GpgFrontend Files

GpgFrontend v2.2.0-beta.1 is the first preview release of the 2.2 mainline series, introducing a multi-engine OpenPGP architecture.

Warning: Internal cryptographic helpers have migrated from OpenSSL to libsodium. This may cause incompatibility with some application-managed encrypted data, such as specific app settings or cached data, created by earlier versions. This does not affect standard OpenPGP messages, signatures, encrypted files, or GnuPG-managed keyrings.

Highlights

• Multi-Engine Support: Introduced an experimental Rust-based rPGP backend alongside GnuPG. GnuPG remains the recommended default engine, while rPGP can be selected for supported key databases and used as a fallback when GnuPG is unavailable.
• Modern Standards: Added early support for OpenPGP v6, experimental post-quantum signature algorithms such as ML-DSA and SLH-DSA in the rPGP engine, and hybrid key generation with improved version-aware algorithm filtering.
• Key Database Management: Added support for multiple key databases with per-database engine selection.
• macOS Sandbox: Added the foundation for macOS sandbox support and GpgFrontend Lite, including sandbox-aware path handling and automatic hiding of unsupported GnuPG-specific options.
• Enhanced Security: Internal utilities for hashing, HMAC, random generation, password hashing, and key derivation now use libsodium.

Improvements

• rPGP Backend: The experimental rPGP backend now supports common OpenPGP workflows, including text and file encryption/decryption, signing/verification, symmetric encryption, directory encryption/decryption, key import/export, key generation, UID operations, subkey operations, passphrase changes, and revocation certificate generation/import where supported.
• Key Generation: Improved OpenPGP v6, PQC, and hybrid key generation dialogs with second-algorithm selection, clearer labels, stricter validation, and safer filtering of invalid key/subkey combinations.
• File Management: Enhanced the file browser with better path handling, mounted volume support, drag-and-drop move/copy behavior, refresh, copy-path, Trash, create, and rename actions.
• Editor Recovery: Improved session recovery for unsaved tabs. Saved or intentionally closed tabs are no longer restored incorrectly, while unsaved restored tabs remain recoverable after repeated crashes.
• Passphrase Handling: Improved passphrase prompts and retry flows, including confirmation for newly entered passwords, stricter empty-input checks, and better invalid-password cache behavior.
• Diagnostics: Added an in-app log viewer with configurable filtering, clearer startup diagnostics, active engine information, and engine/version details in operation reports.
• User Interface: Refined the About dialog, startup wizard, loading dialog, status bar, key database labels, passphrase dialogs, and window geometry restoration in multi-monitor setups.
• Engine-Aware UI: Settings and key-management actions now hide unsupported options depending on the active engine, including GnuPG-only settings, owner-trust actions, OpenSSH export, network settings, and advanced controls.
• Signature Verification: When verifying signatures with missing public keys, GpgFrontend can now trigger module-based public-key lookup by fingerprint.
• Localization: Added Russian translation and refreshed existing translations for new multi-engine, key-generation, and settings UI strings.
• Database Architecture: GpgFrontend now creates gf_keydb.sqlite in key database directories. For rPGP databases, this SQLite database stores key material and metadata. For GnuPG databases, key material remains managed by GnuPG, while the SQLite database is used only for GpgFrontend-managed metadata and may be empty.

Bug Fixes

• Resolved UI crashes during asynchronous key imports.
• Fixed key merging, metadata lookup, disabled/revoked key state handling, and shutdown cleanup issues within the rPGP backend.
• Corrected logic where GnuPG-specific actions incorrectly appeared in sandboxed or rPGP contexts.
• Improved output-file handling for encryption/decryption operations, including safer temporary writes, corrected output names, and avoiding output display after failed operations.
• Fixed key generation edge cases involving ambiguous algorithm names, hybrid algorithm selection, invalid key lengths, and OpenPGP v6 Curve25519/X25519 mapping.
• Improved key identifier matching for fingerprints, key IDs, subkeys, and recipient/signing key selection.
• Fixed session recovery edge cases that could restore stale content or lose recoverable unsaved tabs.
• Improved Qt5/Qt6 compatibility, Windows/MinGW dependency detection, macOS code signing, sandbox packaging, and AppImage packaging.

New Experimental Algorithms

GpgFrontend v2.2.0-beta.1 adds experimental post-quantum and hybrid algorithm choices for OpenPGP v6 key generation.

Important: These algorithms are experimental. In particular, ML-DSA and SLH-DSA support is provided only by the experimental rPGP engine. Keys generated with these rPGP-only PQC signature algorithms are not currently interoperable with GnuPG in GpgFrontend. Do not use these keys when GnuPG interoperability is required.

rPGP-only PQC signature algorithms

• ML-DSA-65
• ML-DSA-87
• SLH-DSA-SHAKE-128S
• SLH-DSA-SHAKE-128F
• SLH-DSA-SHAKE-256S

rPGP-only hybrid PQC signature algorithms

• ML-DSA-65 + Ed25519
• ML-DSA-87 + Ed448

Upgrade Notes

• Stability: This is a beta release. Users requiring maximum stability should remain on the 2.1.x series.
• rPGP Status: The rPGP backend is experimental and does not yet provide full feature parity with GnuPG.
• Key Database: Existing GnuPG keyrings are not migrated into gf_keydb.sqlite. GnuPG remains responsible for GnuPG-managed key material.
• Dependencies: Build environments now require libsodium. OpenSSL is no longer used for GpgFrontend’s internal cryptographic helpers.