youpdated 0.1.0__tar.gz → 0.2.0__tar.gz

youpdated-0.2.0/CHANGELOG.md

@@ -0,0 +1,111 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] — 2026-08-19
+
+### Added
+
+- **Encryption at rest for the config and history** ([#5](https://github.com/Void1-1/youpdated/issues/5)).
+  `youpdated encrypt` (alias `set-encrypted`) converts an existing setup in place; `youpdated decrypt`
+  converts it back. Every command detects an encrypted setup on its own and asks for the passphrase
+  once, or reads it from `YOUPDATED_PASSPHRASE` for unattended runs.
+
+  Files are encrypted whole with AES-256-GCM under a scrypt-derived key (n=2¹⁶, r=8, p=1), with the
+  KDF parameters authenticated as additional data so they cannot be downgraded. Decryption happens
+  **in memory**: the config is parsed from a decrypted buffer and the SQLite database is
+  deserialized into an in-memory database and written back encrypted when the run ends, so no
+  plaintext copy is put on disk even mid-run. A read-only run leaves the file byte-for-byte alone.
+
+  Needs the `cryptography` package: `pip install 'youpdated[encryption]'`. Installs without it
+  behave exactly as before.
+
+- **`youpdated init --encrypt`** writes the starter config already encrypted, so a setup that is
+  meant to be private never has a plaintext config on disk at all — unlike `init` then `encrypt`,
+  which leaves the original blocks in free space.
+
+- **A proxy preflight.** When `privacy.proxy` is set, the proxy is checked before the run starts
+  and the run is refused with exit `1` if it is unreachable. `--test` reports it instead of
+  aborting.
+
+- **`youpdated.crypto` is a documented standalone module.** `from youpdated import crypto` gives
+  you the container directly; everything in its `__all__` is a supported surface. It stays an
+  optional *dependency* rather than a separate distribution on purpose: nothing in it imports
+  `cryptography` at module scope, so a plain install already pays nothing for it, and shipping the
+  container format apart from the code that reads it would risk version skew on files that are the
+  user's only copy.
+
+### Changed
+
+- **A dead proxy now stops the run instead of failing every target.** Requests already failed
+  closed (httpx routes everything through the proxy and never falls back to a direct connection)
+  but with Tor off, a run would fail each target separately, record an empty baseline, and still
+  exit `0`. In a cron log that is indistinguishable from "nothing new". It now exits `1` before the
+  state database is even opened, so nothing is recorded.
+
+### Fixed
+
+- **A broken SOCKS handshake escaped the retry path.** `socksio` raises `ProtocolError`, which is
+  not an `httpx.HTTPError`, so a proxy port answering with something that is not SOCKS5 bypassed
+  the retries and surfaced as a raw exception rather than a `FetchError`. The client now treats
+  `SOCKSError` as a network error like any other.
+
+- **`tests/test_cleanup.py` could delete a real `./youpdated.yaml`.** The fixture redirected the
+  config and data directories but not the working directory, so `find_traces()` picked up the
+  project config of whoever ran the suite from a directory that had one, and `remove_traces()`
+  deleted it. The fixture now chdirs to the temp directory.
+
+## [0.1.1] — 2026-08-18
+
+### Fixed
+
+- **`browser` / Brave: a server error killed the target instead of falling back.** The Brave source
+  reads the GitHub REST API and keeps the `.atom` feed as a fallback, but only a 403 or 429 reached
+  it. A 5xx: a timeout, or a DNS failure, was retried, then raised, and the whole target was
+  reported as failed. Observed against `api.github.com` returning 504. Any failure the HTTP client
+  gives up on now falls back to the atom feed; a genuine outage of *both* still reports an error.
+
+### Changed
+
+- Retry backoff is configurable on the HTTP client (`retry_backoff`), so the test suite no longer spends real seconds exercising retry paths. The suite went from ~4.9s to ~0.4s.
+
+### Added
+
+- A `release` workflow that publishes to PyPI via trusted publishing when a GitHub Release is
+  published, gated on the full 13-job test matrix and on the tag matching the version in
+  `pyproject.toml`.
+
+## [0.1.0] — 2026-08-18
+
+First release.
+
+### Added
+
+- **Seven sources**, all working without accounts or API keys:
+  - `github` — releases, tags, and commits via `.atom` feeds
+  - `npm` — newly published versions from public registry
+  - `steam` — patch notes and news; resolves the store name from a bare appid
+  - `itch` — devlog posts and new builds, fingerprinted from the game page
+  - `youtube` — channels and playlists, with Invidious and Data API fallback
+  - `browser` — Chrome, Brave, Firefox, and Edge releases across platforms and channels
+  - `feed` — any RSS/Atom URL, for apps without a dedicated source
+- **Plugin architecture**: sources register in-tree with `@register` or ship from a third-party package through a `youpdated.sources` entry point.
+- **Config**: every source entry takes a bare value for the common case or a
+  mapping for advanced options
+- **Incremental reporting**: a SQLite history so each run reports what changed. First run records a baseline.
+- **Three output formats**: terminal report, `--json`, and `--rss`
+- **Privacy controls**: optional SOCKS/HTTP proxy covering every request, user-agent rotation, per-host request pacing with jitter, per-request cookie clearing, and conditional GETs. `--test` prints URLs without sending
+- **`youpdated uninstall`** to remove every file from the tool. Refuses directories it didn't create or have other files.
+
+### Known issues
+
+- YouTube's RSS endpoint throttles occassionaly and 404s valid URLs; fallback covers, but a run can still fail all three. Retry or set `privacy.proxy`.
+- Some itch games publish no "Updated" timestamp, so build updates are reported undated.
+- Firefox publishes current versions, so it reports one item per channel.
+- Edge exposes release notes only for the stable and beta channels. (But like, it's Edge, why do you want to know when it updates?)
+
+[0.2.0]: https://github.com/Void1-1/youpdated/releases/tag/v0.2.0
+[0.1.1]: https://github.com/Void1-1/youpdated/releases/tag/v0.1.1
+[0.1.0]: https://github.com/Void1-1/youpdated/releases/tag/v0.1.0

{youpdated-0.1.0 → youpdated-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: youpdated
-Version: 0.1.0
+Version: 0.2.0
 Summary: Simple update tracker for games, apps, and packages
 Author-email: Void1-1 <161782542+Void1-1@users.noreply.github.com>
 License-Expression: MIT
@@ -32,9 +32,12 @@ Requires-Dist: feedparser>=6.0
 Requires-Dist: rich>=13.0
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: platformdirs>=4.0
+Provides-Extra: encryption
+Requires-Dist: cryptography>=42.0; extra == "encryption"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: respx>=0.21; extra == "dev"
+Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: publish
 Requires-Dist: build>=1.2; extra == "publish"
 Requires-Dist: twine>=5.0; extra == "publish"
@@ -99,7 +102,7 @@ it on your `PATH`:
 
 ```sh
 export PATH="$PWD/.venv/bin:$PATH"           # macOS / Linux
-youpdated --version                          # -> youpdated 0.1.0
+youpdated --version                          # -> youpdated 0.2.0
 ```
 
 ```powershell
@@ -261,6 +264,9 @@ youpdated check -v                    # show each request, its status, and item
 youpdated check --state ./test.db     # use a throwaway history file
 youpdated sources                     # list available sources
 youpdated init --force                # rewrite the starter config
+youpdated init --encrypt              # starter config written encrypted from the start
+youpdated encrypt                     # lock the config and history behind a passphrase
+youpdated decrypt                     # convert them back to plain files
 youpdated uninstall --test            # list every file the tool wrote
 ```
 
@@ -272,7 +278,7 @@ Running `youpdated` with no arguments runs `youpdated check`.
 youpdated check --json | jq '.updates[] | select(.source == "github") | .title'
 ```
 
-Exit codes: `0` success, `1` config error, `2` with `--fail-on-error` when a source failed, `130` on interrupt.
+Exit codes: `0` success, `1` config, encryption, or proxy error, `2` with `--fail-on-error` when a source failed, `130` on interrupt.
 
 ## Running it on schedule
 
@@ -323,6 +329,12 @@ Once a day is plenty, most of these sources change slowly, and conditional reque
 | Everything reports as new again | The history database was deleted or `--state` points somewhere new. |
 | `youpdated: command not found` | The virtualenv isn't on your `PATH`. Use `.venv/bin/youpdated`. |
 | `ModuleNotFoundError: youpdated` | You used `pip install -e .` on MacOS |
+| `Encryption error: wrong passphrase, or the file has been modified` | The passphrase doesn't match, or the file was edited or truncated. Nothing is written on a failed unlock. |
+| `Encryption error: ... no terminal to ask on` | A cron or piped run can't prompt. Set `YOUPDATED_PASSPHRASE`. |
+| `encryption needs the cryptography package` | `pip install 'youpdated[encryption]'`. |
+| `... is not encrypted, but a passphrase was given` | A half-converted setup. Re-run `youpdated encrypt` to finish it. |
+| `Proxy error: cannot reach the proxy at ...` | `privacy.proxy` is set but nothing is listening. Start Tor (or your proxy), or remove the line. Nothing was fetched or recorded. |
+| Every source fails with `ProtocolError: Malformed reply` | Something is listening on the proxy port but isn't a SOCKS5 proxy. Check the port and scheme. |
 
 To start over from a clean slate, delete the history database (the path is in the table in [step 2](#2-create-your-config)); your config is untouched.
 
@@ -357,16 +369,107 @@ It prints the command to remove the package itself. (which it can't do while run
 
 If you installed into a dedicated virtualenv, deleting that directory removes the package too.
 
+## Encryption at rest
+
+By default the config and the history database are plain files. Anyone with your login, or your unencrypted backups, can read the list. To lock them behind a passphrase:
+
+```sh
+pip install 'youpdated[encryption]'   # pulls in `cryptography`; not needed otherwise
+youpdated encrypt                     # `set-encrypted` also works
+```
+
+Starting fresh, skip the plaintext step entirely. `init --encrypt` writes the starter config already encrypted, so it never exists in the clear at all:
+
+```sh
+youpdated init --encrypt
+```
+
+You can't edit in place: run `youpdated decrypt`, edit, then `youpdated encrypt` again. That does put the config on disk in plaintext while you work on it, so `init --encrypt` is rarely worth anything, or you edit before encrypting the first time.
+
+It asks for a passphrase twice and rewrites both files in place. From then on every command asks for it once, decrypts **into memory**, and writes back encrypted when the run ends.
+
+```sh
+youpdated check                       # Passphrase: ...
+youpdated decrypt                     # back to plain files
+```
+
+For cron and other unattended runs there is no terminal to ask on, so pass the passphrase in the environment instead:
+
+```cron
+0 9 * * * YOUPDATED_PASSPHRASE='...' /path/to/.venv/bin/youpdated check >> ~/youpdated.log 2>&1
+```
+
+That trades the passphrase's secrecy for the crontab's. Ensure it is more protected than your config was. Reading it from a file your shell sources, or from a keychain helper, is stronger.
+
+**What this does and does not protect.** Files are encrypted whole with AES-256-GCM under a key derived from the passphrase with scrypt (n=2¹⁶, r=8), and the tag is checked on every read, so a modified file is refused rather than trusted. It does **not** cover anything while Youpdated is running: the passphrase and the decrypted config are in the process's memory, and `YOUPDATED_PASSPHRASE` is visible to other processes of the same user. Nor does it erase the plaintext that was already on the disk. `encrypt` overwrites the file, but the old blocks may survive in free space until they are reused.
+
+**There is no recovery.** Don't forget your passphrase, or you'll have to recreate configs.
+
+| | Encrypted | Plain |
+| --- | --- | --- |
+| `youpdated check` | asks for the passphrase | runs |
+| `cat ~/.config/youpdated/config.yaml` | binary | readable |
+| `sqlite3 state.sqlite3 'select * from seen'` | `file is not a database` | readable |
+| File permissions | `0600` on macOS/Linux, see below on Windows | as created |
+
+**On Windows the file mode does nothing.** There are no POSIX permission bits, so the `0600` the
+writer asks for is ignored apart from the read-only flag, and access is decided by the ACL the file
+inherits from its directory. In the default location under `%LOCALAPPDATA%` that already excludes
+other standard users. The encryption itself is unaffected and works
+identically on all three platforms.
+
+### Using it as a module
+
+[youpdated/crypto.py](https://github.com/Void1-1/youpdated/blob/main/youpdated/crypto.py) stands alone.
+
+```python
+from youpdated import crypto
+
+blob = crypto.encrypt(b"anything", "passphrase")
+crypto.write_private("secret.bin", blob)          # atomic, 0600
+assert crypto.decrypt(blob, "passphrase") == b"anything"
+```
+
+Everything in `crypto.__all__` is supported, the container format included: `encrypt`, `decrypt`, `is_encrypted`, `is_encrypted_file`, `write_private`, `prompt_passphrase`, `available`, `require_backend`, `EncryptionError`, `MAGIC`, `VERSION`, `PASSPHRASE_ENV`. A `decrypt` on a file this version can't read raises rather than guessing, and `VERSION` is bumped if the layout ever changes.
+
+The same passphrase threads through the two core entry points, so you can drive an encrypted setup without the CLI:
+
+```python
+from youpdated.config import load_config
+from youpdated.state import State
+
+config = load_config("youpdated.yaml", passphrase="...")
+with State("state.sqlite3", passphrase="...") as state:
+    print(state.seen_count())
+```
+
+```sh
+$ python -c "from youpdated.cli import main; main(['sources'])" && python -c "
+import sys, youpdated.cli
+print('cryptography loaded:', any(m.startswith('cryptography') for m in sys.modules))"
+cryptography loaded: False
+```
+
+Don't use encryption with untrusted sources or non-official code without verifying security yourself!
+
 ## Privacy
 
 - **No credentials.** Every source works unauthenticated. `GITHUB_TOKEN` and `YOUTUBE_API_KEY` are read from the environment if set (only for raising rate limits) and are never written to config.
-- **Local only.** Config and history live in your platform's config/data directories. Nothing is sent anywhere except the sources you list.
+- **Local only.** Config and history live in your platform's config/data directories. Nothing is sent anywhere except the sources you list. They can be [encrypted at rest](#encryption-at-rest).
 - **One HTTP path.** Every request goes through [youpdated/http.py](https://github.com/Void1-1/youpdated/blob/main/youpdated/http.py). `privacy.proxy` covers all traffic. To check:
 
   ```sh
   youpdated check --all --no-save    # with privacy.proxy: socks5://127.0.0.1:9
   ```
 
+- **The proxy fails closed.** There is no direct fallback: if `privacy.proxy` is set and the proxy
+  is unreachable, requests error rather than going around it. Youpdated also checks the proxy is
+  up *before* the run starts and refuses with exit `1` if it isn't, so a run with Tor down can't
+  quietly report "nothing new" and record an empty baseline. `--test` reports the proxy as
+  unreachable instead of aborting, since it sends nothing either way.
+- **Hostnames are resolved by the proxy, not by you.** SOCKS5 CONNECT sends the domain name to the
+  proxy (`ATYP 3`), so your local resolver never sees which sites you watch. A proxied request with a locally-resolved hostname would leak the whole list to your DNS server.
+
 - **Cookies are discarded** on every request, so nothing accumulates across a run.
 - **Requests are paced** per host with random jitter instead of arriving in a burst.
 - **Conditional GETs** (ETag / Last-Modified) mean unchanged feeds are re-fetched cheaply, which is both faster and less fingerprintable. `--all` turns them off, since a 304 has no items.

{youpdated-0.1.0 → youpdated-0.2.0}/README.md

@@ -57,7 +57,7 @@ it on your `PATH`:
 
 ```sh
 export PATH="$PWD/.venv/bin:$PATH"           # macOS / Linux
-youpdated --version                          # -> youpdated 0.1.0
+youpdated --version                          # -> youpdated 0.2.0
 ```
 
 ```powershell
@@ -219,6 +219,9 @@ youpdated check -v                    # show each request, its status, and item
 youpdated check --state ./test.db     # use a throwaway history file
 youpdated sources                     # list available sources
 youpdated init --force                # rewrite the starter config
+youpdated init --encrypt              # starter config written encrypted from the start
+youpdated encrypt                     # lock the config and history behind a passphrase
+youpdated decrypt                     # convert them back to plain files
 youpdated uninstall --test            # list every file the tool wrote
 ```
 
@@ -230,7 +233,7 @@ Running `youpdated` with no arguments runs `youpdated check`.
 youpdated check --json | jq '.updates[] | select(.source == "github") | .title'
 ```
 
-Exit codes: `0` success, `1` config error, `2` with `--fail-on-error` when a source failed, `130` on interrupt.
+Exit codes: `0` success, `1` config, encryption, or proxy error, `2` with `--fail-on-error` when a source failed, `130` on interrupt.
 
 ## Running it on schedule
 
@@ -281,6 +284,12 @@ Once a day is plenty, most of these sources change slowly, and conditional reque
 | Everything reports as new again | The history database was deleted or `--state` points somewhere new. |
 | `youpdated: command not found` | The virtualenv isn't on your `PATH`. Use `.venv/bin/youpdated`. |
 | `ModuleNotFoundError: youpdated` | You used `pip install -e .` on MacOS |
+| `Encryption error: wrong passphrase, or the file has been modified` | The passphrase doesn't match, or the file was edited or truncated. Nothing is written on a failed unlock. |
+| `Encryption error: ... no terminal to ask on` | A cron or piped run can't prompt. Set `YOUPDATED_PASSPHRASE`. |
+| `encryption needs the cryptography package` | `pip install 'youpdated[encryption]'`. |
+| `... is not encrypted, but a passphrase was given` | A half-converted setup. Re-run `youpdated encrypt` to finish it. |
+| `Proxy error: cannot reach the proxy at ...` | `privacy.proxy` is set but nothing is listening. Start Tor (or your proxy), or remove the line. Nothing was fetched or recorded. |
+| Every source fails with `ProtocolError: Malformed reply` | Something is listening on the proxy port but isn't a SOCKS5 proxy. Check the port and scheme. |
 
 To start over from a clean slate, delete the history database (the path is in the table in [step 2](#2-create-your-config)); your config is untouched.
 
@@ -315,16 +324,107 @@ It prints the command to remove the package itself. (which it can't do while run
 
 If you installed into a dedicated virtualenv, deleting that directory removes the package too.
 
+## Encryption at rest
+
+By default the config and the history database are plain files. Anyone with your login, or your unencrypted backups, can read the list. To lock them behind a passphrase:
+
+```sh
+pip install 'youpdated[encryption]'   # pulls in `cryptography`; not needed otherwise
+youpdated encrypt                     # `set-encrypted` also works
+```
+
+Starting fresh, skip the plaintext step entirely. `init --encrypt` writes the starter config already encrypted, so it never exists in the clear at all:
+
+```sh
+youpdated init --encrypt
+```
+
+You can't edit in place: run `youpdated decrypt`, edit, then `youpdated encrypt` again. That does put the config on disk in plaintext while you work on it, so `init --encrypt` is rarely worth anything, or you edit before encrypting the first time.
+
+It asks for a passphrase twice and rewrites both files in place. From then on every command asks for it once, decrypts **into memory**, and writes back encrypted when the run ends.
+
+```sh
+youpdated check                       # Passphrase: ...
+youpdated decrypt                     # back to plain files
+```
+
+For cron and other unattended runs there is no terminal to ask on, so pass the passphrase in the environment instead:
+
+```cron
+0 9 * * * YOUPDATED_PASSPHRASE='...' /path/to/.venv/bin/youpdated check >> ~/youpdated.log 2>&1
+```
+
+That trades the passphrase's secrecy for the crontab's. Ensure it is more protected than your config was. Reading it from a file your shell sources, or from a keychain helper, is stronger.
+
+**What this does and does not protect.** Files are encrypted whole with AES-256-GCM under a key derived from the passphrase with scrypt (n=2¹⁶, r=8), and the tag is checked on every read, so a modified file is refused rather than trusted. It does **not** cover anything while Youpdated is running: the passphrase and the decrypted config are in the process's memory, and `YOUPDATED_PASSPHRASE` is visible to other processes of the same user. Nor does it erase the plaintext that was already on the disk. `encrypt` overwrites the file, but the old blocks may survive in free space until they are reused.
+
+**There is no recovery.** Don't forget your passphrase, or you'll have to recreate configs.
+
+| | Encrypted | Plain |
+| --- | --- | --- |
+| `youpdated check` | asks for the passphrase | runs |
+| `cat ~/.config/youpdated/config.yaml` | binary | readable |
+| `sqlite3 state.sqlite3 'select * from seen'` | `file is not a database` | readable |
+| File permissions | `0600` on macOS/Linux, see below on Windows | as created |
+
+**On Windows the file mode does nothing.** There are no POSIX permission bits, so the `0600` the
+writer asks for is ignored apart from the read-only flag, and access is decided by the ACL the file
+inherits from its directory. In the default location under `%LOCALAPPDATA%` that already excludes
+other standard users. The encryption itself is unaffected and works
+identically on all three platforms.
+
+### Using it as a module
+
+[youpdated/crypto.py](https://github.com/Void1-1/youpdated/blob/main/youpdated/crypto.py) stands alone.
+
+```python
+from youpdated import crypto
+
+blob = crypto.encrypt(b"anything", "passphrase")
+crypto.write_private("secret.bin", blob)          # atomic, 0600
+assert crypto.decrypt(blob, "passphrase") == b"anything"
+```
+
+Everything in `crypto.__all__` is supported, the container format included: `encrypt`, `decrypt`, `is_encrypted`, `is_encrypted_file`, `write_private`, `prompt_passphrase`, `available`, `require_backend`, `EncryptionError`, `MAGIC`, `VERSION`, `PASSPHRASE_ENV`. A `decrypt` on a file this version can't read raises rather than guessing, and `VERSION` is bumped if the layout ever changes.
+
+The same passphrase threads through the two core entry points, so you can drive an encrypted setup without the CLI:
+
+```python
+from youpdated.config import load_config
+from youpdated.state import State
+
+config = load_config("youpdated.yaml", passphrase="...")
+with State("state.sqlite3", passphrase="...") as state:
+    print(state.seen_count())
+```
+
+```sh
+$ python -c "from youpdated.cli import main; main(['sources'])" && python -c "
+import sys, youpdated.cli
+print('cryptography loaded:', any(m.startswith('cryptography') for m in sys.modules))"
+cryptography loaded: False
+```
+
+Don't use encryption with untrusted sources or non-official code without verifying security yourself!
+
 ## Privacy
 
 - **No credentials.** Every source works unauthenticated. `GITHUB_TOKEN` and `YOUTUBE_API_KEY` are read from the environment if set (only for raising rate limits) and are never written to config.
-- **Local only.** Config and history live in your platform's config/data directories. Nothing is sent anywhere except the sources you list.
+- **Local only.** Config and history live in your platform's config/data directories. Nothing is sent anywhere except the sources you list. They can be [encrypted at rest](#encryption-at-rest).
 - **One HTTP path.** Every request goes through [youpdated/http.py](https://github.com/Void1-1/youpdated/blob/main/youpdated/http.py). `privacy.proxy` covers all traffic. To check:
 
   ```sh
   youpdated check --all --no-save    # with privacy.proxy: socks5://127.0.0.1:9
   ```
 
+- **The proxy fails closed.** There is no direct fallback: if `privacy.proxy` is set and the proxy
+  is unreachable, requests error rather than going around it. Youpdated also checks the proxy is
+  up *before* the run starts and refuses with exit `1` if it isn't, so a run with Tor down can't
+  quietly report "nothing new" and record an empty baseline. `--test` reports the proxy as
+  unreachable instead of aborting, since it sends nothing either way.
+- **Hostnames are resolved by the proxy, not by you.** SOCKS5 CONNECT sends the domain name to the
+  proxy (`ATYP 3`), so your local resolver never sees which sites you watch. A proxied request with a locally-resolved hostname would leak the whole list to your DNS server.
+
 - **Cookies are discarded** on every request, so nothing accumulates across a run.
 - **Requests are paced** per host with random jitter instead of arriving in a burst.
 - **Conditional GETs** (ETag / Last-Modified) mean unchanged feeds are re-fetched cheaply, which is both faster and less fingerprintable. `--all` turns them off, since a 304 has no items.

{youpdated-0.1.0 → youpdated-0.2.0}/SECURITY.md

@@ -21,11 +21,18 @@ Youpdated is a local CLI that reads public endpoints. The interesting attack sur
 - **Privacy leaks.** Youpdated promises that when `privacy.proxy` is set, *every* request goes
   through it, and that nothing is sent anywhere except the configured sources. A path that bypasses
   the proxy, leaks the config or history off the machine, or attaches identifying data to requests
-  is a vulnerability, not just a bug.
+  is a vulnerability, not just a bug. This includes failing *open*: if the proxy is unreachable, no
+  request may fall back to a direct connection. It also includes resolving a watched hostname
+  locally instead of handing it to the proxy, which would leak the whole watch list to your DNS
+  resolver even though the requests themselves are proxied.
 - **Credential handling.** `GITHUB_TOKEN` and `YOUTUBE_API_KEY` are read from the environment and
   must never be written to disk, logged, or sent to any host other than the one they belong to.
 - **`youpdated uninstall`.** It deletes files. Any way to make it remove something outside its own
   config and data directories is in scope.
+- **Encryption at rest.** When the config or history is encrypted, the passphrase and the decrypted
+  contents must exist only in memory. Anything that writes plaintext to disk, logs the passphrase,
+  accepts a file whose authentication tag does not verify, or lets the KDF parameters be weakened
+  is in scope. So is a way to read an encrypted file's contents without the passphrase.
 
 ## What's out of scope
 
@@ -34,5 +41,16 @@ Youpdated is a local CLI that reads public endpoints. The interesting attack sur
 - Rate limiting or blocking by an upstream service (YouTube's feed does this intermittently by
   design: see the README).
 - Requiring a proxy or Tor to be running. Youpdated does not start or manage one.
+- Anything reachable while Youpdated is running with an unlocked setup: the passphrase is in the
+  process's memory by necessity, and `YOUPDATED_PASSPHRASE` is readable by other processes of the
+  same user. Encryption at rest protects the files, not a live session.
+- Plaintext left in free space by `youpdated encrypt`. It overwrites the file; recovering the old
+  blocks from the underlying device is out of scope, and not something a userspace tool can
+  reliably prevent on modern storage.
+- File permissions on Windows. The `0600` mode requested when writing is a POSIX concept; Windows
+  ignores it and applies the ACL inherited from the containing directory. The default
+  `%LOCALAPPDATA%` location is already user-scoped, but a `--config` or `--state` path in a shared
+  directory is not. Restricting an ACL needs `pywin32` or shelling out to `icacls`, which this
+  project does not depend on. The file contents stay encrypted either way.
 - Vulnerabilities in dependencies with no exploitable path through this code. Report those upstream;
   Dependabot tracks version bumps here.

{youpdated-0.1.0 → youpdated-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "youpdated"
-version = "0.1.0"
+version = "0.2.0"
 description = "Simple update tracker for games, apps, and packages"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -50,7 +50,8 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
-dev = ["pytest>=8.0", "respx>=0.21"]
+encryption = ["cryptography>=42.0"]
+dev = ["pytest>=8.0", "respx>=0.21", "cryptography>=42.0"]
 publish = ["build>=1.2", "twine>=5.0"]
 
 [project.urls]

{youpdated-0.1.0 → youpdated-0.2.0}/youpdated/__init__.py

@@ -1,3 +1,3 @@
 """Youpdated, a simple update tracker."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"