Yopass 16.1.0

Please try jhaals/yopass:next

This release adds a new Yopass server image: jhaals/yopass:next. It's a rewrite of the server that is faster, uses less memory and has much broader test coverage than the current one. It is planned to become the default in a future release, so I'd strongly encourage you to try it now.

It should work as a drop-in replacement for existing installations. It serves the same frontend, accepts the same flags and environment variables, and reads and writes the same data format in Memcached, Redis, Valkey, disk and S3. Both servers can run against the same backend at once, and one-time secrets stay one-time across them. That means you can run :next next to your current deployment, or switch to it and back again, without migrating anything.

docker run -p 1337:1337 -e MEMCACHED=memcached:11211 jhaals/yopass:next
docker run -p 1337:1337 -e DATABASE=redis -e REDIS=redis://redis:6379/0 jhaals/yopass:next

If you want a fixed build instead of a moving tag, use next-16.1.0.

It would be very helpful if you could try it in your environment and open an issue for anything that behaves differently or breaks. Reports from real deployments are what will get it ready to become the default. That includes your proxy setup, OIDC provider, S3-compatible storage and Sentinel clusters.

A few differences you might notice on purpose:

• If the database is unreachable, secret lookups return 503 rather than 404, so an outage no longer looks like a link that was already used.
• Session cookies use a different format. Users who switch between the two servers have to log in again.
• Parsing is stricter. For example, --trusted-proxies only accepts IPs or CIDRs.

The full list is in server/README.md. jhaals/yopass:latest and the version tags still use the current Go server, which has not changed.

New command-line client

The yopass CLI attached to this release is a rewrite. It has the same flags and works with the same messages as the website and the old CLI, so links created by either one open in the other. It is tested against the old CLI in every sender and receiver pairing, and against messages created by OpenPGP.js and GnuPG.

On Linux and macOS, install it with:

curl -fsSL https://raw.githubusercontent.com/jhaals/yopass/master/install.sh | sh

The script verifies the checksum before installing to ~/.local/bin. Prebuilt binaries for Linux, macOS and Windows (amd64 and arm64) are attached below, with checksums and build provenance attestations. The old Go CLI is still in the repository under cmd/yopass if you need it.

New

• Redis Sentinel support. Add master_name to your --redis URL and Yopass finds the primary through Sentinel and follows it through failovers. List extra Sentinels with repeated addr parameters. See the Redis Sentinel guide. (#4090)
• Notes on secret requests. People asking for a secret can add an optional plaintext note, for example "the staging DB password", for the responder to see. The default length limit is 1000 characters and you can change it with --max-request-note-length. Setting it to 0 turns notes off. Anyone with the link can read the note, so don't put sensitive information in it. The responder page is also simpler now and only shows branding and settings. (#4096)
• AWS Lambda / CDK: set the default expiry with DEFAULT_EXPIRY. A MAX_LENGTH of zero or less is now rejected at startup. (#4094)

Fixes

• The Docker Compose examples now declare their service dependencies. Thanks @AlekseyLapunov! (#4112)