C30_Konsole.svg
+       share/icons/database/C31_FilePrint.svg
+       share/icons/database/C32_FSView.svg
+       share/icons/database/C33_Run.svg
+       share/icons/database/C34_Configure.svg
+       share/icons/database/C36_Ark.svg
+       share/icons/database/C39_History.svg
+       share/icons/database/C40_Mail_Find.svg
+       share/icons/database/C41_VectorGfx.svg
+       share/icons/database/C42_KCMMemory.svg
+       share/icons/database/C43_EditTrash.svg
+       share/icons/database/C47_KPackage.svg
+       share/icons/database/C48_Folder.svg
+       share/icons/database/C49_Folder_Blue_Open.svg
+       share/icons/database/C50_Folder_Tar.svg
+       share/icons/database/C55_Thumbnail.svg
+       share/icons/database/C56_KAddressBook.svg
+       share/icons/database/C57_View_Text.svg
+       share/icons/database/C58_KGPG.svg
+       share/icons/database/C59_Package_Development.svg
+       share/icons/database/C60_KFM_Home.svg
+       share/icons/database/C62_Tux.svg
+       share/icons/database/C63_Feather.svg
+       share/icons/database/C65_W.svg
+       share/icons/database/C67_Certificate.svg
+       share/icons/database/C68_BlackBerry.svg
 Copyright: none
-License: public-domain
+License: MIT
+Comment: Taken from https://github.com/icons8/flat-color-icons
+
+Files: share/icons/badges/0_ShareActive.svg
+       share/icons/badges/1_ShareInactive.svg
+       share/icons/database/C07_Kate.svg
+       share/icons/database/C17_CDROM_Unmount.svg
+       share/icons/database/C18_Display.svg
+       share/icons/database/C26_FileSave.svg
+       share/icons/database/C27_NFS_Unmount.svg
+       share/icons/database/C35_KRFB.svg
+       share/icons/database/C38_Samba_Unmount.svg
+       share/icons/database/C44_KNotes.svg
+       share/icons/database/C51_Decrypted.svg
+       share/icons/database/C52_Encrypted.svg
+       share/icons/database/C54_Signature.svg
+       share/icons/database/C66_Money.svg
+Copyright: none
+License: CC0
+Comment: Taken from https://github.com/paomedia/small-n-flat
+
+Files: share/icons/badges/2_Expired.svg
+       share/icons/database/C37_KPercentage.svg
+       share/icons/database/C45_Cancel.svg
+       share/icons/database/C46_Help.svg
+       share/icons/database/C53_Apply.svg
+       share/icons/database/C61_Services.svg
+       share/icons/application/scalable/actions/proton.svg
+Copyright: 2022 KeePassXC Team <team@keepassxc.org>
+License: MIT
+
+Files: share/icons/application/scalable/actions/application-exit.svg
+       share/icons/application/scalable/actions/arrow-collapse-down.svg
+       share/icons/application/scalable/actions/attributes-copy.svg
+       share/icons/application/scalable/actions/auto-type.svg
+       share/icons/application/scalable/actions/bitwarden.svg
+       share/icons/application/scalable/actions/bugreport.svg
+       share/icons/application/scalable/actions/chevron-double-down.svg
+       share/icons/application/scalable/actions/chevron-double-right.svg
+       share/icons/application/scalable/actions/clipboard-text.svg
+       share/icons/application/scalable/actions/configure.svg
+       share/icons/application/scalable/actions/csv.svg
+       share/icons/application/scalable/actions/database-change-key.svg
+       share/icons/application/scalable/actions/database-lock.svg
+       share/icons/application/scalable/actions/database-lock-all.svg
+       share/icons/application/scalable/actions/database-merge.svg
+       share/icons/application/scalable/actions/database-search.svg
+       share/icons/application/scalable/actions/database-settings.svg
+       share/icons/application/scalable/actions/dialog-close.svg
+       share/icons/application/scalable/actions/dialog-ok.svg
+       share/icons/application/scalable/actions/document-close.svg
+       share/icons/application/scalable/actions/document-edit.svg
+       share/icons/application/scalable/actions/document-export.svg
+       share/icons/application/scalable/actions/document-import.svg
+       share/icons/application/scalable/actions/document-new.svg
+       share/icons/application/scalable/actions/document-open.svg
+       share/icons/application/scalable/actions/document-open-recent.svg
+       share/icons/application/scalable/actions/document-properties.svg
+       share/icons/application/scalable/actions/document-save.svg
+       share/icons/application/scalable/actions/document-save-as.svg
+       share/icons/application/scalable/actions/document-save-copy.svg
+       share/icons/application/scalable/actions/donate.svg
+       share/icons/application/scalable/actions/edit-clear-locationbar-ltr.svg
+       share/icons/application/scalable/actions/edit-clear-locationbar-rtl.svg
+       share/icons/application/scalable/actions/entry-clone.svg
+       share/icons/application/scalable/actions/entry-delete.svg
+       share/icons/application/scalable/actions/entry-restore.svg
+       share/icons/application/scalable/actions/entry-edit.svg
+       share/icons/application/scalable/actions/entry-expire.svg
+       share/icons/application/scalable/actions/entry-new.svg
+       share/icons/application/scalable/actions/favicon-download.svg
+       share/icons/application/scalable/actions/fingerprint.svg
+       share/icons/application/scalable/actions/getting-started.svg
+       share/icons/application/scalable/actions/group-delete.svg
+       share/icons/application/scalable/actions/group-edit.svg
+       share/icons/application/scalable/actions/group-clone.svg
+       share/icons/application/scalable/actions/group-empty-trash.svg
+       share/icons/application/scalable/actions/group-new.svg
+       share/icons/application/scalable/actions/hammer-wrench.svg
+       share/icons/application/scalable/actions/health.svg
+       share/icons/application/scalable/actions/help-about.svg
+       share/icons/application/scalable/actions/lock-question.svg
+       share/icons/application/scalable/actions/keyboard-shortcuts.svg
+       share/icons/application/scalable/actions/message-close.svg
+       share/icons/application/scalable/actions/move-down.svg
+       share/icons/application/scalable/actions/move-up.svg
+       share/icons/application/scalable/actions/object-locked.svg
+       share/icons/application/scalable/actions/object-unlocked.svg
+       share/icons/application/scalable/actions/onepassword.svg
+       share/icons/application/scalable/actions/paperclip.svg
+       share/icons/application/scalable/actions/password-copy.svg
+       share/icons/application/scalable/actions/passkey.svg
+       share/icons/application/scalable/actions/password-generator.svg
+       share/icons/application/scalable/actions/password-show-off.svg
+       share/icons/application/scalable/actions/password-show-on.svg
+       share/icons/application/scalable/actions/qrcode.svg
+       share/icons/application/scalable/actions/refresh.svg
+       share/icons/application/scalable/actions/remote-sync.svg
+       share/icons/application/scalable/actions/reports.svg
+       share/icons/application/scalable/actions/reports-exclude.svg
+       share/icons/application/scalable/actions/sort-alphabetical-ascending.svg
+       share/icons/application/scalable/actions/sort-alphabetical-descending.svg
+       share/icons/application/scalable/actions/statistics.svg
+       share/icons/application/scalable/actions/system-help.svg
+       share/icons/application/scalable/actions/system-search.svg
+       share/icons/application/scalable/actions/system-software-update.svg
+       share/icons/application/scalable/actions/tag.svg
+       share/icons/application/scalable/actions/tag-multiple.svg
+       share/icons/application/scalable/actions/tag-search.svg
+       share/icons/application/scalable/actions/totp.svg
+       share/icons/application/scalable/actions/totp-copy.svg
+       share/icons/application/scalable/actions/totp-copy-password.svg
+       share/icons/application/scalable/actions/totp-edit.svg
+       share/icons/application/scalable/actions/totp-invalid.svg
+       share/icons/application/scalable/actions/trash.svg
+       share/icons/application/scalable/actions/url-copy.svg
+       share/icons/application/scalable/actions/user-guide.svg
+       share/icons/application/scalable/actions/username-copy.svg
+       share/icons/application/scalable/actions/view-history.svg
+       share/icons/application/scalable/actions/web.svg
+       share/icons/application/scalable/actions/yubikey-refresh.svg
+       share/icons/application/scalable/apps/internet-web-browser.svg
+       share/icons/application/scalable/apps/keepassxc.svg
+       share/icons/application/scalable/apps/keepassxc-dark.svg
+       share/icons/application/scalable/apps/keepassxc-locked.svg
+       share/icons/application/scalable/apps/keepassxc-unlocked.svg
+       share/icons/application/scalable/apps/preferences-desktop-icons.svg
+       share/icons/application/scalable/apps/preferences-system-network-sharing.svg
+       share/icons/application/scalable/apps/utilities-terminal.svg
+       share/icons/application/scalable/categories/preferences-other.svg
+       share/icons/application/scalable/mimetypes/application-x-keepassxc.svg
+       share/icons/application/scalable/status/dialog-error.svg
+       share/icons/application/scalable/status/dialog-information.svg
+       share/icons/application/scalable/status/dialog-warning.svg
+       share/icons/application/scalable/status/security-high.svg
+       share/icons/application/scalable/actions/lock-open-alert.svg
+       share/icons/application/scalable/actions/lock-open.svg
+       share/icons/application/scalable/actions/lock.svg
+Copyright: 2023 Pictogrammers <https://pictogrammers.com/docs/general/about/>
+License: Apache-2.0
+Comment: Some icons are modified to fit KeePassXC design (https://pictogrammers.com/library/mdi/)
 
 Files: src/streams/qtiocompressor.*
        src/streams/QtIOCompressor
@@ -218,24 +258,31 @@ Files: src/streams/qtiocompressor.*
 Copyright: 2009-2012, Nokia Corporation and/or its subsidiary(-ies)
 License: LGPL-2.1 or GPL-3
 
-Files: cmake/GetGitRevisionDescription.cmake*
-Copyright: 2009-2010, Iowa State University
-License: Boost-1.0
-
-Files: src/zxcvbn/zxcvbn.*
+Files: src/thirdparty/zxcvbn/zxcvbn.*
 Copyright: 2015-2017, Tony Evans
 License: MIT
 
-Files: src/http/qhttp/*
-Copyright: 2014, Amir Zamani
-License: MIT
-
 Files: src/gui/KMessageWidget.h
        src/gui/KMessageWidget.cpp
 Copyright: 2011 Aurélien Gâteau <agateau@kde.org>
            2014 Dominik Haumann <dhaumann@kde.org>
 License: LGPL-2.1
 
-Files: share/macosx/dmg-background.tiff
+Files: share/macosx/background.tiff
 Copyright: 2008-2014, Andrey Tarantsov
 License: MIT
+
+Files: share/icons/application/scalable/apps/freedesktop.svg
+Copyright: GPL-2+
+Comment: from Freedesktop.org website
+
+Files: share/icons/application/scalable/actions/hibp.svg
+       share/icons/database/C64_Apple.svg
+Copyright: GPL-2+
+Comment: from the Simple Icons repo (https://github.com/simple-icons/simple-icons/)
+
+Files: src/thirdparty/ykcore/yk*
+       src/thirdparty/ykcore/yubikey.h
+Copyright: 2006-2015, Yubico AB
+License: BSD-2-Clause
+Comment: from the yubikey-personalization repo (https://github.com/Yubico/yubikey-personalization)

Dockerfile

@@ -1,80 +0,0 @@
-# KeePassXC Linux Release Build Dockerfile
-# Copyright (C) 2017-2018 KeePassXC team <https://keepassxc.org/>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 or (at your option)
-# version 3 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-FROM ubuntu:14.04
-
-ENV REBUILD_COUNTER=8
-
-ENV QT5_VERSION=59
-ENV QT5_PPA_VERSION=${QT5_VERSION}4
-
-RUN set -x \
-    && apt-get update -y \
-    && apt-get -y install software-properties-common
-
-RUN set -x \
-    && add-apt-repository ppa:beineri/opt-qt${QT5_PPA_VERSION}-trusty \
-    && add-apt-repository ppa:phoerious/keepassxc
-
-RUN set -x \
-    && apt-get update -y \
-    && apt-get upgrade -y
-
-# build and runtime dependencies
-RUN set -x \
-    && apt-get install -y \
-        cmake3 \
-        g++ \
-        git \
-        libgcrypt20-18-dev \
-        libargon2-0-dev \
-        libsodium-dev \
-        libcurl-no-gcrypt-dev \
-        qt${QT5_VERSION}base \
-        qt${QT5_VERSION}tools \
-        qt${QT5_VERSION}x11extras \
-        qt${QT5_VERSION}translations \
-        qt${QT5_VERSION}imageformats \
-        zlib1g-dev \
-        libxi-dev \
-        libxtst-dev \
-        mesa-common-dev \
-        libyubikey-dev \
-        libykpers-1-dev
-
-ENV CMAKE_PREFIX_PATH="/opt/qt${QT5_VERSION}/lib/cmake"
-ENV CMAKE_INCLUDE_PATH="/opt/keepassxc-libs/include"
-ENV CMAKE_LIBRARY_PATH="/opt/keepassxc-libs/lib/x86_64-linux-gnu"
-ENV CPATH="${CMAKE_INCLUDE_PATH}"
-ENV LD_LIBRARY_PATH="${CMAKE_LIBRARY_PATH}:/opt/qt${QT5_VERSION}/lib"
-
-RUN set -x \
-    && echo "/opt/qt${QT5_VERSION}/lib" > /etc/ld.so.conf.d/qt${QT5_VERSION}.conf \
-    && echo "/opt/keepassxc-libs/lib/x86_64-linux-gnu" > /etc/ld.so.conf.d/keepassxc.conf
-
-# AppImage dependencies
-RUN set -x \
-    && apt-get install -y \
-        libfuse2 \
-        wget
-
-RUN set -x \
-    && apt-get autoremove --purge \
-    && rm -rf /var/lib/apt/lists/*
-
-VOLUME /keepassxc/src
-VOLUME /keepassxc/out
-WORKDIR /keepassxc

INSTALL.md

@@ -2,135 +2,154 @@ Build and Install KeePassXC
 =================
 
 This document will guide you through the steps to build and install KeePassXC from source.
-You can visit the online version of this document at the following link:
+For more information, see also the [_Building KeePassXC_](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC) page on the wiki.
 
-https://github.com/keepassxreboot/keepassx/wiki/Install-Instruction-from-Source
+The [QuickStart Guide](https://keepassxc.org/docs/KeePassXC_GettingStarted.html) gets you started using KeePassXC on your Windows, macOS, or Linux computer using pre-compiled binaries from the [downloads page](https://keepassxc.org/download).
 
-The [KeePassXC QuickStart](./docs/QUICKSTART.md) gets you started using KeePassXC on your
-Windows, Mac, or Linux computer using the pre-built binaries.
-
-Build Dependencies
-==================
-
-The following tools must exist within your PATH:
-
-* make
-* cmake (>= 2.8.12)
-* g++ (>= 4.7) or clang++ (>= 3.0)
-
-The following libraries are required:
-
-* Qt 5 (>= 5.2): qtbase and qttools5
-* libgcrypt (>= 1.6)
-* zlib
-* libmicrohttpd
-* libxi, libxtst, qtx11extras (optional for auto-type on X11)
-* libsodium (>= 1.0.12, optional for KeePassXC-Browser support)
-* libargon2
-
-
-Prepare the Building Environment
+Toolchain and Build Dependencies
 ================================
 
-* [Building Environment on Linux](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Linux)
-* [Building Environment on Windows](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Windows)
-* [Building Environment on MacOS](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-OS-X)
+The following build tools must exist within your PATH:
+
+* cmake (>= 3.10.0)
+* make (>= 4.2) or ninja (>= 1.10)
+* g++ (>= 4.9) or clang++ (>= 6.0)
+* asciidoctor (>= 2.0)
+
+* Besides a working C++ toolchain, KeePassXC also has a number of direct build and runtime dependencies. For detailed information about how to install them, please refer to the GitHub wiki:
+
+* [Set up Build Environment on Linux](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Linux)
+* [Set up Build Environment on Windows](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Windows)
+* [Set up Build Environment on macOS](https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-macOS)
 
 Build Steps
 ===========
+We recommend using the release tool to perform builds, please read up-to-date instructions [on our wiki](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC#building-using-the-release-tool).
 
-To compile from source, open a **Terminal (on Linux/MacOS)** or a **MSYS2-MinGW shell (on Windows)**<br/>
-**Note:** on Windows make sure you are using a **MINGW shell** by checking the label before the current path
+To compile from source, open a **Terminal (Linux/MacOS)**, the **MSVC Tools Command Prompt (Windows)**, or **MSYS2-MinGW shell (Windows)**. For code development on Windows, you can use Visual Studio 2022, Visual Studio Code, or CLion.
 
-First, download the KeePassXC [source tarball](https://keepassxc.org/download#source)
-or check out the latest version from our [Git repository](https://github.com/keepassxreboot/keepassxc).
+1. Download the KeePassXC [source tarball](https://keepassxc.org/download#source) or check out the latest version from our [Git repository](https://github.com/keepassxreboot/keepassxc).
 
-To clone the project from Git, `cd` to a suitable location and run
+   To clone the project from Git, `cd` to a suitable location and run
 
-```bash
-git clone https://github.com/keepassxreboot/keepassxc.git
-```
+   ```
+   git clone https://github.com/keepassxreboot/keepassxc.git
+   ```
 
-This will clone the entire contents of the repository and check out the current `develop` branch.
+   This will clone the entire contents of the repository and check out the current `develop` branch.
 
-To update the project from within the project's folder, you can run the following command:
+   To update the project from within the project's folder, you can run the following command:
 
-```bash
-git pull
-```
+   ```
+   git pull
+   ```
 
-Navigate to the directory where you have downloaded KeePassXC and type these commands:
+   For a stable build, it is recommended to check out the `latest` tag.
+
+   ```
+   git checkout latest
+   ```
+
+2. Navigate to the directory where you have downloaded KeePassXC and run:
+
+   ```
+   mkdir build
+   cd build
+   cmake -DWITH_XC_ALL=ON ..
+   make
+   ```
+      
+If you have `vcpkg` installed, add `-DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake` to the `cmake` command to automatically download and install all required build and runtime dependencies locally to your build directory before compiling KeePassXC. Using `vcpkg` is the preferred way to install dependencies on macOS and required on Windows if using the MSVC toolchain.
+
+For more detailed build instructions for each platform, please refer to the [GitHub wiki](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC).
+
+Note: These steps place the compiled KeePassXC binary inside the `./build/src/` directory (`src/KeePassXC.app/Contents/MacOS` on macOS).
+
+## MacOS Build Notes
+
+If you installed Qt@5 via Homebrew and CMake fails to find your Qt installation, you can specify it manually by adding the following parameter:
+
+`-DCMAKE_PREFIX_PATH=$(brew --prefix qt@5)/lib/cmake`
+
+When building with ASAN support on macOS, you need to use `export ASAN_OPTIONS=detect_leaks=0` before running the tests (LSAN is no supported on macOS).
+
+## Windows Build Notes
+
+If you are using MSYS2, you have to add ```-G "MSYS Makefiles"``` at the beginning of the cmake command.
+
+CMake Configuration Options
+==========================
+
+## Recommended CMake Build Parameters
 
 ```
-cd directory-where-sources-live
-mkdir build
-cd build
-cmake -DWITH_TESTS=OFF ...and other options - see below...
-make
+-DCMAKE_VERBOSE_MAKEFILE=ON
+-DCMAKE_BUILD_TYPE=<RelWithDebInfo/Debug/Release>
+-DWITH_GUI_TESTS=ON
 ```
-These steps place the compiled KeePassXC binary inside the `./build/src/` directory.
-(Note the cmake notes/options below.)
 
-**Cmake Notes:**
+## Additional CMake Parameters
 
-* Common cmake parameters
+KeePassXC comes with a variety of build options that can turn on/off features. Most notably, we allow you to build the application with all TCP/IP networking code disabled. Please note that we still require and link against Qt5's network library in order to use local named pipes on all operating systems. Each of these build options are supplied at the time of calling cmake:
 
-	```
-	-DCMAKE_INSTALL_PREFIX=/usr/local
-	-DCMAKE_VERBOSE_MAKEFILE=ON
-	-DCMAKE_BUILD_TYPE=<RelWithDebInfo/Debug/Release>
-	-DWITH_GUI_TESTS=ON
-	```
+```
+-DWITH_XC_AUTOTYPE=[ON|OFF] Enable/Disable Auto-Type (default: ON)
+-DWITH_XC_YUBIKEY=[ON|OFF] Enable/Disable YubiKey HMAC-SHA1 authentication support (default: OFF)
+-DWITH_XC_BROWSER=[ON|OFF] Enable/Disable KeePassXC-Browser extension support (default: OFF)
+-DWITH_XC_BROWSER_PASSKEYS=[ON|OFF] Enable/Disable Passkeys support for browser integration (default: OFF)
+-DWITH_XC_NETWORKING=[ON|OFF] Enable/Disable Networking support (e.g., favicon downloading) (default: OFF)
+-DWITH_XC_SSHAGENT=[ON|OFF] Enable/Disable SSHAgent support (default: OFF)
+-DWITH_XC_FDOSECRETS=[ON|OFF] (Linux Only) Enable/Disable Freedesktop.org Secrets Service support (default:OFF)
+-DWITH_XC_KEESHARE=[ON|OFF] Enable/Disable KeeShare group synchronization extension (default: OFF)
+-DWITH_XC_ALL=[ON|OFF] Enable/Disable compiling all plugins above (default: OFF)
 
-* cmake accepts the following options:
+-DWITH_XC_UPDATECHECK=[ON|OFF] Enable/Disable automatic updating checking (requires WITH_XC_NETWORKING) (default: ON)
 
-	```
-	  -DWITH_XC_AUTOTYPE=[ON|OFF] Enable/Disable Auto-Type (default: ON)
-	  -DWITH_XC_HTTP=[ON|OFF] Enable/Disable KeePassHTTP and custom icon downloads (default: OFF)
-	  -DWITH_XC_YUBIKEY=[ON|OFF] Enable/Disable YubiKey HMAC-SHA1 authentication support (default: OFF)
-	  -DWITH_XC_BROWSER=[ON|OFF] Enable/Disable KeePassXC-Browser extension support (default: OFF)
+-DWITH_TESTS=[ON|OFF] Enable/Disable building of unit tests (default: ON)
+-DWITH_GUI_TESTS=[ON|OFF] Enable/Disable building of GUI tests (default: OFF)
+-DWITH_DEV_BUILD=[ON|OFF] Enable/Disable deprecated method warnings (default: OFF)
+-DWITH_ASAN=[ON|OFF] Enable/Disable address sanitizer checks (Linux / macOS only) (default: OFF)
+-DWITH_COVERAGE=[ON|OFF] Enable/Disable coverage tests (GCC only) (default: OFF)
+-DWITH_APP_BUNDLE=[ON|OFF] Enable Application Bundle for macOS (default: ON)
 
-	  -DWITH_TESTS=[ON|OFF] Enable/Disable building of unit tests (default: ON)
-	  -DWITH_GUI_TESTS=[ON|OFF] Enable/Disable building of GUI tests (default: OFF)
-	  -DWITH_DEV_BUILD=[ON|OFF] Enable/Disable deprecated method warnings (default: OFF)
-	  -DWITH_ASAN=[ON|OFF] Enable/Disable address sanitizer checks (Linux / macOS only) (default: OFF)
-	  -DWITH_COVERAGE=[ON|OFF] Enable/Disable coverage tests (GCC only) (default: OFF)
-	```
-
-* If you are on MacOS you must add this parameter to **Cmake**, with the Qt version you have installed<br/> `-DCMAKE_PREFIX_PATH=/usr/local/Cellar/qt5/5.6.2/lib/cmake/`
-
-:exclamation: When building with ASan support on macOS, you need to use `export ASAN_OPTIONS=detect_leaks=0` before running the tests (no LSan support in macOS).
+-DKEEPASSXC_BUILD_TYPE=[Snapshot|PreRelease|Release] Set the build type to show/hide stability warnings (default: "Snapshot")
+-DKEEPASSXC_DIST_TYPE=[Snap|AppImage|Other] Specify the distribution method (default: "Other")
+-DOVERRIDE_VERSION=[X.X.X] Specify a version number when building. Used with snapshot builds (default: "")
+-DGIT_HEAD_OVERRIDE=[XXXXXXX] Specify the 7 digit git commit ref for this build. Used with distribution builds (default: "")
+```
 
 Installation
 ============
 
 After you have successfully built KeePassXC, install the binary by executing the following:
 
-```bash
+```
 sudo make install
 ```
 
-You can specify the destination dir with
-```
-DESTDIR=X
-```
-
-
 Packaging
 =========
 
-You can create a package to redistribute KeePassXC (zip, deb, rpm, dmg, etc..)
-```
-make package
-```
+You can create a package to redistribute KeePassXC (zip, deb, rpm, dmg, etc..). Refer to [keepassxc-packaging](https://github.com/keepassxreboot/keepassxc-packaging) for packaging scripts.
 
+To package using CMake, run the following command using whichever [generators](https://cmake.org/cmake/help/latest/manual/cpack-generators.7.html) you would like to package with.
+
+```
+cpack -G "ZIP;WIX"
+```
 
 Testing
 =======
 
-You can perform test on the executable
+You can perform tests on the built executables with:
 ```
-make test
+make test ARGS+="--output-on-failure"
+```
+
+On Linux, if you are not currently running on an X Server or Wayland, run the tests as follows:
+```
+make test ARGS+="-E test\(cli\|gui\) --output-on-failure"
+xvfb-run -e errors -a --server-args="-screen 0 1024x768x24" make test ARGS+="-R test\(cli\|gui\) --output-on-failure"
 ```
 
 Common parameters:

LICENSE.BOOST-1.0

@@ -1,23 +0,0 @@
-Boost Software License - Version 1.0 - August 17th, 2003
-
-Permission is hereby granted, free of charge, to any person or organization
-obtaining a copy of the software and accompanying documentation covered by
-this license (the "Software") to use, reproduce, display, distribute,
-execute, and transmit the Software, and to prepare derivative works of the
-Software, and to permit third-parties to whom the Software is furnished to
-do so, all subject to the following:
-
-The copyright notices in the Software and this entire statement, including
-the above license grant, this restriction and the following disclaimer,
-must be included in all copies of the Software, in whole or in part, and
-all derivative works of the Software, unless such copies or derivative
-works are solely in the form of machine-executable object code generated by
-a source language processor.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
-SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
-FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
-ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.

LICENSE.GPL-2

@@ -1,12 +1,12 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
 
  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
-			    Preamble
+                            Preamble
 
   The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -56,7 +56,7 @@ patent must be licensed for everyone's free use or not licensed at all.
   The precise terms and conditions for copying, distribution and
 modification follow.
 
-		    GNU GENERAL PUBLIC LICENSE
+                    GNU GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
   0. This License applies to any program or other work which contains
@@ -255,7 +255,7 @@ make exceptions for this.  Our decision will be guided by the two goals
 of preserving the free status of all derivatives of our free software and
 of promoting the sharing and reuse of software generally.
 
-			    NO WARRANTY
+                            NO WARRANTY
 
   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
 FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
@@ -277,9 +277,9 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
 PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGES.
 
-		     END OF TERMS AND CONDITIONS
+                     END OF TERMS AND CONDITIONS
 
-	    How to Apply These Terms to Your New Programs
+            How to Apply These Terms to Your New Programs
 
   If you develop a new program, and you want it to be of the greatest
 possible use to the public, the best way to achieve this is to make it

LICENSE.GPL-3

@@ -1,12 +1,11 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
 
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
-			    Preamble
+                            Preamble
 
   The GNU General Public License is a free, copyleft license for
 software and other kinds of works.
@@ -69,7 +68,7 @@ patents cannot be used to render the program non-free.
   The precise terms and conditions for copying, distribution and
 modification follow.
 
-		       TERMS AND CONDITIONS
+                       TERMS AND CONDITIONS
 
   0. Definitions.
 
@@ -77,7 +76,7 @@ modification follow.
 
   "Copyright" also means copyright-like laws that apply to other kinds of
 works, such as semiconductor masks.
- 
+
   "The Program" refers to any copyrightable work licensed under this
 License.  Each licensee is addressed as "you".  "Licensees" and
 "recipients" may be individuals or organizations.
@@ -510,7 +509,7 @@ actual knowledge that, but for the patent license, your conveying the
 covered work in a country, or your recipient's use of the covered work
 in a country, would infringe one or more identifiable patents in that
 country that you have reason to believe are valid.
-  
+
   If, pursuant to or in connection with a single transaction or
 arrangement, you convey, or propagate by procuring conveyance of, a
 covered work, and grant a patent license to some of the parties
@@ -619,9 +618,9 @@ an absolute waiver of all civil liability in connection with the
 Program, unless a warranty or assumption of liability accompanies a
 copy of the Program in return for a fee.
 
-		     END OF TERMS AND CONDITIONS
+                     END OF TERMS AND CONDITIONS
 
-	    How to Apply These Terms to Your New Programs
+            How to Apply These Terms to Your New Programs
 
   If you develop a new program, and you want it to be of the greatest
 possible use to the public, the best way to achieve this is to make it
@@ -646,7 +645,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
@@ -665,12 +664,11 @@ might be different; for a GUI interface, you would use an "about box".
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.
 
   The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
-
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

LICENSE.LGPL-2.1

@@ -55,7 +55,7 @@ modified by someone else and passed on, the recipients should know
 that what they have is not the original version, so that the original
 author's reputation will not be affected by problems that might be
 introduced by others.
-
+
   Finally, software patents pose a constant threat to the existence of
 any free program.  We wish to make sure that a company cannot
 effectively restrict the users of a free program by obtaining a
@@ -111,7 +111,7 @@ modification follow.  Pay close attention to the difference between a
 "work based on the library" and a "work that uses the library".  The
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
-
+
                   GNU LESSER GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
@@ -158,7 +158,7 @@ Library.
   You may charge a fee for the physical act of transferring a copy,
 and you may at your option offer warranty protection in exchange for a
 fee.
-
+
   2. You may modify your copy or copies of the Library or any portion
 of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
@@ -216,7 +216,7 @@ instead of to this License.  (If a newer version than version 2 of the
 ordinary GNU General Public License has appeared, then you can specify
 that version instead if you wish.)  Do not make any other change in
 these notices.
-
+
   Once this change is made in a given copy, it is irreversible for
 that copy, so the ordinary GNU General Public License applies to all
 subsequent copies and derivative works made from that copy.
@@ -267,7 +267,7 @@ Library will still fall under Section 6.)
 distribute the object code for the work under the terms of Section 6.
 Any executables containing that work also fall under Section 6,
 whether or not they are linked directly with the Library itself.
-
+
   6. As an exception to the Sections above, you may also combine or
 link a "work that uses the Library" with the Library to produce a
 work containing portions of the Library, and distribute that work
@@ -329,7 +329,7 @@ restrictions of other proprietary libraries that do not normally
 accompany the operating system.  Such a contradiction means you cannot
 use both them and the Library together in an executable that you
 distribute.
-
+
   7. You may place library facilities that are a work based on the
 Library side-by-side in a single library together with other library
 facilities not covered by this License, and distribute such a combined
@@ -370,7 +370,7 @@ subject to these terms and conditions.  You may not impose any further
 restrictions on the recipients' exercise of the rights granted herein.
 You are not responsible for enforcing compliance by third parties with
 this License.
-
+
   11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
@@ -422,7 +422,7 @@ conditions either of that version or of any later version published by
 the Free Software Foundation.  If the Library does not specify a
 license version number, you may choose any version ever published by
 the Free Software Foundation.
-
+
   14. If you wish to incorporate parts of the Library into other free
 programs whose distribution conditions are incompatible with these,
 write to the author to ask for permission.  For software which is
@@ -456,7 +456,7 @@ SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.
 
                      END OF TERMS AND CONDITIONS
-
+
            How to Apply These Terms to Your New Libraries
 
   If you develop a new library, and you want it to be of the greatest

LICENSE.LGPL-3

@@ -1,7 +1,7 @@
                    GNU LESSER GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 

LICENSE.OFL

@@ -0,0 +1,96 @@
+Copyright (c) 2014, Austin Andrews (http://materialdesignicons.com/),
+with Reserved Font Name Material Design Icons.
+Copyright (c) 2014, Google (http://www.google.com/design/)
+uses the license at https://github.com/google/material-design-icons/blob/master/LICENSE
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

README.md

@@ -1,68 +1,65 @@
-# <img src="https://keepassxc.org/logo.png" width="40" height="40"/> KeePassXC
-[![TeamCity Build Status](https://ci.keepassxc.org/app/rest/builds/buildType:\(id:KeepassXC_TeamCityCi\)/statusIcon?guest=1)](https://ci.keepassxc.org/viewType.html?buildTypeId=KeepassXC_TeamCityCi&guest=1)  [![Coverage Status](https://coveralls.io/repos/github/keepassxreboot/keepassxc/badge.svg)](https://coveralls.io/github/keepassxreboot/keepassxc)
+# <img src="https://keepassxc.org/assets/img/keepassxc.svg" width="40" height="40"/> KeePassXC
+[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/6326/badge)](https://bestpractices.coreinfrastructure.org/projects/6326)
+[![TeamCity Build Status](https://ci.keepassxc.org/app/rest/builds/buildType:\(project:KeepassXC\)/statusIcon)](https://ci.keepassxc.org/?guest=1)
+[![codecov](https://codecov.io/gh/keepassxreboot/keepassxc/branch/develop/graph/badge.svg)](https://codecov.io/gh/keepassxreboot/keepassxc)
+[![GitHub release](https://img.shields.io/github/release/keepassxreboot/keepassxc)](https://github.com/keepassxreboot/keepassxc/releases/)
 
-## About KeePassXC
-[KeePassXC](https://keepassxc.org) is a cross-platform community fork of
-[KeePassX](https://www.keepassx.org/).
-Our goal is to extend and improve it with new features and bugfixes
-to provide a feature-rich, fully cross-platform and modern
-open-source password manager.
+[![Matrix community channel](https://img.shields.io/matrix/keepassxc:matrix.org?label=Community%20channel)](https://app.element.io/#/room/#keepassxc:mozilla.org)
+[![Matrix development channel](https://img.shields.io/matrix/keepassxc-dev:matrix.org?label=Development%20channel)](https://app.element.io/#/room/#keepassxc-dev:mozilla.org)
 
-## Installation
-The [KeePassXC QuickStart](./docs/QUICKSTART.md) gets you started using
-KeePassXC on your Windows, Mac, or Linux computer using pre-compiled binaries
-from the [downloads page](https://keepassxc.org/download).
+[KeePassXC](https://keepassxc.org) is a modern, secure, and open-source password manager that stores and manages your most sensitive information. You can run KeePassXC on Windows, macOS, and Linux systems. KeePassXC is for people with extremely high demands of secure personal data management. It saves many different types of information, such as usernames, passwords, URLs, attachments, and notes in an offline, encrypted file that can be stored in any location, including private and public cloud solutions. For easy identification and management, user-defined titles and icons can be specified for entries. In addition, entries are sorted into customizable groups. An integrated search function allows you to use advanced patterns to easily find any entry in your database. A customizable, fast, and easy-to-use password generator utility allows you to create passwords with any combination of characters or easy to remember passphrases.
 
-Additionally, individual Linux distributions may ship their own versions,
-so please check out your distribution's package list to see if KeePassXC is available.
+## Quick Start
+The [QuickStart Guide](https://keepassxc.org/docs/KeePassXC_GettingStarted.html) gets you started using KeePassXC on your Windows, macOS, or Linux computer using pre-compiled binaries from the [downloads page](https://keepassxc.org/download). Additionally, individual Linux distributions may ship their own versions, so please check your distribution's package list to see if KeePassXC is available. Detailed documentation is available in the [User Guide](https://keepassxc.org/docs/KeePassXC_UserGuide.html).
 
-## Additional features compared to KeePassX
-- Auto-Type on all three major platforms (Linux, Windows, macOS)
-- Twofish encryption
-- YubiKey challenge-response support
-- TOTP generation
-- CSV import
-- Command line interface
-- DEP and ASLR hardening
-- Stand-alone password and passphrase generator
-- Password strength meter
-- Using website favicons as entry icons
-- Merging of databases
-- Automatic reload when the database changed on disk
-- Browser integration with KeePassHTTP-Connector for
-[Mozilla Firefox](https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-connector/) and
-[Google Chrome or Chromium](https://chrome.google.com/webstore/detail/keepasshttp-connector/dafgdjggglmmknipkhngniifhplpcldb), and
-[passafari](https://github.com/mmichaa/passafari.safariextension/) in Safari. [[See note about KeePassHTTP]](#Note_about_KeePassHTTP)
-- Browser integration with KeePassXC-Browser using [native messaging](https://developer.chrome.com/extensions/nativeMessaging) for [Mozilla Firefox](https://addons.mozilla.org/en-US/firefox/addon/keepassxc-browser/) and [Google Chrome or Chromium](https://chrome.google.com/webstore/detail/keepassxc-browser/iopaggbpplllidnfmcghoonnokmjoicf)
-- Many bug fixes
+## Features List
+KeePassXC has numerous features for novice and power users alike. Our goal is to create an application that can be used by anyone while still offering advanced features to those that need them.
 
-For a full list of features and changes, read the [CHANGELOG](CHANGELOG) document.
+### Basic
+* Create, open, and save databases in the KDBX format (KeePass-compatible with KDBX4 and KDBX3)
+* Store sensitive information in entries that are organized by groups
+* Search for entries
+* Password generator
+* Auto-Type passwords into applications
+* Browser integration with Google Chrome, Mozilla Firefox, Microsoft Edge, Chromium, Vivaldi, Brave, and Tor-Browser
+* Support for passkeys using the browser integration
+* Entry icon download
+* Import databases from CSV, 1Password, Bitwarden, Proton Pass, and KeePass1 formats
+
+### Advanced
+* Database reports (password health, HIBP, and statistics)
+* Database export to CSV, XML, and HTML formats
+* TOTP storage and generation
+* Field references between entries
+* File attachments and custom attributes
+* Entry history and data restoration
+* YubiKey/OnlyKey challenge-response support
+* Command line interface (keepassxc-cli)
+* Auto-Open databases
+* KeeShare shared databases (import, export, and synchronize)
+* SSH Agent integration
+* FreeDesktop.org Secret Service (replace Gnome keyring, etc.)
+* Additional encryption choices: Twofish and ChaCha20
+
+For a full list of changes, read the [CHANGELOG](CHANGELOG.md) document. \
+For a full list of keyboard shortcuts, see [KeyboardShortcuts.adoc](./docs/topics/KeyboardShortcuts.adoc)
 
 ## Building KeePassXC
 
-Detailed instructions are available in the [Build and Install](./INSTALL.md)
-page or on the [Wiki page](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC).
+Detailed instructions are available in the [Build and Install](./INSTALL.md) page and in the [Wiki](https://github.com/keepassxreboot/keepassxc/wiki/Building-KeePassXC).
 
 ## Contributing
 
-We are always looking for suggestions how to improve our application.
-If you find any bugs or have an idea for a new feature, please let us know by
-opening a report in our [issue tracker](https://github.com/keepassxreboot/keepassxc/issues)
-on GitHub or join us on IRC on freenode channels #keepassxc or #keepassxc-dev.
+We are always looking for suggestions on how to improve KeePassXC. If you find any bugs or have an idea for a new feature, please let us know by opening a report in the [issue tracker](https://github.com/keepassxreboot/keepassxc/issues) on GitHub, or join us on [Matrix community channel](https://matrix.to/#/!zUxwGnFkUyycpxeHeM:matrix.org?via=matrix.org) or [Matrix development channel](https://matrix.to/#/!RhJPJPGwQIFVQeXqZa:matrix.org?via=matrix.org), or on IRC in [Libera.Chat](https://web.libera.chat/) channels #keepassxc and #keepassxc-dev.
 
-You can of course also directly contribute your own code. We are happy to accept your pull requests.
+You may directly contribute your own code by submitting a pull request. Please read the [CONTRIBUTING](.github/CONTRIBUTING.md) document for further information.
 
-Please read the [CONTRIBUTING document](.github/CONTRIBUTING.md) for further information.
+Contributors are required to adhere to the project's [Code of Conduct](CODE-OF-CONDUCT.md).
 
-### Note about KeePassHTTP
-The KeePassHTTP protocol is not a highly secure protocol.
-It has a certain flaw which could allow an attacker to decrypt your passwords
-should they manage to impersonate the web browser extension from a remote address.
-<!--intercept communication between a KeePassHTTP server
-and PassIFox/chromeIPass over a network connection -->
-(See [here](https://github.com/pfn/keepasshttp/issues/258) and [here](https://github.com/keepassxreboot/keepassxc/issues/147)).
+## Generative AI
 
-To minimize the risk, KeePassXC strictly limits communication between itself
-and the browser plugin to your local computer (localhost).
-This makes your passwords quite safe,
-but as with all open source software, use it at your own risk!
+Generative AI is fast becoming a first-party feature in most development environments, including GitHub itself. If the majority of a code submission is made using Generative AI (e.g., agent-based or vibe coding) then **we will document that in the pull request.** All code submissions go through a rigorous review process regardless of the development workflow or submitter.
+
+## License
+
+KeePassXC code is licensed under GPL-2 or GPL-3. Additional licensing for third-party files is detailed in [COPYING](./COPYING).

SECURITY.md

@@ -0,0 +1,46 @@
+### Reporting Security Issues
+
+The KeePassXC team takes security vulnerabilities very seriously and appreciates your responsible disclosure efforts. We will make every effort to acknowledge your contributions and handle them promptly.
+
+To report a security issue, please use one of the following methods:
+
+- **GitHub Security Advisory:** Use the ["Report a Vulnerability"](https://github.com/keepassxreboot/keepassxc/security/advisories/new) tab on our GitHub repository.
+- **Private Matrix Message:** Contact any of the following KeePassXC team members privately (also encrypted):
+  - [@droidmonkey_kpxc](https://matrix.to/#/@droidmonkey_kpxc:matrix.org)
+  - [@varjolintu](https://matrix.to/#/@varjolintu:matrix.org)
+  - [@phoerious](https://matrix.to/#/@phoerious:matrix.org)
+- **Send an Email:** Send your report to team@keepassxc.org. We recommend encrypting the email if possible.
+
+Please **DO NOT** use public channels (e.g., GitHub issues, Matrix chat channels) for initial reporting of bona fide security vulnerabilities.
+
+Once you report a security issue, our team will respond with the next steps. After our initial reply, we will keep you informed of the progress towards a fix and full announcement. We may ask for additional information or guidance during this process. If we disagree that your report constitutes a genuine security vulnerability, we will inform you and close the report. Your report may be turned into an issue for further tracking.
+
+If you discover vulnerabilities in third-party modules used by KeePassXC, please report them to the maintainers of the respective modules. If the vulnerability impacts KeePassXC directly, we encourage you to notify us using the above methods. We will validate if the vulnerability is exploitable from KeePassXC code; please note that not all vulnerabilities are actually exploitable and do not constitute an immediate concern for the KeePassXC application.
+
+### Example Security Vulnerabilities
+
+When reporting, please ensure the issue falls under what can be considered a genuine security vulnerability for KeePassXC. Some examples include:
+
+- Unauthorized access to sensitive user data (e.g., passwords).
+- Remote code execution or escalation of privileges.
+- Bypassing authentication or encryption mechanisms.
+- Broken or improperly implemented encryption methods. 
+
+### Counter Examples
+
+The following issues are **not** considered security vulnerabilities:
+
+- Bugs caused by locally modifying the application (e.g., injecting DLLs, altering code).
+- Crashes or misbehavior resulting from normal use (report this as a normal issue).
+- Vulnerabilities found in third-party modules (should be reported to the module’s maintainers).
+  
+### CVE Reporting Policy
+
+Please **DO NOT** submit a report to a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA) before confirming the security vulnerability with the KeePassXC team. If we do not respond to your report within 30 days, this restriction no longer applies.
+
+
+### Other Communication
+
+For other inquiries (e.g., developer questions, user questions), please use the public channels on Matrix:
+- **User's Channel:** [#keepassxc:mozilla.org](https://matrix.to/#/#keepassxc:mozilla.org)
+- **Developer's Channel:** [#keepassxc-dev:mozilla.org](https://matrix.to/#/#keepassxc-dev:mozilla.org)

ci/trusty/Dockerfile

@@ -1,73 +0,0 @@
-# KeePassXC Linux Release Build Dockerfile
-# Copyright (C) 2017 KeePassXC team <https://keepassxc.org/>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 or (at your option)
-# version 3 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-# TIP: check this Dockerfile using this online tool: https://www.fromlatest.io
-
-FROM ubuntu:14.04
-
-ENV REBUILD_COUNTER=4
-
-ENV QT5_VERSION=53
-ENV QT5_PPA_VERSION=${QT5_VERSION}2
-
-RUN set -x \
-     && apt-get update -y \
-     && apt-get -y install software-properties-common
-
-RUN set -x \
-    && add-apt-repository ppa:beineri/opt-qt${QT5_PPA_VERSION}-trusty \
-    && add-apt-repository ppa:phoerious/keepassxc
-
-RUN set -x \
-    && apt-get -y update \
-    && apt-get -y --no-install-recommends install \
-      build-essential \
-      clang-3.6 \
-      libclang-common-3.6-dev \
-      clang-format-3.6 \
-      cmake3 \
-      make \
-      libgcrypt20-18-dev \
-      libargon2-0-dev \
-      libsodium-dev \
-      libcurl-no-gcrypt-dev \
-      qt${QT5_VERSION}base \
-      qt${QT5_VERSION}tools \
-      qt${QT5_VERSION}x11extras \
-      qt${QT5_VERSION}translations \
-      zlib1g-dev \
-      libyubikey-dev \
-      libykpers-1-dev \
-      libxi-dev \
-      libxtst-dev \
-      xvfb
-
-ENV CMAKE_PREFIX_PATH="/opt/qt${QT5_VERSION}/lib/cmake"
-ENV CMAKE_INCLUDE_PATH="/opt/keepassxc-libs/include"
-ENV CMAKE_LIBRARY_PATH="/opt/keepassxc-libs/lib/x86_64-linux-gnu"
-ENV CPATH="${CMAKE_INCLUDE_PATH}"
-ENV LD_LIBRARY_PATH="${CMAKE_LIBRARY_PATH}:/opt/qt${QT5_VERSION}/lib"
-
-RUN set -x \
-    && echo "/opt/qt${QT5_VERSION}/lib" > /etc/ld.so.conf.d/qt${QT5_VERSION}.conf \
-    && echo "/opt/keepassxc-libs/lib/x86_64-linux-gnu" > /etc/ld.so.conf.d/keepassxc.conf
-
-RUN set -x \
-    && apt-get autoremove --purge \
-    && rm -rf /var/lib/apt/lists/*
-
-VOLUME ["/keepassxc"]
-WORKDIR /keepassxc

cmake/CLangFormat.cmake

@@ -0,0 +1,59 @@
+#  Copyright (C) 2017 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set(EXCLUDED_DIRS
+        # third-party directories
+        src/thirdparty
+        # objective-c directories
+        src/quickunlock/touchid
+        src/autotype/mac
+        src/gui/osutils/macutils)
+
+set(EXCLUDED_FILES
+        # third-party files
+        src/streams/qtiocompressor.\\*
+        src/gui/KMessageWidget.\\*
+        src/gui/MainWindowAdaptor.\\*
+        src/gui/tag/TagsEdit.\\*
+        tests/modeltest.\\*
+        # objective-c files
+        src/core/ScreenLockListenerMac.\\*)
+
+set(FIND_EXCLUDE_DIR_EXPR "")
+foreach(EXCLUDE ${EXCLUDED_DIRS})
+    list(APPEND FIND_EXCLUDE_DIR_EXPR -o -path "${EXCLUDE}" -prune)
+endforeach()
+
+set(FIND_EXCLUDE_FILE_EXPR "")
+foreach(EXCLUDE ${EXCLUDED_FILES})
+    if(FIND_EXCLUDE_FILE_EXPR)
+        list(APPEND FIND_EXCLUDE_FILE_EXPR -o)
+    endif()
+    list(APPEND FIND_EXCLUDE_FILE_EXPR -path "${EXCLUDE}")
+endforeach()
+if(FIND_EXCLUDE_FILE_EXPR)
+    set(FIND_EXCLUDE_FILE_EXPR -a -not "\\(" ${FIND_EXCLUDE_FILE_EXPR} "\\)")
+endif()
+
+add_custom_target(format)
+
+add_custom_command(
+        TARGET format
+        PRE_BUILD
+        COMMAND find src tests "\\(" -name "\\*.h" -o -name "\\*.cpp" ${FIND_EXCLUDE_DIR_EXPR} "\\)"
+            ${FIND_EXCLUDE_FILE_EXPR} -type f -print0 | xargs -0 -P0 -n10 clang-format -style=file -i
+
+        COMMENT "Formatting source files..."
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR})

cmake/CodeCoverage.cmake

@@ -1,4 +1,5 @@
-# Copyright (c) 2012 - 2015, Lars Bilke
+# Copyright (c) 2012 - 2017, Lars Bilke
+# Copyright (c) 2021 KeePassXC Team
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without modification,
@@ -25,173 +26,218 @@
 # ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-#
-#
-# 2012-01-31, Lars Bilke
-# - Enable Code Coverage
-#
-# 2013-09-17, Joakim Söderberg
-# - Added support for Clang.
-# - Some additional usage instructions.
-#
-# USAGE:
 
-# 0. (Mac only) If you use Xcode 5.1 make sure to patch geninfo as described here:
-#      http://stackoverflow.com/a/22404544/80480
-#
-# 1. Copy this file into your cmake modules path.
-#
-# 2. Add the following line to your CMakeLists.txt:
-#      INCLUDE(CodeCoverage)
-#
-# 3. Set compiler flags to turn off optimization and enable coverage:
-#    SET(CMAKE_CXX_FLAGS "-g -O0 -fprofile-arcs -ftest-coverage")
-#	 SET(CMAKE_C_FLAGS "-g -O0 -fprofile-arcs -ftest-coverage")
-#
-# 3. Use the function SETUP_TARGET_FOR_COVERAGE to create a custom make target
-#    which runs your test executable and produces a lcov code coverage report:
-#    Example:
-#	 SETUP_TARGET_FOR_COVERAGE(
-#				my_coverage_target  # Name for custom target.
-#				test_driver         # Name of the test driver executable that runs the tests.
-#									# NOTE! This should always have a ZERO as exit code
-#									# otherwise the coverage generation will not complete.
-#				coverage            # Name of output directory.
-#				)
-#
-# 4. Build a Debug build:
-#	 cmake -DCMAKE_BUILD_TYPE=Debug ..
-#	 make
-#	 make my_coverage_target
-#
-#
+include(CMakeParseArguments)
 
 # Check prereqs
-FIND_PROGRAM( GCOV_PATH gcov )
-FIND_PROGRAM( LCOV_PATH lcov )
-FIND_PROGRAM( GENHTML_PATH genhtml )
-FIND_PROGRAM( GCOVR_PATH gcovr PATHS ${CMAKE_SOURCE_DIR}/tests)
+find_program(GCOV_PATH gcov)
+find_program(LLVM_COV_PATH llvm-cov)
+find_program(LLVM_PROFDATA_PATH llvm-profdata)
+find_program(XCRUN_PATH xcrun)
+find_program(GENHTML_PATH NAMES genhtml genhtml.perl genhtml.bat)
+find_program(GCOVR_PATH gcovr PATHS ${CMAKE_SOURCE_DIR}/scripts/test)
 
-IF(NOT GCOV_PATH)
-	MESSAGE(FATAL_ERROR "gcov not found! Aborting...")
-ENDIF() # NOT GCOV_PATH
+set(COVERAGE_COMPILER_FLAGS "-g -O0" CACHE INTERNAL "")
+if(CMAKE_COMPILER_IS_GNUCXX)
+    set(COVERAGE_COMPILER_FLAGS "${COVERAGE_COMPILER_FLAGS} --coverage -fprofile-arcs -ftest-coverage")
+elseif(CMAKE_COMPILER_IS_CLANGXX)
+    set(COVERAGE_COMPILER_FLAGS "${COVERAGE_COMPILER_FLAGS} -fprofile-instr-generate -fcoverage-mapping")
+endif()
 
-IF("${CMAKE_CXX_COMPILER_ID}" MATCHES "(Apple)?[Cc]lang")
-	IF("${CMAKE_CXX_COMPILER_VERSION}" VERSION_LESS 3)
-		MESSAGE(FATAL_ERROR "Clang version must be 3.0.0 or greater! Aborting...")
-	ENDIF()
-ELSEIF(NOT CMAKE_COMPILER_IS_GNUCXX)
-	MESSAGE(FATAL_ERROR "Compiler is not GNU gcc! Aborting...")
-ENDIF() # CHECK VALID COMPILER
+set(CMAKE_COVERAGE_FORMAT
+    "html" "xml"
+    CACHE STRING "Coverage report output format.")
+set_property(CACHE CMAKE_COVERAGE_FORMAT PROPERTY STRINGS "html" "txt")
 
-SET(CMAKE_CXX_FLAGS_COVERAGE
-    "-g -O0 --coverage -fprofile-arcs -ftest-coverage"
-    CACHE STRING "Flags used by the C++ compiler during coverage builds."
-    FORCE )
-SET(CMAKE_C_FLAGS_COVERAGE
-    "-g -O0 --coverage -fprofile-arcs -ftest-coverage"
-    CACHE STRING "Flags used by the C compiler during coverage builds."
-    FORCE )
-SET(CMAKE_EXE_LINKER_FLAGS_COVERAGE
+set(CMAKE_CXX_FLAGS_COVERAGE
+    ${COVERAGE_COMPILER_FLAGS}
+    CACHE STRING "Flags used by the C++ compiler during coverage builds.")
+set(CMAKE_C_FLAGS_COVERAGE
+    ${COVERAGE_COMPILER_FLAGS}
+    CACHE STRING "Flags used by the C compiler during coverage builds.")
+set(CMAKE_EXE_LINKER_FLAGS_COVERAGE
     ""
-    CACHE STRING "Flags used for linking binaries during coverage builds."
-    FORCE )
-SET(CMAKE_SHARED_LINKER_FLAGS_COVERAGE
+    CACHE STRING "Flags used for linking binaries during coverage builds.")
+set(CMAKE_SHARED_LINKER_FLAGS_COVERAGE
     ""
-    CACHE STRING "Flags used by the shared libraries linker during coverage builds."
-    FORCE )
-MARK_AS_ADVANCED(
+    CACHE STRING "Flags used by the shared libraries linker during coverage builds.")
+mark_as_advanced(
+    CMAKE_COVERAGE_FORMAT
     CMAKE_CXX_FLAGS_COVERAGE
     CMAKE_C_FLAGS_COVERAGE
     CMAKE_EXE_LINKER_FLAGS_COVERAGE
-    CMAKE_SHARED_LINKER_FLAGS_COVERAGE )
+    CMAKE_SHARED_LINKER_FLAGS_COVERAGE)
 
-IF ( NOT (CMAKE_BUILD_TYPE STREQUAL "Debug" OR CMAKE_BUILD_TYPE STREQUAL "Coverage"))
-  MESSAGE( WARNING "Code coverage results with an optimized (non-Debug) build may be misleading" )
-ENDIF() # NOT CMAKE_BUILD_TYPE STREQUAL "Debug"
+if(NOT CMAKE_BUILD_TYPE_LOWER STREQUAL "debug")
+    message(WARNING "Code coverage results with an optimised (non-Debug) build may be misleading")
+endif() # NOT CMAKE_BUILD_TYPE STREQUAL "Debug"
+
+if(CMAKE_COMPILER_IS_GNUCXX)
+    if(NOT GCOV_PATH)
+        message(FATAL_ERROR "gcov not found! Aborting...")
+    endif() # NOT GCOV_PATH
+    link_libraries(gcov)
+endif()
 
 
-# Param _targetname     The name of new the custom make target
-# Param _testrunner     The name of the target which runs the tests.
-#						MUST return ZERO always, even on errors.
-#						If not, no coverage report will be created!
-# Param _outputname     lcov output is generated as _outputname.info
-#                       HTML report is generated in _outputname/index.html
-# Optional fourth parameter is passed as arguments to _testrunner
-#   Pass them in list form, e.g.: "-j;2" for -j 2
-FUNCTION(SETUP_TARGET_FOR_COVERAGE _targetname _testrunner _outputname)
+# Defines a target for running and collection code coverage information
+# Builds dependencies, runs the given executable and outputs reports.
+# NOTE! The executable should always have a ZERO as exit code otherwise
+# the coverage generation will not complete.
+#
+# SETUP_TARGET_FOR_COVERAGE_GCOVR(
+#     NAME ctest_coverage                    # New target name
+#     EXECUTABLE ctest -j ${PROCESSOR_COUNT} # Executable in PROJECT_BINARY_DIR
+#     DEPENDENCIES executable_target         # Dependencies to build first
+# )
+function(SETUP_TARGET_FOR_COVERAGE_GCOVR)
 
-	IF(NOT LCOV_PATH)
-		MESSAGE(FATAL_ERROR "lcov not found! Aborting...")
-	ENDIF() # NOT LCOV_PATH
+    set(options NONE)
+    set(oneValueArgs NAME SOURCES_ROOT)
+    set(multiValueArgs EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+    cmake_parse_arguments(Coverage "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
 
-	IF(NOT GENHTML_PATH)
-		MESSAGE(FATAL_ERROR "genhtml not found! Aborting...")
-	ENDIF() # NOT GENHTML_PATH
+    if(NOT GCOVR_PATH)
+        message(FATAL_ERROR "gcovr not found! Aborting...")
+    endif() # NOT GCOVR_PATH
 
-	SET(coverage_info "${CMAKE_BINARY_DIR}/${_outputname}.info")
-	SET(coverage_cleaned "${coverage_info}.cleaned")
+    # Combine excludes to several -e arguments
+    set(GCOVR_EXCLUDES "")
+    foreach(EXCLUDE ${COVERAGE_EXCLUDES})
+        list(APPEND GCOVR_EXCLUDES "-e")
+        list(APPEND GCOVR_EXCLUDES "${EXCLUDE}")
+    endforeach()
 
-	SEPARATE_ARGUMENTS(test_command UNIX_COMMAND "${_testrunner}")
+    add_custom_target(${Coverage_NAME}
+        # Run tests
+        COMMAND ctest -C $<CONFIG> $ENV{ARGS} $$ARGS
 
-	# Setup target
-	ADD_CUSTOM_TARGET(${_targetname}
+        WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+        DEPENDS ${Coverage_DEPENDENCIES}
+    )
 
-		# Cleanup lcov
-		${LCOV_PATH} --directory . --zerocounters
+    if("html" IN_LIST CMAKE_COVERAGE_FORMAT)
+        add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+            # Create folder
+            COMMAND ${CMAKE_COMMAND} -E make_directory ${PROJECT_BINARY_DIR}/${Coverage_NAME}-html
 
-		# Run tests
-		COMMAND ${test_command} ${ARGV3}
+            # Running gcovr HTML
+            COMMAND ${GCOVR_PATH} --html --html-details
+                -r ${Coverage_SOURCES_ROOT} ${GCOVR_EXCLUDES}
+                --object-directory=${PROJECT_BINARY_DIR}
+                --exclude-unreachable-branches --exclude-throw-branches
+                -o ${Coverage_NAME}-html/index.html
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Running gcovr to produce HTML code coverage report ${Coverage_NAME}-html."
+        )
+    endif()
 
-		# Capturing lcov counters and generating report
-		COMMAND ${LCOV_PATH} --directory . --capture --output-file ${coverage_info}
-		COMMAND ${LCOV_PATH} --remove ${coverage_info} 'tests/*' '/usr/*' --output-file ${coverage_cleaned}
-		COMMAND ${GENHTML_PATH} -o ${_outputname} ${coverage_cleaned}
-		COMMAND ${CMAKE_COMMAND} -E remove ${coverage_info} ${coverage_cleaned}
+    if("xml" IN_LIST CMAKE_COVERAGE_FORMAT)
+        add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+            # Running gcovr TXT
+            COMMAND ${GCOVR_PATH} --xml
+                -r ${Coverage_SOURCES_ROOT} ${GCOVR_EXCLUDES}
+                --object-directory=${PROJECT_BINARY_DIR}
+                --exclude-unreachable-branches --exclude-throw-branches
+                -o ${Coverage_NAME}.xml
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Running gcovr to produce XML code coverage report ${Coverage_NAME}.xml."
+        )
+    endif()
 
-		WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-		COMMENT "Resetting code coverage counters to zero.\nProcessing code coverage counters and generating report."
-	)
+    if("txt" IN_LIST CMAKE_COVERAGE_FORMAT)
+        add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+            # Running gcovr TXT
+            COMMAND ${GCOVR_PATH}
+                -r ${Coverage_SOURCES_ROOT} ${GCOVR_EXCLUDES}
+                --object-directory=${PROJECT_BINARY_DIR}
+                --exclude-unreachable-branches --exclude-throw-branches
+                -o ${Coverage_NAME}.txt
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Running gcovr to produce TXT code coverage report ${Coverage_NAME}.txt."
+        )
+    endif()
 
-	# Show info where to find the report
-	ADD_CUSTOM_COMMAND(TARGET ${_targetname} POST_BUILD
-		COMMAND ;
-		COMMENT "Open ./${_outputname}/index.html in your browser to view the coverage report."
-	)
+endfunction() # SETUP_TARGET_FOR_COVERAGE_GCOVR
 
-ENDFUNCTION() # SETUP_TARGET_FOR_COVERAGE
+# Defines a target for running and collection code coverage information
+# Builds dependencies, runs the given executable and outputs reports.
+# NOTE! The executable should always have a ZERO as exit code otherwise
+# the coverage generation will not complete.
+#
+# SETUP_TARGET_FOR_COVERAGE_LLVM(
+#     NAME ctest_coverage                    # New target name
+#     EXECUTABLE ctest -j ${PROCESSOR_COUNT} # Executable in PROJECT_BINARY_DIR
+#     DEPENDENCIES executable_target         # Dependencies to build first
+# )
+function(SETUP_TARGET_FOR_COVERAGE_LLVM)
 
-# Param _targetname     The name of new the custom make target
-# Param _testrunner     The name of the target which runs the tests
-# Param _outputname     cobertura output is generated as _outputname.xml
-# Optional fourth parameter is passed as arguments to _testrunner
-#   Pass them in list form, e.g.: "-j;2" for -j 2
-FUNCTION(SETUP_TARGET_FOR_COVERAGE_COBERTURA _targetname _testrunner _outputname)
+    set(options NONE)
+    set(oneValueArgs NAME SOURCES_ROOT PROF_FILE)
+    set(multiValueArgs EXECUTABLE BINARY EXECUTABLE_ARGS DEPENDENCIES)
+    cmake_parse_arguments(Coverage "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
 
-	IF(NOT PYTHON_EXECUTABLE)
-		MESSAGE(FATAL_ERROR "Python not found! Aborting...")
-	ENDIF() # NOT PYTHON_EXECUTABLE
+    if(XCRUN_PATH)
+        set(LLVM_COV_PATH ${XCRUN_PATH} llvm-cov)
+        set(LLVM_PROFDATA_PATH ${XCRUN_PATH} llvm-profdata)
+    else()
+        if(NOT LLVM_COV_PATH)
+            message(FATAL_ERROR "llvm-cov not found! Aborting...")
+        endif() # NOT LLVM_COV_PATH
+        if(NOT LLVM_PROFDATA_PATH)
+            message(FATAL_ERROR "llvm-profdata not found! Aborting...")
+        endif() # NOT LLVM_PROFDATA_PATH
+    endif() # XCRUN_PATH
 
-	IF(NOT GCOVR_PATH)
-		MESSAGE(FATAL_ERROR "gcovr not found! Aborting...")
-	ENDIF() # NOT GCOVR_PATH
+    set(LLVM_PROFILE_DIR ${PROJECT_BINARY_DIR}/llvm_profile)
+    file(REMOVE_RECURSE ${LLVM_PROFILE_DIR})
 
-	ADD_CUSTOM_TARGET(${_targetname}
+    set(COV_EXCLUDES "")
+    foreach(EXCLUDE ${COVERAGE_EXCLUDES})
+        list(APPEND COV_EXCLUDES "-ignore-filename-regex=${EXCLUDE}")
+    endforeach()
 
-		# Run tests
-		${_testrunner} ${ARGV3}
+    list(GET Coverage_BINARY 0 COV_BINARY)
+    if(Coverage_BINARY)
+        list(REMOVE_AT Coverage_BINARY 0)
+        foreach(BIN ${Coverage_BINARY})
+            list(APPEND COV_BINARY -object ${BIN})
+        endforeach()
+    endif()
 
-		# Running gcovr
-		COMMAND ${GCOVR_PATH} -x -r ${CMAKE_SOURCE_DIR} -e '${CMAKE_SOURCE_DIR}/tests/'  -o ${_outputname}.xml
-		WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-		COMMENT "Running gcovr to produce Cobertura code coverage report."
-	)
+    add_custom_target(${Coverage_NAME}
+        COMMAND ${CMAKE_COMMAND} -E env LLVM_PROFILE_FILE=${LLVM_PROFILE_DIR}/profile-%p.profraw ctest -C $<CONFIG> $$ARGS
 
-	# Show info where to find the report
-	ADD_CUSTOM_COMMAND(TARGET ${_targetname} POST_BUILD
-		COMMAND ;
-		COMMENT "Cobertura code coverage report saved in ${_outputname}.xml."
-	)
+        COMMAND ${LLVM_PROFDATA_PATH} merge -sparse ${LLVM_PROFILE_DIR}/* -o coverage.profdata
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            DEPENDS ${Coverage_DEPENDENCIES})
 
-ENDFUNCTION() # SETUP_TARGET_FOR_COVERAGE_COBERTURA
+    if("html" IN_LIST CMAKE_COVERAGE_FORMAT)
+        add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+            COMMAND ${LLVM_COV_PATH} show -instr-profile=coverage.profdata ${COV_BINARY}
+                --format=html --output-dir=${Coverage_NAME}-html ${COV_EXCLUDES} ${Coverage_SOURCES_ROOT}
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Running llvm-cov to produce HTML code coverage report ${Coverage_NAME}-html")
+    endif()
+
+    if("xml" IN_LIST CMAKE_COVERAGE_FORMAT)
+        message(WARNING "XML coverage report format not supported for llvm-cov")
+    endif()
+
+    if("txt" IN_LIST CMAKE_COVERAGE_FORMAT)
+        add_custom_command(TARGET ${Coverage_NAME} POST_BUILD
+            COMMAND ${LLVM_COV_PATH} show -instr-profile=coverage.profdata ${COV_BINARY}
+                --format=text ${COV_EXCLUDES} ${Coverage_SOURCES_ROOT} > ${Coverage_NAME}.txt
+
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Running llvm-cov to produce TXT code coverage report ${Coverage_NAME}.txt.")
+    endif()
+
+endfunction() # SETUP_TARGET_FOR_COVERAGE_LLVM
+
+
+function(APPEND_COVERAGE_COMPILER_FLAGS)
+    message(STATUS "Appending code coverage compiler flags: ${COVERAGE_COMPILER_FLAGS}")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${COVERAGE_COMPILER_FLAGS}" PARENT_SCOPE)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${COVERAGE_COMPILER_FLAGS}" PARENT_SCOPE)
+endfunction() # APPEND_COVERAGE_COMPILER_FLAGS

cmake/FindArgon2.cmake

@@ -1,34 +0,0 @@
-#  Copyright (C) 2017 KeePassXC Team
-#
-#  This program is free software: you can redistribute it and/or modify
-#  it under the terms of the GNU General Public License as published by
-#  the Free Software Foundation, either version 2 or (at your option)
-#  version 3 of the License.
-#
-#  This program is distributed in the hope that it will be useful,
-#  but WITHOUT ANY WARRANTY; without even the implied warranty of
-#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#  GNU General Public License for more details.
-#
-#  You should have received a copy of the GNU General Public License
-#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-find_path(ARGON2_INCLUDE_DIR argon2.h)
-if (MINGW)
-  # find static library on Windows, and redefine used symbols to
-  # avoid definition name conflicts with libsodium
-  find_library(ARGON2_SYS_LIBRARIES libargon2.a)
-  message(STATUS "Patching libargon2...\n")
-  execute_process(COMMAND objcopy
-              --redefine-sym argon2_hash=libargon2_argon2_hash
-              --redefine-sym argon2_error_message=libargon2_argon2_error_message
-              ${ARGON2_SYS_LIBRARIES} ${CMAKE_BINARY_DIR}/libargon2_patched.a
-          WORKING_DIRECTORY ${CMAKE_BINARY_DIR})
-  find_library(ARGON2_LIBRARIES libargon2_patched.a PATHS ${CMAKE_BINARY_DIR} NO_DEFAULT_PATH)
-else()
-  find_library(ARGON2_LIBRARIES argon2)
-endif()
-mark_as_advanced(ARGON2_LIBRARIES ARGON2_INCLUDE_DIR)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(Argon2 DEFAULT_MSG ARGON2_LIBRARIES ARGON2_INCLUDE_DIR)

cmake/FindBotan.cmake

@@ -0,0 +1,65 @@
+# - Find botan
+# Find the botan cryptographic library
+#
+# This module defines the following variables:
+#   BOTAN_FOUND  -  True if library and include directory are found
+# If set to TRUE, the following are also defined:
+#   BOTAN_INCLUDE_DIRS  -  The directory where to find the header file
+#   BOTAN_LIBRARIES  -  Where to find the library files
+#
+# This file is in the public domain (https://github.com/vistle/vistle/blob/master/cmake/Modules/FindBOTAN.cmake)
+
+include(FindPackageHandleStandardArgs)
+
+set(BOTAN_VERSIONS botan-3 botan-2)
+set(BOTAN_NAMES botan-3 botan-2 botan)
+set(BOTAN_NAMES_DEBUG botand-3 botand-2 botand botan botan-3)
+
+find_path(
+    BOTAN_INCLUDE_DIR
+    NAMES botan/build.h
+    PATH_SUFFIXES ${BOTAN_VERSIONS}
+    DOC "The Botan include directory")
+if(BOTAN_INCLUDE_DIR)
+    file(READ "${BOTAN_INCLUDE_DIR}/botan/build.h" build)
+    string(REGEX MATCH "BOTAN_VERSION_MAJOR ([0-9]*)" _ ${build})
+    set(BOTAN_VERSION_MAJOR ${CMAKE_MATCH_1})
+    string(REGEX MATCH "BOTAN_VERSION_MINOR ([0-9]*)" _ ${build})
+    set(BOTAN_VERSION_MINOR ${CMAKE_MATCH_1})
+    string(REGEX MATCH "BOTAN_VERSION_PATCH ([0-9]*)" _ ${build})
+    set(BOTAN_VERSION_PATCH ${CMAKE_MATCH_1})
+    set(BOTAN_VERSION "${BOTAN_VERSION_MAJOR}.${BOTAN_VERSION_MINOR}.${BOTAN_VERSION_PATCH}")
+endif()
+
+find_library(
+    BOTAN_LIBRARY
+    NAMES ${BOTAN_NAMES}
+    PATH_SUFFIXES release/lib lib
+    DOC "The Botan (release) library")
+if(WIN32 AND NOT MINGW)
+    find_library(
+        BOTAN_LIBRARY_DEBUG
+        NAMES ${BOTAN_NAMES_DEBUG}
+        PATH_SUFFIXES debug/lib lib
+        DOC "The Botan debug library")
+    find_package_handle_standard_args(
+        Botan
+        REQUIRED_VARS BOTAN_LIBRARY BOTAN_LIBRARY_DEBUG BOTAN_INCLUDE_DIR
+        VERSION_VAR BOTAN_VERSION)
+else()
+    find_package_handle_standard_args(
+        Botan
+        REQUIRED_VARS BOTAN_LIBRARY BOTAN_INCLUDE_DIR
+        VERSION_VAR BOTAN_VERSION)
+endif()
+
+if(BOTAN_FOUND)
+    set(BOTAN_INCLUDE_DIRS ${BOTAN_INCLUDE_DIR})
+    if(WIN32 AND NOT MINGW)
+        set(BOTAN_LIBRARIES optimized ${BOTAN_LIBRARY} debug ${BOTAN_LIBRARY_DEBUG})
+    else()
+        set(BOTAN_LIBRARIES ${BOTAN_LIBRARY})
+    endif()
+endif()
+
+mark_as_advanced(BOTAN_INCLUDE_DIR BOTAN_LIBRARY BOTAN_LIBRARY_DEBUG)

cmake/FindGcrypt.cmake

@@ -1,31 +0,0 @@
-#  Copyright (C) 2011 Felix Geyer <debfx@fobos.de>
-#
-#  This program is free software: you can redistribute it and/or modify
-#  it under the terms of the GNU General Public License as published by
-#  the Free Software Foundation, either version 2 or (at your option)
-#  version 3 of the License.
-#
-#  This program is distributed in the hope that it will be useful,
-#  but WITHOUT ANY WARRANTY; without even the implied warranty of
-#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#  GNU General Public License for more details.
-#
-#  You should have received a copy of the GNU General Public License
-#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-find_path(GCRYPT_INCLUDE_DIR gcrypt.h)
-
-find_library(GCRYPT_LIBRARIES gcrypt)
-
-mark_as_advanced(GCRYPT_LIBRARIES GCRYPT_INCLUDE_DIR)
-
-if(GCRYPT_INCLUDE_DIR AND EXISTS "${GCRYPT_INCLUDE_DIR}/gcrypt.h")
-    file(STRINGS "${GCRYPT_INCLUDE_DIR}/gcrypt.h" GCRYPT_H REGEX "^#define GCRYPT_VERSION \"[^\"]*\"$")
-    string(REGEX REPLACE "^.*GCRYPT_VERSION \"([0-9]+).*$" "\\1" GCRYPT_VERSION_MAJOR "${GCRYPT_H}")
-    string(REGEX REPLACE "^.*GCRYPT_VERSION \"[0-9]+\\.([0-9]+).*$" "\\1" GCRYPT_VERSION_MINOR  "${GCRYPT_H}")
-    string(REGEX REPLACE "^.*GCRYPT_VERSION \"[0-9]+\\.[0-9]+\\.([0-9]+).*$" "\\1" GCRYPT_VERSION_PATCH "${GCRYPT_H}")
-    set(GCRYPT_VERSION_STRING "${GCRYPT_VERSION_MAJOR}.${GCRYPT_VERSION_MINOR}.${GCRYPT_VERSION_PATCH}")
-endif()
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(Gcrypt DEFAULT_MSG GCRYPT_LIBRARIES GCRYPT_INCLUDE_DIR)

cmake/FindMinizip.cmake

@@ -0,0 +1,9 @@
+# MINIZIP_FOUND                   - Minizip library was found
+# MINIZIP_INCLUDE_DIR             - Path to Minizip include dir
+# MINIZIP_LIBRARIES               - List of Minizip libraries
+
+find_library(MINIZIP_LIBRARIES NAMES minizip libminizip)
+find_path(MINIZIP_INCLUDE_DIR zip.h PATH_SUFFIXES minizip)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Minizip DEFAULT_MSG MINIZIP_LIBRARIES MINIZIP_INCLUDE_DIR)

cmake/FindPCSC.cmake

@@ -0,0 +1,61 @@
+#  Copyright (C) 2021 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Use pkgconfig on Linux
+if(NOT WIN32)
+   find_package(PkgConfig QUIET)
+   pkg_check_modules(PCSC libpcsclite)
+endif()
+
+if(NOT PCSC_FOUND)
+   # Search for PC/SC headers on Mac and Windows
+
+   # Additional search paths for Windows if not running in Visual Studio environment
+   if (WIN32) 
+      # Resolve the ambiguity of using two names for one architecture
+      if(CMAKE_SYSTEM_PROCESSOR STREQUAL "AMD64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "x64")
+         set(ARCH_DIR "x64")
+      else()
+         set(ARCH_DIR "${CMAKE_SYSTEM_PROCESSOR}")
+      endif()
+
+      # Locate Windows SDK Paths
+      if (CMAKE_WINDOWS_KITS_10_DIR)
+         set(WINSDKROOTC_INCLUDE "${CMAKE_WINDOWS_KITS_10_DIR}/Include/${CMAKE_VS_WINDOWS_TARGET_PLATFORM_VERSION}/um")
+         set(WINSDKROOTC_LIB     "${CMAKE_WINDOWS_KITS_10_DIR}/LIB/${CMAKE_VS_WINDOWS_TARGET_PLATFORM_VERSION}/um/${ARCH_DIR}")
+      else()
+         set(WINSDKROOTC_INCLUDE "$ENV{ProgramFiles\(x86\)}/Windows Kits/10/Include/${CMAKE_VS_WINDOWS_TARGET_PLATFORM_VERSION}/um")
+         set(WINSDKROOTC_LIB     "$ENV{ProgramFiles\(x86\)}/Windows Kits/10/LIB/${CMAKE_VS_WINDOWS_TARGET_PLATFORM_VERSION}/um/${ARCH_DIR}")
+      endif()
+   endif()
+
+   find_path(PCSC_INCLUDE_DIRS winscard.h
+      HINTS
+         ${CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES}
+         /usr/include/PCSC
+         ${WINSDKROOTC_INCLUDE}
+      PATH_SUFFIXES PCSC)
+
+   # MAC library is PCSC, Windows library is WinSCard
+   find_library(PCSC_LIBRARIES NAMES pcsclite libpcsclite WinSCard PCSC
+      HINTS   
+         ${CMAKE_C_IMPLICIT_LINK_DIRECTORIES}
+         ${WINSDKROOTC_LIB})
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(PCSC DEFAULT_MSG PCSC_LIBRARIES PCSC_INCLUDE_DIRS)
+
+mark_as_advanced(PCSC_LIBRARIES PCSC_INCLUDE_DIRS)

cmake/FindQREncode.cmake

@@ -1,4 +1,4 @@
-#  Copyright (C) 2014 Kyle Manna <kyle@kylemanna.com>
+#  Copyright (C) 2017 KeePassXC Team <team@keepassxc.org>
 #
 #  This program is free software: you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -13,15 +13,17 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-find_path(YUBIKEY_CORE_INCLUDE_DIR yubikey.h)
-find_path(YUBIKEY_PERS_INCLUDE_DIR ykcore.h PATH_SUFFIXES ykpers-1)
-set(YUBIKEY_INCLUDE_DIRS ${YUBIKEY_CORE_INCLUDE_DIR} ${YUBIKEY_PERS_INCLUDE_DIR})
+find_path(QRENCODE_INCLUDE_DIR NAMES qrencode.h)
 
-find_library(YUBIKEY_CORE_LIBRARY NAMES yubikey.dll libyubikey.so yubikey)
-find_library(YUBIKEY_PERS_LIBRARY NAMES ykpers-1.dll libykpers-1.so ykpers-1)
-set(YUBIKEY_LIBRARIES ${YUBIKEY_CORE_LIBRARY} ${YUBIKEY_PERS_LIBRARY})
+if(WIN32 AND NOT MINGW)
+	find_library(QRENCODE_LIBRARY_RELEASE qrencode)
+	find_library(QRENCODE_LIBRARY_DEBUG qrencoded)
+	set(QRENCODE_LIBRARY optimized ${QRENCODE_LIBRARY_RELEASE} debug ${QRENCODE_LIBRARY_DEBUG})
+else()
+	find_library(QRENCODE_LIBRARY qrencode)
+endif()
+
+mark_as_advanced(QRENCODE_LIBRARY QRENCODE_INCLUDE_DIR)
 
 include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(YubiKey DEFAULT_MSG YUBIKEY_LIBRARIES YUBIKEY_INCLUDE_DIRS)
-
-mark_as_advanced(YUBIKEY_LIBRARIES YUBIKEY_INCLUDE_DIRS)
+find_package_handle_standard_args(QREncode DEFAULT_MSG QRENCODE_LIBRARY QRENCODE_INCLUDE_DIR)

cmake/FindReadline.cmake

@@ -0,0 +1,49 @@
+# Code copied from sethhall@github
+#
+# - Try to find readline include dirs and libraries
+#
+# Usage of this module as follows:
+#
+#     find_package(Readline)
+#
+# Variables used by this module, they can change the default behaviour and need
+# to be set before calling find_package:
+#
+#  Readline_ROOT_DIR         Set this variable to the root installation of
+#                            readline if the module has problems finding the
+#                            proper installation path.
+#
+# Variables defined by this module:
+#
+#  READLINE_FOUND            System has readline, include and lib dirs found
+#  Readline_INCLUDE_DIR      The readline include directories.
+#  Readline_LIBRARY          The readline library.
+
+find_path(Readline_ROOT_DIR
+    NAMES include/readline/readline.h
+)
+
+find_path(Readline_INCLUDE_DIR
+    NAMES readline/readline.h
+    HINTS ${Readline_ROOT_DIR}/include
+)
+
+find_library(Readline_LIBRARY
+    NAMES readline
+    HINTS ${Readline_ROOT_DIR}/lib
+)
+
+if(Readline_INCLUDE_DIR AND Readline_LIBRARY AND Ncurses_LIBRARY)
+  set(READLINE_FOUND TRUE)
+else(Readline_INCLUDE_DIR AND Readline_LIBRARY AND Ncurses_LIBRARY)
+  find_library(Readline_LIBRARY NAMES readline)
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Readline DEFAULT_MSG Readline_INCLUDE_DIR Readline_LIBRARY )
+  mark_as_advanced(Readline_INCLUDE_DIR Readline_LIBRARY)
+endif(Readline_INCLUDE_DIR AND Readline_LIBRARY AND Ncurses_LIBRARY)
+
+mark_as_advanced(
+    Readline_ROOT_DIR
+    Readline_INCLUDE_DIR
+    Readline_LIBRARY
+)

cmake/Findsodium.cmake

@@ -1,267 +0,0 @@
-# Written in 2016 by Henrik Steffen Gaßmann <henrik@gassmann.onl>
-#
-# To the extent possible under law, the author(s) have dedicated all
-# copyright and related and neighboring rights to this software to the
-# public domain worldwide. This software is distributed without any warranty.
-#
-# You should have received a copy of the CC0 Public Domain Dedication
-# along with this software. If not, see
-#
-#     http://creativecommons.org/publicdomain/zero/1.0/
-#
-########################################################################
-# Tries to find the local libsodium installation.
-#
-# On Windows the sodium_DIR environment variable is used as a default
-# hint which can be overridden by setting the corresponding cmake variable.
-#
-# Once done the following variables will be defined:
-#
-#   sodium_FOUND
-#   sodium_INCLUDE_DIR
-#   sodium_LIBRARY_DEBUG
-#   sodium_LIBRARY_RELEASE
-#
-#
-# Furthermore an imported "sodium" target is created.
-#
-
-if (CMAKE_C_COMPILER_ID STREQUAL "GNU"
-    OR CMAKE_C_COMPILER_ID STREQUAL "Clang")
-    set(_GCC_COMPATIBLE 1)
-endif()
-
-# static library option
-option(sodium_USE_STATIC_LIBS "enable to statically link against sodium")
-if(NOT (sodium_USE_STATIC_LIBS EQUAL sodium_USE_STATIC_LIBS_LAST))
-    unset(sodium_LIBRARY CACHE)
-    unset(sodium_LIBRARY_DEBUG CACHE)
-    unset(sodium_LIBRARY_RELEASE CACHE)
-    unset(sodium_DLL_DEBUG CACHE)
-    unset(sodium_DLL_RELEASE CACHE)
-    set(sodium_USE_STATIC_LIBS_LAST ${sodium_USE_STATIC_LIBS} CACHE INTERNAL "internal change tracking variable")
-endif()
-
-
-########################################################################
-# UNIX
-if (UNIX)
-    # import pkg-config
-    find_package(PkgConfig QUIET)
-    if (PKG_CONFIG_FOUND)
-        pkg_check_modules(sodium_PKG QUIET libsodium)
-    endif()
-
-    if(sodium_USE_STATIC_LIBS)
-        set(XPREFIX sodium_PKG_STATIC)
-    else()
-        set(XPREFIX sodium_PKG)
-    endif()
-
-    find_path(sodium_INCLUDE_DIR sodium.h
-        HINTS ${${XPREFIX}_INCLUDE_DIRS}
-    )
-    find_library(sodium_LIBRARY_DEBUG NAMES ${${XPREFIX}_LIBRARIES} sodium
-        HINTS ${${XPREFIX}_LIBRARY_DIRS}
-    )
-    find_library(sodium_LIBRARY_RELEASE NAMES ${${XPREFIX}_LIBRARIES} sodium
-        HINTS ${${XPREFIX}_LIBRARY_DIRS}
-    )
-
-
-########################################################################
-# Windows
-elseif (WIN32)
-    set(sodium_DIR "$ENV{sodium_DIR}" CACHE FILEPATH "sodium install directory")
-    mark_as_advanced(sodium_DIR)
-
-    find_path(sodium_INCLUDE_DIR sodium.h
-        HINTS ${sodium_DIR}
-        PATH_SUFFIXES include
-    )
-
-    if (MSVC)
-        # detect target architecture
-        file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/arch.c" [=[
-            #if defined _M_IX86
-            #error ARCH_VALUE x86_32
-            #elif defined _M_X64
-            #error ARCH_VALUE x86_64
-            #endif
-            #error ARCH_VALUE unknown
-        ]=])
-        try_compile(_UNUSED_VAR "${CMAKE_CURRENT_BINARY_DIR}" "${CMAKE_CURRENT_BINARY_DIR}/arch.c"
-            OUTPUT_VARIABLE _COMPILATION_LOG
-        )
-        string(REGEX REPLACE ".*ARCH_VALUE ([a-zA-Z0-9_]+).*" "\\1" _TARGET_ARCH "${_COMPILATION_LOG}")
-
-        # construct library path
-        if (_TARGET_ARCH STREQUAL "x86_32")
-            string(APPEND _PLATFORM_PATH "Win32")
-        elseif(_TARGET_ARCH STREQUAL "x86_64")
-            string(APPEND _PLATFORM_PATH "x64")
-        else()
-            message(FATAL_ERROR "the ${_TARGET_ARCH} architecture is not supported by Findsodium.cmake.")
-        endif()
-        string(APPEND _PLATFORM_PATH "/$$CONFIG$$")
-
-        if (MSVC_VERSION LESS 1900)
-            math(EXPR _VS_VERSION "${MSVC_VERSION} / 10 - 60")
-        else()
-            math(EXPR _VS_VERSION "${MSVC_VERSION} / 10 - 50")
-        endif()
-        string(APPEND _PLATFORM_PATH "/v${_VS_VERSION}")
-
-        if (sodium_USE_STATIC_LIBS)
-            string(APPEND _PLATFORM_PATH "/static")
-        else()
-            string(APPEND _PLATFORM_PATH "/dynamic")
-        endif()
-
-        string(REPLACE "$$CONFIG$$" "Debug" _DEBUG_PATH_SUFFIX "${_PLATFORM_PATH}")
-        string(REPLACE "$$CONFIG$$" "Release" _RELEASE_PATH_SUFFIX "${_PLATFORM_PATH}")
-
-        find_library(sodium_LIBRARY_DEBUG libsodium.lib
-            HINTS ${sodium_DIR}
-            PATH_SUFFIXES ${_DEBUG_PATH_SUFFIX}
-        )
-        find_library(sodium_LIBRARY_RELEASE libsodium.lib
-            HINTS ${sodium_DIR}
-            PATH_SUFFIXES ${_RELEASE_PATH_SUFFIX}
-        )
-        if (NOT sodium_USE_STATIC_LIBS)
-            set(CMAKE_FIND_LIBRARY_SUFFIXES ".dll")
-            find_library(sodium_DLL_DEBUG libsodium
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES ${_DEBUG_PATH_SUFFIX}
-            )
-            find_library(sodium_DLL_RELEASE libsodium
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES ${_RELEASE_PATH_SUFFIX}
-            )
-        endif()
-
-    elseif(_GCC_COMPATIBLE)
-        if (sodium_USE_STATIC_LIBS)
-            find_library(sodium_LIBRARY_DEBUG libsodium.a
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES lib
-            )
-            find_library(sodium_LIBRARY_RELEASE libsodium.a
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES lib
-            )
-        else()
-            find_library(sodium_LIBRARY_DEBUG libsodium.dll.a
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES lib
-            )
-            find_library(sodium_LIBRARY_RELEASE libsodium.dll.a
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES lib
-            )
-
-            file(GLOB _DLL
-                LIST_DIRECTORIES false
-                RELATIVE "${sodium_DIR}/bin"
-                "${sodium_DIR}/bin/libsodium*.dll"
-            )
-            find_library(sodium_DLL_DEBUG ${_DLL} libsodium
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES bin
-            )
-            find_library(sodium_DLL_RELEASE ${_DLL} libsodium
-                HINTS ${sodium_DIR}
-                PATH_SUFFIXES bin
-            )
-        endif()
-    else()
-        message(FATAL_ERROR "this platform is not supported by FindSodium.cmake")
-    endif()
-
-
-########################################################################
-# unsupported
-else()
-    message(FATAL_ERROR "this platform is not supported by FindSodium.cmake")
-endif()
-
-
-########################################################################
-# common stuff
-
-# extract sodium version
-if (sodium_INCLUDE_DIR)
-    set(_VERSION_HEADER "${_INCLUDE_DIR}/sodium/version.h")
-    if (EXISTS _VERSION_HEADER)
-        file(READ "${_VERSION_HEADER}" _VERSION_HEADER_CONTENT)
-        string(REGEX REPLACE ".*#[ \t]*define[ \t]*SODIUM_VERSION_STRING[ \t]*\"([^\n]*)\".*" "\\1"
-            sodium_VERSION "${_VERSION_HEADER_CONTENT}")
-        set(sodium_VERSION "${sodium_VERSION}" PARENT_SCOPE)
-    endif()
-endif()
-
-# communicate results
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(sodium
-    REQUIRED_VARS
-        sodium_LIBRARY_RELEASE
-        sodium_LIBRARY_DEBUG
-        sodium_INCLUDE_DIR
-    VERSION_VAR
-        sodium_VERSION
-)
-
-# mark file paths as advanced
-mark_as_advanced(sodium_INCLUDE_DIR)
-mark_as_advanced(sodium_LIBRARY_DEBUG)
-mark_as_advanced(sodium_LIBRARY_RELEASE)
-if (WIN32)
-    mark_as_advanced(sodium_DLL_DEBUG)
-    mark_as_advanced(sodium_DLL_RELEASE)
-endif()
-
-# create imported target
-if(sodium_USE_STATIC_LIBS)
-    set(_LIB_TYPE STATIC)
-else()
-    set(_LIB_TYPE SHARED)
-endif()
-add_library(sodium ${_LIB_TYPE} IMPORTED)
-
-set_target_properties(sodium PROPERTIES
-    INTERFACE_INCLUDE_DIRECTORIES "${sodium_INCLUDE_DIR}"
-    IMPORTED_LINK_INTERFACE_LANGUAGES "C"
-)
-
-if (sodium_USE_STATIC_LIBS)
-    set_target_properties(sodium PROPERTIES
-        INTERFACE_COMPILE_DEFINITIONS "SODIUM_STATIC"
-        IMPORTED_LOCATION "${sodium_LIBRARY_RELEASE}"
-        IMPORTED_LOCATION_DEBUG "${sodium_LIBRARY_DEBUG}"
-    )
-else()
-    if (UNIX)
-        set_target_properties(sodium PROPERTIES
-            IMPORTED_LOCATION "${sodium_LIBRARY_RELEASE}"
-            IMPORTED_LOCATION_DEBUG "${sodium_LIBRARY_DEBUG}"
-        )
-    elseif (WIN32)
-        set_target_properties(sodium PROPERTIES
-            IMPORTED_IMPLIB "${sodium_LIBRARY_RELEASE}"
-            IMPORTED_IMPLIB_DEBUG "${sodium_LIBRARY_DEBUG}"
-        )
-        if (NOT (sodium_DLL_DEBUG MATCHES ".*-NOTFOUND"))
-            set_target_properties(sodium PROPERTIES
-                IMPORTED_LOCATION_DEBUG "${sodium_DLL_DEBUG}"
-            )
-        endif()
-        if (NOT (sodium_DLL_RELEASE MATCHES ".*-NOTFOUND"))
-            set_target_properties(sodium PROPERTIES
-                IMPORTED_LOCATION_RELWITHDEBINFO "${sodium_DLL_RELEASE}"
-                IMPORTED_LOCATION_MINSIZEREL "${sodium_DLL_RELEASE}"
-                IMPORTED_LOCATION_RELEASE "${sodium_DLL_RELEASE}"
-            )
-        endif()
-    endif()
-endif()

cmake/GNUInstallDirs.cmake

@@ -1,188 +0,0 @@
-# - Define GNU standard installation directories
-# Provides install directory variables as defined for GNU software:
-#  http://www.gnu.org/prep/standards/html_node/Directory-Variables.html
-# Inclusion of this module defines the following variables:
-#  CMAKE_INSTALL_<dir>      - destination for files of a given type
-#  CMAKE_INSTALL_FULL_<dir> - corresponding absolute path
-# where <dir> is one of:
-#  BINDIR           - user executables (bin)
-#  SBINDIR          - system admin executables (sbin)
-#  LIBEXECDIR       - program executables (libexec)
-#  SYSCONFDIR       - read-only single-machine data (etc)
-#  SHAREDSTATEDIR   - modifiable architecture-independent data (com)
-#  LOCALSTATEDIR    - modifiable single-machine data (var)
-#  LIBDIR           - object code libraries (lib or lib64 or lib/<multiarch-tuple> on Debian)
-#  INCLUDEDIR       - C header files (include)
-#  OLDINCLUDEDIR    - C header files for non-gcc (/usr/include)
-#  DATAROOTDIR      - read-only architecture-independent data root (share)
-#  DATADIR          - read-only architecture-independent data (DATAROOTDIR)
-#  INFODIR          - info documentation (DATAROOTDIR/info)
-#  LOCALEDIR        - locale-dependent data (DATAROOTDIR/locale)
-#  MANDIR           - man documentation (DATAROOTDIR/man)
-#  DOCDIR           - documentation root (DATAROOTDIR/doc/PROJECT_NAME)
-# Each CMAKE_INSTALL_<dir> value may be passed to the DESTINATION options of
-# install() commands for the corresponding file type.  If the includer does
-# not define a value the above-shown default will be used and the value will
-# appear in the cache for editing by the user.
-# Each CMAKE_INSTALL_FULL_<dir> value contains an absolute path constructed
-# from the corresponding destination by prepending (if necessary) the value
-# of CMAKE_INSTALL_PREFIX.
-
-#=============================================================================
-# Copyright 2011 Nikita Krupen'ko <krnekit@gmail.com>
-# Copyright 2011 Kitware, Inc.
-#
-# Distributed under the OSI-approved BSD License (the "License");
-# see accompanying file Copyright.txt for details.
-#
-# This software is distributed WITHOUT ANY WARRANTY; without even the
-# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-# See the License for more information.
-#=============================================================================
-# (To distribute this file outside of CMake, substitute the full
-#  License text for the above reference.)
-
-# Installation directories
-#
-if(NOT DEFINED CMAKE_INSTALL_BINDIR)
-  set(CMAKE_INSTALL_BINDIR "bin" CACHE PATH "user executables (bin)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_SBINDIR)
-  set(CMAKE_INSTALL_SBINDIR "sbin" CACHE PATH "system admin executables (sbin)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_LIBEXECDIR)
-  set(CMAKE_INSTALL_LIBEXECDIR "libexec" CACHE PATH "program executables (libexec)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_SYSCONFDIR)
-  set(CMAKE_INSTALL_SYSCONFDIR "etc" CACHE PATH "read-only single-machine data (etc)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_SHAREDSTATEDIR)
-  set(CMAKE_INSTALL_SHAREDSTATEDIR "com" CACHE PATH "modifiable architecture-independent data (com)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_LOCALSTATEDIR)
-  set(CMAKE_INSTALL_LOCALSTATEDIR "var" CACHE PATH "modifiable single-machine data (var)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_LIBDIR)
-  set(_LIBDIR_DEFAULT "lib")
-  # Override this default 'lib' with 'lib64' iff:
-  #  - we are on Linux system but NOT cross-compiling
-  #  - we are NOT on debian
-  #  - we are on a 64 bits system
-  # reason is: amd64 ABI: http://www.x86-64.org/documentation/abi.pdf
-  # For Debian with multiarch, use 'lib/${CMAKE_LIBRARY_ARCHITECTURE}' if
-  # CMAKE_LIBRARY_ARCHITECTURE is set (which contains e.g. "i386-linux-gnu"
-  # See http://wiki.debian.org/Multiarch
-  if((CMAKE_SYSTEM_NAME MATCHES "Linux|kFreeBSD" OR CMAKE_SYSTEM_NAME STREQUAL "GNU")
-      AND NOT CMAKE_CROSSCOMPILING)
-    if (EXISTS "/etc/debian_version") # is this a debian system ?
-       if(CMAKE_LIBRARY_ARCHITECTURE)
-         set(_LIBDIR_DEFAULT "lib/${CMAKE_LIBRARY_ARCHITECTURE}")
-       endif()
-    else() # not debian, rely on CMAKE_SIZEOF_VOID_P:
-      if(NOT DEFINED CMAKE_SIZEOF_VOID_P)
-        message(AUTHOR_WARNING
-          "Unable to determine default CMAKE_INSTALL_LIBDIR directory because no target architecture is known. "
-          "Please enable at least one language before including GNUInstallDirs.")
-      else()
-        if("${CMAKE_SIZEOF_VOID_P}" EQUAL "8")
-          set(_LIBDIR_DEFAULT "lib64")
-        endif()
-      endif()
-    endif()
-  endif()
-  set(CMAKE_INSTALL_LIBDIR "${_LIBDIR_DEFAULT}" CACHE PATH "object code libraries (${_LIBDIR_DEFAULT})")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_INCLUDEDIR)
-  set(CMAKE_INSTALL_INCLUDEDIR "include" CACHE PATH "C header files (include)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_OLDINCLUDEDIR)
-  set(CMAKE_INSTALL_OLDINCLUDEDIR "/usr/include" CACHE PATH "C header files for non-gcc (/usr/include)")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_DATAROOTDIR)
-  set(CMAKE_INSTALL_DATAROOTDIR "share" CACHE PATH "read-only architecture-independent data root (share)")
-endif()
-
-#-----------------------------------------------------------------------------
-# Values whose defaults are relative to DATAROOTDIR.  Store empty values in
-# the cache and store the defaults in local variables if the cache values are
-# not set explicitly.  This auto-updates the defaults as DATAROOTDIR changes.
-
-if(NOT CMAKE_INSTALL_DATADIR)
-  set(CMAKE_INSTALL_DATADIR "" CACHE PATH "read-only architecture-independent data (DATAROOTDIR)")
-  set(CMAKE_INSTALL_DATADIR "${CMAKE_INSTALL_DATAROOTDIR}")
-endif()
-
-if(NOT CMAKE_INSTALL_INFODIR)
-  set(CMAKE_INSTALL_INFODIR "" CACHE PATH "info documentation (DATAROOTDIR/info)")
-  set(CMAKE_INSTALL_INFODIR "${CMAKE_INSTALL_DATAROOTDIR}/info")
-endif()
-
-if(NOT CMAKE_INSTALL_LOCALEDIR)
-  set(CMAKE_INSTALL_LOCALEDIR "" CACHE PATH "locale-dependent data (DATAROOTDIR/locale)")
-  set(CMAKE_INSTALL_LOCALEDIR "${CMAKE_INSTALL_DATAROOTDIR}/locale")
-endif()
-
-if(NOT CMAKE_INSTALL_MANDIR)
-  set(CMAKE_INSTALL_MANDIR "" CACHE PATH "man documentation (DATAROOTDIR/man)")
-  set(CMAKE_INSTALL_MANDIR "${CMAKE_INSTALL_DATAROOTDIR}/man")
-endif()
-
-if(NOT CMAKE_INSTALL_DOCDIR)
-  set(CMAKE_INSTALL_DOCDIR "" CACHE PATH "documentation root (DATAROOTDIR/doc/PROJECT_NAME)")
-  set(CMAKE_INSTALL_DOCDIR "${CMAKE_INSTALL_DATAROOTDIR}/doc/${PROJECT_NAME}")
-endif()
-
-#-----------------------------------------------------------------------------
-
-mark_as_advanced(
-  CMAKE_INSTALL_BINDIR
-  CMAKE_INSTALL_SBINDIR
-  CMAKE_INSTALL_LIBEXECDIR
-  CMAKE_INSTALL_SYSCONFDIR
-  CMAKE_INSTALL_SHAREDSTATEDIR
-  CMAKE_INSTALL_LOCALSTATEDIR
-  CMAKE_INSTALL_LIBDIR
-  CMAKE_INSTALL_INCLUDEDIR
-  CMAKE_INSTALL_OLDINCLUDEDIR
-  CMAKE_INSTALL_DATAROOTDIR
-  CMAKE_INSTALL_DATADIR
-  CMAKE_INSTALL_INFODIR
-  CMAKE_INSTALL_LOCALEDIR
-  CMAKE_INSTALL_MANDIR
-  CMAKE_INSTALL_DOCDIR
-  )
-
-# Result directories
-#
-foreach(dir
-    BINDIR
-    SBINDIR
-    LIBEXECDIR
-    SYSCONFDIR
-    SHAREDSTATEDIR
-    LOCALSTATEDIR
-    LIBDIR
-    INCLUDEDIR
-    OLDINCLUDEDIR
-    DATAROOTDIR
-    DATADIR
-    INFODIR
-    LOCALEDIR
-    MANDIR
-    DOCDIR
-    )
-  if(NOT IS_ABSOLUTE ${CMAKE_INSTALL_${dir}})
-    set(CMAKE_INSTALL_FULL_${dir} "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_${dir}}")
-  else()
-    set(CMAKE_INSTALL_FULL_${dir} "${CMAKE_INSTALL_${dir}}")
-  endif()
-endforeach()

cmake/GenerateProductVersion.cmake

@@ -91,7 +91,7 @@ function(generate_product_version outfiles)
         set(PRODUCT_COMPANY_COPYRIGHT "Copyright (C) ${PRODUCT_CURRENT_YEAR} ${PRODUCT_COMPANY_NAME}")
     endif()
     if (NOT PRODUCT_COMMENTS OR "${PRODUCT_COMMENTS}" STREQUAL "")
-        set(PRODUCT_COMMENTS "${PRODUCT_NAME} v${PRODUCT_VERSION_MAJOR}.${PRODUCT_VERSION_MINOR}")
+        set(PRODUCT_COMMENTS "${PRODUCT_NAME} v${PRODUCT_VERSION_MAJOR}.${PRODUCT_VERSION_MINOR}.${PRODUCT_VERSION_PATCH}")
     endif()
     if (NOT PRODUCT_ORIGINAL_FILENAME OR "${PRODUCT_ORIGINAL_FILENAME}" STREQUAL "")
         set(PRODUCT_ORIGINAL_FILENAME "${PRODUCT_NAME}")

cmake/GetGitRevisionDescription.cmake

@@ -1,130 +0,0 @@
-# - Returns a version string from Git
-#
-# These functions force a re-configure on each git commit so that you can
-# trust the values of the variables in your build system.
-#
-#  get_git_head_revision(<refspecvar> <hashvar> [<additional arguments to git describe> ...])
-#
-# Returns the refspec and sha hash of the current head revision
-#
-#  git_describe(<var> [<additional arguments to git describe> ...])
-#
-# Returns the results of git describe on the source tree, and adjusting
-# the output so that it tests false if an error occurs.
-#
-#  git_get_exact_tag(<var> [<additional arguments to git describe> ...])
-#
-# Returns the results of git describe --exact-match on the source tree,
-# and adjusting the output so that it tests false if there was no exact
-# matching tag.
-#
-# Requires CMake 2.6 or newer (uses the 'function' command)
-#
-# Original Author:
-# 2009-2010 Ryan Pavlik <rpavlik@iastate.edu> <abiryan@ryand.net>
-# http://academic.cleardefinition.com
-# Iowa State University HCI Graduate Program/VRAC
-#
-# Copyright Iowa State University 2009-2010.
-# Distributed under the Boost Software License, Version 1.0.
-# (See accompanying file LICENSE.BOOST-1.0 or copy at
-# http://www.boost.org/LICENSE_1_0.txt)
-
-if(__get_git_revision_description)
-	return()
-endif()
-set(__get_git_revision_description YES)
-
-# We must run the following at "include" time, not at function call time,
-# to find the path to this module rather than the path to a calling list file
-get_filename_component(_gitdescmoddir ${CMAKE_CURRENT_LIST_FILE} PATH)
-
-function(get_git_head_revision _refspecvar _hashvar)
-	set(GIT_PARENT_DIR "${CMAKE_CURRENT_SOURCE_DIR}")
-	set(GIT_DIR "${GIT_PARENT_DIR}/.git")
-	while(NOT EXISTS "${GIT_DIR}")	# .git dir not found, search parent directories
-		set(GIT_PREVIOUS_PARENT "${GIT_PARENT_DIR}")
-		get_filename_component(GIT_PARENT_DIR ${GIT_PARENT_DIR} PATH)
-		if(GIT_PARENT_DIR STREQUAL GIT_PREVIOUS_PARENT)
-			# We have reached the root directory, we are not in git
-			set(${_refspecvar} "GITDIR-NOTFOUND" PARENT_SCOPE)
-			set(${_hashvar} "GITDIR-NOTFOUND" PARENT_SCOPE)
-			return()
-		endif()
-		set(GIT_DIR "${GIT_PARENT_DIR}/.git")
-	endwhile()
-	# check if this is a submodule
-	if(NOT IS_DIRECTORY ${GIT_DIR})
-		file(READ ${GIT_DIR} submodule)
-		string(REGEX REPLACE "gitdir: (.*)\n$" "\\1" GIT_DIR_RELATIVE ${submodule})
-		get_filename_component(SUBMODULE_DIR ${GIT_DIR} PATH)
-		get_filename_component(GIT_DIR ${SUBMODULE_DIR}/${GIT_DIR_RELATIVE} ABSOLUTE)
-	endif()
-	set(GIT_DATA "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/git-data")
-	if(NOT EXISTS "${GIT_DATA}")
-		file(MAKE_DIRECTORY "${GIT_DATA}")
-	endif()
-
-	if(NOT EXISTS "${GIT_DIR}/HEAD")
-		return()
-	endif()
-	set(HEAD_FILE "${GIT_DATA}/HEAD")
-	configure_file("${GIT_DIR}/HEAD" "${HEAD_FILE}" COPYONLY)
-
-	configure_file("${_gitdescmoddir}/GetGitRevisionDescription.cmake.in"
-		"${GIT_DATA}/grabRef.cmake"
-		@ONLY)
-	include("${GIT_DATA}/grabRef.cmake")
-
-	set(${_refspecvar} "${HEAD_REF}" PARENT_SCOPE)
-	set(${_hashvar} "${HEAD_HASH}" PARENT_SCOPE)
-endfunction()
-
-function(git_describe _var)
-	if(NOT GIT_FOUND)
-		find_package(Git QUIET)
-	endif()
-	get_git_head_revision(refspec hash)
-	if(NOT GIT_FOUND)
-		set(${_var} "GIT-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-	if(NOT hash)
-		set(${_var} "HEAD-HASH-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-
-	# TODO sanitize
-	#if((${ARGN}" MATCHES "&&") OR
-	#	(ARGN MATCHES "||") OR
-	#	(ARGN MATCHES "\\;"))
-	#	message("Please report the following error to the project!")
-	#	message(FATAL_ERROR "Looks like someone's doing something nefarious with git_describe! Passed arguments ${ARGN}")
-	#endif()
-
-	#message(STATUS "Arguments to execute_process: ${ARGN}")
-
-	execute_process(COMMAND
-		"${GIT_EXECUTABLE}"
-		describe
-		${hash}
-		${ARGN}
-		WORKING_DIRECTORY
-		"${CMAKE_SOURCE_DIR}"
-		RESULT_VARIABLE
-		res
-		OUTPUT_VARIABLE
-		out
-		ERROR_QUIET
-		OUTPUT_STRIP_TRAILING_WHITESPACE)
-	if(NOT res EQUAL 0)
-		set(out "${out}-${res}-NOTFOUND")
-	endif()
-
-	set(${_var} "${out}" PARENT_SCOPE)
-endfunction()
-
-function(git_get_exact_tag _var)
-	git_describe(out --exact-match ${ARGN})
-	set(${_var} "${out}" PARENT_SCOPE)
-endfunction()

cmake/GetGitRevisionDescription.cmake.in

@@ -1,41 +0,0 @@
-#
-# Internal file for GetGitRevisionDescription.cmake
-#
-# Requires CMake 2.6 or newer (uses the 'function' command)
-#
-# Original Author:
-# 2009-2010 Ryan Pavlik <rpavlik@iastate.edu> <abiryan@ryand.net>
-# http://academic.cleardefinition.com
-# Iowa State University HCI Graduate Program/VRAC
-#
-# Copyright Iowa State University 2009-2010.
-# Distributed under the Boost Software License, Version 1.0.
-# (See accompanying file LICENSE.BOOST-1.0 or copy at
-# http://www.boost.org/LICENSE_1_0.txt)
-
-set(HEAD_HASH)
-
-file(READ "@HEAD_FILE@" HEAD_CONTENTS LIMIT 1024)
-
-string(STRIP "${HEAD_CONTENTS}" HEAD_CONTENTS)
-if(HEAD_CONTENTS MATCHES "ref")
-	# named branch
-	string(REPLACE "ref: " "" HEAD_REF "${HEAD_CONTENTS}")
-	if(EXISTS "@GIT_DIR@/${HEAD_REF}")
-		configure_file("@GIT_DIR@/${HEAD_REF}" "@GIT_DATA@/head-ref" COPYONLY)
-	else()
-		configure_file("@GIT_DIR@/packed-refs" "@GIT_DATA@/packed-refs" COPYONLY)
-		file(READ "@GIT_DATA@/packed-refs" PACKED_REFS)
-		if(${PACKED_REFS} MATCHES "([0-9a-z]*) ${HEAD_REF}")
-			set(HEAD_HASH "${CMAKE_MATCH_1}")
-		endif()
-	endif()
-else()
-	# detached HEAD
-	configure_file("@GIT_DIR@/HEAD" "@GIT_DATA@/head-ref" COPYONLY)
-endif()
-
-if(NOT HEAD_HASH)
-	file(READ "@GIT_DATA@/head-ref" HEAD_HASH LIMIT 1024)
-	string(STRIP "${HEAD_HASH}" HEAD_HASH)
-endif()

cmake/KPXCMacDeployHelpers.cmake

@@ -0,0 +1,61 @@
+# Running macdeployqt on a POST_BUILD copied binaries is pointless when using CPack because
+# the copied binaries will be overridden by the corresponding install(TARGETS) commands.
+# That's why we run macdeployqt using install(CODE) on the already installed binaries.
+# The precondition is that all install(TARGETS) calls have to be called before this function is
+# called.
+# macdeloyqt is called only once, but it is given all executables that should be processed.
+function(kpxc_run_macdeployqt_at_install_time)
+    set(NO_VALUE_OPTIONS)
+    set(SINGLE_VALUE_OPTIONS
+        APP_NAME
+    )
+    set(MULTI_VALUE_OPTIONS
+        EXTRA_BINARIES
+    )
+    cmake_parse_arguments(PARSE_ARGV 0 ARG
+        "${NO_VALUE_OPTIONS}" "${SINGLE_VALUE_OPTIONS}" "${MULTI_VALUE_OPTIONS}"
+    )
+
+    set(ESCAPED_PREFIX "\${CMAKE_INSTALL_PREFIX}")
+    set(APP_BUNDLE_NAME "${ARG_APP_NAME}.app")
+    set(APP_BUNDLE_PATH "${ESCAPED_PREFIX}/${APP_BUNDLE_NAME}")
+
+    # Collect extra binaries and plugins that should be handled by macdpeloyqt.
+    set(EXTRA_BINARIES "")
+    foreach(EXTRA_BINARY ${ARG_EXTRA_BINARIES})
+        set(INSTALLED_BINARY_PATH "${ESCAPED_PREFIX}/${EXTRA_BINARY}")
+        list(APPEND EXTRA_BINARIES "-executable=${INSTALLED_BINARY_PATH}")
+    endforeach()
+
+    list(JOIN EXTRA_BINARIES " " EXTRA_BINARIES_STR)
+
+    if(CMAKE_VERSION VERSION_GREATER "3.14")
+        set(COMMAND_ECHO "COMMAND_ECHO STDOUT")
+    else()
+        set(COMMAND_ECHO "")
+    endif()
+
+    set(COMMAND_ARGS
+        ${MACDEPLOYQT_EXE}
+        ${APP_BUNDLE_PATH}
+
+        # Adjusts dependency rpaths of extra binaries
+        ${EXTRA_BINARIES_STR}
+
+        # Silences warnings on subsequent re-installations
+        -always-overwrite
+    )
+
+    install(CODE
+    "
+execute_process(
+    COMMAND ${COMMAND_ARGS}
+    ${COMMAND_ECHO}
+    RESULT_VARIABLE EXIT_CODE
+)
+if(NOT EXIT_CODE EQUAL 0)
+    message(FATAL_ERROR
+        \"Running ${COMMAND_ARGS} failed with exit code \${EXIT_CODE}.\")
+endif()
+")
+endfunction()

cmake/MacOSCodesign.cmake.in

@@ -0,0 +1,101 @@
+#  Copyright (C) 2025 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+# CPACK_PACKAGE_FILES is set only during POST_BUILD
+if(NOT CPACK_PACKAGE_FILES)     # PRE_BUILD: Sign binaries
+
+    set(PROGNAME "@PROGNAME@")
+    set(CODESIGN_IDENTITY "@WITH_XC_CODESIGN_IDENTITY@")
+    set(ENTITLEMENTS @MACOSX_BUNDLE_APPLE_ENTITLEMENTS@)
+    set(APP_DIR "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/ALL_IN_ONE/${PROGNAME}.app")
+
+    if(NOT CODESIGN_IDENTITY)
+        message(FATAL_ERROR "No codesign identity specified.")
+    endif()
+
+    message(STATUS "Codesign identity used: ${CODESIGN_IDENTITY}")
+    message(STATUS "Signing ${PROGNAME}.app, this may take while...")
+
+    # Sign all binaries
+    execute_process(
+        COMMAND xcrun codesign --sign=${CODESIGN_IDENTITY} --force --options=runtime --deep "${APP_DIR}"
+        RESULT_VARIABLE SIGN_RESULT
+        OUTPUT_VARIABLE SIGN_OUTPUT
+        ERROR_VARIABLE SIGN_ERROR
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_STRIP_TRAILING_WHITESPACE
+        ECHO_OUTPUT_VARIABLE
+    )
+    if (NOT SIGN_RESULT EQUAL 0)
+        message(FATAL_ERROR "Signing binaries failed: ${SIGN_ERROR}")
+    endif()
+
+    # (Re-)Sign main executable with --entitlements
+    execute_process(
+        COMMAND xcrun codesign --sign=${CODESIGN_IDENTITY} --force --options=runtime --entitlements=${ENTITLEMENTS} "${APP_DIR}/Contents/MacOS/${PROGNAME}"
+        RESULT_VARIABLE SIGN_RESULT
+        OUTPUT_VARIABLE SIGN_OUTPUT
+        ERROR_VARIABLE SIGN_ERROR
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_STRIP_TRAILING_WHITESPACE
+        ECHO_OUTPUT_VARIABLE
+    )
+    if (NOT SIGN_RESULT EQUAL 0)
+        message(FATAL_ERROR "Signing main binary failed: ${SIGN_ERROR}")
+    endif()
+
+    message(STATUS "${PROGNAME}.app signed successfully.")
+
+else()       # POST_BUILD: Notarize DMG
+    set(KEYCHAIN_PROFILE "@WITH_XC_NOTARY_KEYCHAIN_PROFILE@")
+    if(NOT KEYCHAIN_PROFILE)
+        message(FATAL_ERROR "No notarization credentials keychain profile specified.")
+    endif()
+
+    foreach(DMG_FILE ${CPACK_PACKAGE_FILES})
+        # Submit for notarization
+        message(STATUS "Submitting DMG bundle for notarization, this may take while...")
+        execute_process(
+                COMMAND xcrun notarytool submit --keychain-profile=${KEYCHAIN_PROFILE} --wait "${DMG_FILE}"
+                RESULT_VARIABLE NOTARIZE_RESULT
+                OUTPUT_VARIABLE NOTARIZE_OUTPUT
+                ERROR_VARIABLE NOTARIZE_ERROR
+                OUTPUT_STRIP_TRAILING_WHITESPACE
+                ERROR_STRIP_TRAILING_WHITESPACE
+                ECHO_OUTPUT_VARIABLE
+        )
+        if (NOT NOTARIZE_RESULT EQUAL 0)
+            message(FATAL_ERROR "Notarization failed: ${NOTARIZE_ERROR}")
+        endif()
+        message(STATUS "DMG bundle notarized successfully.")
+
+        # Staple tickets
+        message(STATUS "Stapling notarization ticket...")
+        execute_process(
+                COMMAND xcrun stapler staple "${DMG_FILE}" && xcrun stapler validate "${DMG_FILE}"
+                RESULT_VARIABLE STAPLE_RESULT
+                OUTPUT_VARIABLE STAPLE_OUTPUT
+                ERROR_VARIABLE STAPLE_ERROR
+                OUTPUT_STRIP_TRAILING_WHITESPACE
+                ERROR_STRIP_TRAILING_WHITESPACE
+                ECHO_OUTPUT_VARIABLE
+        )
+        if (NOT STAPLE_RESULT EQUAL 0)
+            message(FATAL_ERROR "Stapling failed: ${STAPLE_ERROR}")
+        endif()
+        message(STATUS "DMG bundle notarization ticket stapled successfully.")
+    endforeach()
+endif()

cmake/WindowsCodesign.cmake.in

@@ -0,0 +1,79 @@
+#  Copyright (C) 2025 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set(INSTALL_DIR ${CPACK_TEMPORARY_INSTALL_DIRECTORY})
+set(CODESIGN_IDENTITY @WITH_XC_CODESIGN_IDENTITY@)
+set(TIMESTAMP_URL @WITH_XC_CODESIGN_TIMESTAMP_URL@)
+
+if(CPACK_PACKAGE_FILES) 
+    # This variable is set only during POST_BUILD, reset SIGN_FILES first
+    set(SIGN_FILES "")
+    foreach(PACKAGE_FILE ${CPACK_PACKAGE_FILES})
+        # Check each package file to see if it can be signed
+        if(PACKAGE_FILE MATCHES "\\.msix?$" OR PACKAGE_FILE MATCHES "\\.exe$")
+            message(STATUS "Adding ${PACKAGE_FILE} for signature")
+            list(APPEND SIGN_FILES "${PACKAGE_FILE}")
+        endif()
+    endforeach()
+else()
+    # Setup portable zip file if building one
+    if(INSTALL_DIR MATCHES "/ZIP/")
+        file(TOUCH "${INSTALL_DIR}/.portable")
+        message(STATUS "Injected portable marker into ZIP file.")
+    endif()
+
+    # Find all dll and exe files in the install directory
+    file(GLOB_RECURSE SIGN_FILES
+            RELATIVE "${INSTALL_DIR}"
+            "${INSTALL_DIR}/*.dll"
+            "${INSTALL_DIR}/*.exe"
+    )
+endif()
+
+# Sign relevant binaries if requested
+if(CODESIGN_IDENTITY AND SIGN_FILES)
+    # Find signtool in PATH or error out
+    find_program(SIGNTOOL signtool.exe QUIET)
+    if(NOT SIGNTOOL)
+        message(FATAL_ERROR "signtool.exe not found in PATH, correct or unset WITH_XC_CODESIGN_IDENTITY")
+    endif()
+
+    # Check that a certificate thumbprint was provided or error out
+    if(CODESIGN_IDENTITY STREQUAL "auto")
+        message(STATUS "Signing using best available certificate.")
+        set(CERT_OPTS /a)
+    else ()
+        message(STATUS "Signing using certificate with fingerprint ${CODESIGN_IDENTITY}.")
+        set(CERT_OPTS /sha1 ${CODESIGN_IDENTITY})
+    endif()
+
+    message(STATUS "Signing binary files, this may take a while...")
+    # Use cmd /c to enable pop-up for pin entry if needed
+    execute_process(
+            COMMAND cmd /c ${SIGNTOOL} sign /fd SHA256 ${CERT_OPTS} /tr ${TIMESTAMP_URL} /td SHA256 /d ${CPACK_PACKAGE_FILE_NAME} ${SIGN_FILES}
+            WORKING_DIRECTORY "${INSTALL_DIR}"
+            RESULT_VARIABLE SIGN_RESULT
+            OUTPUT_VARIABLE SIGN_OUTPUT
+            ERROR_VARIABLE SIGN_ERROR
+            OUTPUT_STRIP_TRAILING_WHITESPACE
+            ERROR_STRIP_TRAILING_WHITESPACE
+            ECHO_OUTPUT_VARIABLE
+    )
+    if(NOT SIGN_RESULT EQUAL 0)
+        message(FATAL_ERROR "Signing binary files failed: ${SIGN_ERROR}")
+    endif()
+
+    message(STATUS "Binary files signed successfully.")
+endif()

cmake/compiler-checks/macos/control_biometry_support.mm

@@ -0,0 +1,5 @@
+#include <Security/Security.h>
+
+int main() {
+   return static_cast<int>(kSecAccessControlBiometryCurrentSet);
+}

cmake/compiler-checks/macos/control_touch_id_support.mm

@@ -0,0 +1,5 @@
+#include <Security/Security.h>
+
+int main() {
+   return static_cast<int>(kSecAccessControlTouchIDCurrentSet);
+}

cmake/compiler-checks/macos/control_watch_support.mm

@@ -0,0 +1,5 @@
+#include <Security/Security.h>
+
+int main() {
+   return static_cast<int>(kSecAccessControlWatch);
+}

codecov.yaml

@@ -0,0 +1,27 @@
+codecov:
+  require_ci_to_pass: false
+coverage:
+  range: 60..80
+  round: nearest
+  precision: 2
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 0.5%
+        paths:
+          - "src"
+    patch:
+      default:
+        target: 50%
+        threshold: 0%
+        informational: true
+        paths:
+          - "src"
+fixes:
+  - "*/src/::"
+ignore:
+  - "src/gui/styles/**"
+  - "src/thirdparty/**"
+comment:
+  require_changes: true

docs/CMakeLists.txt

@@ -0,0 +1,60 @@
+#  Copyright (C) 2020 KeePassXC Team <team@keepassxc.org>
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 2 or (at your option)
+#  version 3 of the License.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+find_program(ASCIIDOCTOR_EXE asciidoctor)
+if(NOT ASCIIDOCTOR_EXE)
+    message(FATAL_ERROR "asciidoctor is required to build documentation")
+endif()
+message(STATUS "Using asciidoctor: ${ASCIIDOCTOR_EXE}")
+
+set(DOC_DIR ${CMAKE_CURRENT_SOURCE_DIR})
+set(OUT_DIR ${CMAKE_CURRENT_BINARY_DIR})
+set(REV -a revnumber=${KEEPASSXC_VERSION})
+
+# Build html documentation on all platforms
+# NOTE: Combine into one long command to prevent MSVC from failing to build all docs
+file(GLOB doc_depends ${DOC_DIR}/*.adoc ${DOC_DIR}/topics/* ${DOC_DIR}/styles/* ${DOC_DIR}/images/*)
+add_custom_command(
+    OUTPUT KeePassXC_GettingStarted.html KeePassXC_UserGuide.html KeePassXC_KeyboardShortcuts.html
+    COMMAND
+        ${ASCIIDOCTOR_EXE} -D ${OUT_DIR} -o KeePassXC_GettingStarted.html ${REV} ${DOC_DIR}/GettingStarted.adoc &&
+        ${ASCIIDOCTOR_EXE} -D ${OUT_DIR} -o KeePassXC_UserGuide.html ${REV} ${DOC_DIR}/UserGuide.adoc &&
+        ${ASCIIDOCTOR_EXE} -D ${OUT_DIR} -o KeePassXC_KeyboardShortcuts.html ${REV} ${DOC_DIR}/topics/KeyboardShortcuts.adoc
+    DEPENDS ${doc_depends}
+    VERBATIM)
+
+add_custom_target(docs ALL DEPENDS KeePassXC_GettingStarted.html KeePassXC_UserGuide.html KeePassXC_KeyboardShortcuts.html)
+
+install(FILES
+        ${OUT_DIR}/KeePassXC_GettingStarted.html
+        ${OUT_DIR}/KeePassXC_UserGuide.html
+        ${OUT_DIR}/KeePassXC_KeyboardShortcuts.html
+        DESTINATION ${DATA_INSTALL_DIR}/docs)
+
+# Build Man Pages on Linux and macOS
+if(UNIX)
+    add_custom_command(OUTPUT keepassxc.1 keepassxc-cli.1
+        COMMAND ${ASCIIDOCTOR_EXE} -D ${OUT_DIR} -b manpage ${REV} ./man/keepassxc.1.adoc
+        COMMAND ${ASCIIDOCTOR_EXE} -D ${OUT_DIR} -b manpage ${REV} ./man/keepassxc-cli.1.adoc
+        DEPENDS ${DOC_DIR}/man/keepassxc.1.adoc ${DOC_DIR}/man/keepassxc-cli.1.adoc
+        WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+        VERBATIM)
+    add_custom_target(manpages ALL DEPENDS keepassxc.1 keepassxc-cli.1)
+
+    install(FILES
+        ${OUT_DIR}/keepassxc.1
+        ${OUT_DIR}/keepassxc-cli.1
+        DESTINATION ${CMAKE_INSTALL_MANDIR}/man1/)
+endif()

docs/GettingStarted.adoc

@@ -0,0 +1,34 @@
+= KeePassXC: Getting Started Guide
+KeePassXC Team <team@keepassxc.org>
+:data-uri:
+:linkcss!:
+:homepage: https://keepassxc.org
+:icons: font
+:imagesdir: images
+:stylesheet: styles/dark.css
+:toc: left
+:experimental:
+ifdef::backend-pdf[]
+:title-page:
+:title-logo-image: {imagesdir}/kpxc_logo.png
+:pdf-theme: styles/pdf_theme.yml
+:compress:
+endif::[]
+
+include::topics/Disclaimers.adoc[]
+
+<<<
+
+// Include various topics, excluding advanced sections
+
+include::topics/Welcome.adoc[tags=*;!advanced]
+
+include::topics/DownloadInstall.adoc[tags=*;!advanced]
+
+include::topics/UserInterface.adoc[tags=*;!advanced]
+
+include::topics/DatabaseOperations.adoc[tags=*;!advanced]
+
+include::topics/PasswordGenerator.adoc[tags=*;!advanced]
+
+include::topics/BrowserIntegration.adoc[tags=*;!advanced]

docs/QUICKSTART.md

@@ -1,47 +0,0 @@
-# Quick Start for KeePassXC
-
-This procedure gets KeePassXC running on your computer with browser integration, 
-using the pre-built binaries available for [download](https://keepassxc.org/download) 
-from [KeePassXC site](https://keepassxc.org).
-
-**TL;DR** KeePassXC saves your passwords securely.
-When you double-click a URL in KeePassXC, it launches your default browser to that URL.
-With browser integration configured, KeePassXC automatically enters 
-username/password credentials into web page fields.
-
-## Installing and Starting KeePassXC
-
-* [Download the native installer](https://keepassxc.org/download) and install 
-KeePassXC for your  Windows, macOS, or Linux computer in the usual way for your platform.
-* Open the KeePassXC application.
-* Create a new database and give it a master key that's used to unlock the database file. 
-This database holds entries (usernames, passwords, account numbers, notes) 
-for all your websites, programs, etc.
-* Create a few entries - enter the username, password, URL, and optionally notes about the entry.
-* KeePassXC securely stores those entries in the database.
-
-
-## Setting up Browser Integration with KeePassXC
-
-* *Within KeePassXC*, go to **Tools->Settings** (on macOS, go to **KeePassXC->Preferences**.) 
-* In **Browser Integration**, check **Enable KeePassHTTP server**
-Leave the other options at their defaults.
-* *In your default web browser,* install the KeePassHTTP-Connector extension/add-on. Instructions for [Firefox](https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-connector/?src=api) or [Chrome](https://chrome.google.com/webstore/detail/keepasshttp-connector/dafgdjggglmmknipkhngniifhplpcldb?utm_source=chrome-app-launcher-info-dialog) 
-* Click the KeePassXC icon in the upper-right corner. You'll see the dialog below. 
-* Click the blue Connect button to make the browser extension connect to the KeePassXC application. 
-<img src="./KeePassXC-Connect.png" height="200" alt="KeePassXC Connect dialog">
-
-* *Switch back to KeePassXC.* You'll see a dialog (below) indicating that a request to connect has arrived. 
-* Give the connection a name (perhaps *Keepass-Browsername*, any unique name will suffice) and click OK to accept it.
-* This one-time operation connects KeePassXC and your browser.
-<img src="./KeePassXC-Accept-Button.png" height="200" alt="KeePassXC accept connection dialog">
-
-## Using Browser Integration
-
-* *Within KeePassXC,* double-click the URL of an entry,
-or select it and type Ctrl+U (Cmd+U on macOS).
-* Your browser opens to that URL.
-* If there are username/password fields on that page, you will see the dialog below.
-Click *Allow* to confirm that KeePassXC may access the credentials to auto-fill the fields. 
-* Check *Remember this decision* to allow this each time you visit the page.
-<img src="./KeePassXC-Confirm.png" height="200" alt="KeePassCX Confirm Access dialog">

docs/UserGuide.adoc

@@ -0,0 +1,44 @@
+= KeePassXC: User Guide
+KeePassXC Team <team@keepassxc.org>
+:data-uri:
+:homepage: https://keepassxc.org
+:icons: font
+:imagesdir: images
+:stylesheet: styles/dark.css
+:toc: left
+:sectanchors:
+:experimental:
+ifdef::backend-pdf[]
+:title-page:
+:title-logo-image: {imagesdir}/kpxc_logo.png
+:pdf-theme: styles/pdf_theme.yml
+:compress:
+endif::[]
+
+include::topics/Disclaimers.adoc[]
+
+<<<
+
+// Include feature topics and advanced sections
+
+include::topics/UserInterface.adoc[tags=*]
+
+include::topics/DatabaseOperations.adoc[tags=*]
+
+include::topics/PasswordGenerator.adoc[tags=*]
+
+include::topics/ImportExport.adoc[tags=*]
+
+include::topics/KeeShare.adoc[tags=*]
+
+include::topics/BrowserIntegration.adoc[tags=*]
+
+include::topics/Passkeys.adoc[tags=*]
+
+include::topics/AutoType.adoc[tags=*]
+
+include::topics/SecretService.adoc[tags=*]
+
+include::topics/SSHAgent.adoc[tags=*]
+
+include::topics/Reference.adoc[tags=*]