From fa37516f1cb35932d79efb9c702f9585881cc356 Mon Sep 17 00:00:00 2001 From: Simon Date: Fri, 11 Sep 2026 00:39:49 +0200 Subject: [PATCH 1/2] Switch the official website to KeeFetch 1.3 stable downloads --- eng/sync-site-profiles.py | 6 +++--- eng/test-site-browser.py | 5 ++++- eng/test-verify-site.py | 2 +- eng/verify-site.py | 2 +- site/DESIGN.md | 8 ++++---- site/PRODUCT.md | 4 ++-- site/README.md | 2 +- site/benchmarks.html | 4 ++-- site/contributing.html | 4 ++-- site/data/release.json | 17 ++++++++--------- site/getting-started.html | 12 ++++++------ site/index.html | 26 +++++++++++++------------- site/privacy.html | 4 ++-- site/profiles.html | 6 +++--- site/troubleshooting.html | 4 ++-- 15 files changed, 54 insertions(+), 52 deletions(-) diff --git a/eng/sync-site-profiles.py b/eng/sync-site-profiles.py index 3060dee..39023c5 100644 --- a/eng/sync-site-profiles.py +++ b/eng/sync-site-profiles.py @@ -24,7 +24,7 @@ def profile_markup(data): default = 'Default' if p['id'] == 'everyday' else '' evidence = f'https://github.com/tzii/KeeFetch/blob/{EVIDENCE_REF}/' + p['evidenceReport'] rows.append(f'{e(p["displayName"])}{default}{e(p["intendedUse"])}{e(chain)}{p["primaryTimeoutMs"]/1000:g} s primary / {p["fallbackTimeoutMs"]/1000:g} s fallback / {p["cumulativeTimeoutMs"]/1000:g} s total. {stop}.{e(disclosure)}Synthetic: {synth}. Android store lookup: {"Enabled" if p["allowAndroidStoreLookup"] else "Disabled"}.Study evidence') - return '
' + ''.join(rows) + '
Managed profiles in the source preview
ProfileIntended useProvider order and budgetsDisclosure and fallbacks
' + return '
' + ''.join(rows) + '
Managed fetch profiles
ProfileIntended useProvider order and budgetsDisclosure and fallbacks
' def profile_cards_markup(data): """Readable summary cards share the comparison table's catalog source.""" @@ -63,7 +63,7 @@ def profile_presets_markup(data): chain = ' → '.join(PROVIDERS[x] for x in p['providerIds']) policy = 'No favicon resolvers or Android store lookup. Site-linked hosts and redirects remain possible.' if p['id'] == 'privacy' else 'Enabled favicon resolvers may receive the entry’s domain.' panels.append(f'

{name}{" · Recommended" if p["id"] == "everyday" else ""}

{e(p["intendedUse"])}

{e(chain)} · {p["cumulativeTimeoutMs"]/1000:g} s total per-entry budget.

{policy} Synthetic fallbacks are disabled.

') - return '
' + ''.join(panels) + '
' + return '
' + ''.join(panels) + '
' def preview_profiles(site): @@ -85,7 +85,7 @@ def expected_pages(site): e = html.escape version = e(release['version']) blocks = { - 'RELEASE_STATUS': f'v{e(release["previewVersion"])} source preview · Stable download: v{version}', + 'RELEASE_STATUS': (f'v{e(release["previewVersion"])} source preview · ' if release.get('previewVersion') else '') + f'Stable download: v{version}', 'RELEASE_FOOTER': f'Stable v{version}', 'RELEASE_DOWNLOAD': f'Download PLGX · v{version}', 'PROFILE_FALLBACK': profile_markup(data), diff --git a/eng/test-site-browser.py b/eng/test-site-browser.py index 23aa34e..bdba2cf 100644 --- a/eng/test-site-browser.py +++ b/eng/test-site-browser.py @@ -62,6 +62,7 @@ def main() -> int: if args.axe and not args.axe.is_file(): parser.error('--axe must identify axe.min.js') args.output.mkdir(parents=True, exist_ok=True) + release = json.loads((args.site / 'data/release.json').read_text(encoding='utf-8-sig')) results = [] axe_runs = [] report = {'browser': args.browser, 'playwright': version('playwright'), 'cases': results, 'axe': axe_runs} @@ -277,7 +278,9 @@ def media(page, _context): assert image.get_attribute('alt') assert image.evaluate('e => e.closest("a").getAttribute("href") === e.getAttribute("src")') page.locator('.verification summary').click() - expect(page.locator('#checksum')).to_have_text('1fd7e12590bfc2d23ede93c1ae5e61de0662187321caccdfeeb0bbcb995f5275') + expect(page.locator('#checksum')).to_have_text(release['plgxSha256']) + expect(page.locator('.verification a')).to_have_attribute('href', release['plgxChecksumUrl']) + expect(page.locator('.install-intro .button')).to_have_attribute('href', release['plgxUrl']) case('genuine-media-and-stable-checksum', media, width=390, screenshot=True) def print_page(page, _context): diff --git a/eng/test-verify-site.py b/eng/test-verify-site.py index 8f69c38..9d632d7 100644 --- a/eng/test-verify-site.py +++ b/eng/test-verify-site.py @@ -57,7 +57,7 @@ def test_escaping_local_link(self): self.mutate('href="profiles.html"','href="../private.txt"'); self.assert_rejected('local link escapes site') def test_checksum_from_wrong_release(self): path=self.site/'data/release.json'; data=json.loads(path.read_text(encoding='utf-8')) - data['plgxChecksumUrl']=data['plgxChecksumUrl'].replace('/v1.2.0/', '/v0.0.0/') + data['plgxChecksumUrl']=data['plgxChecksumUrl'].replace('/'+data['tag']+'/', '/v0.0.0/') path.write_text(json.dumps(data),encoding='utf-8') self.assert_rejected('incorrect PLGX checksum URL') def test_malformed_checksum(self): diff --git a/eng/verify-site.py b/eng/verify-site.py index 5c98bed..8cfee6d 100644 --- a/eng/verify-site.py +++ b/eng/verify-site.py @@ -112,7 +112,7 @@ def fail(message): errors.append(f'{path.name}: {message}') errors.append('incorrect checksums URL') if release.get('plgxSha256') and not re.fullmatch(r'[0-9a-f]{64}', release['plgxSha256']): errors.append('invalid PLGX checksum') - if release.get('plgxChecksumUrl') not in (None,base+'download/'+release['tag']+'/KeeFetch.plgx.sha256'): + if release.get('plgxChecksumUrl') not in (None,base+'download/'+release['tag']+'/KeeFetch.plgx.sha256',base+'download/'+release['tag']+'/SHA256SUMS.txt'): errors.append('incorrect PLGX checksum URL') if bool(release.get('plgxSha256')) != bool(release.get('plgxChecksumUrl')): errors.append('PLGX checksum and source URL must be supplied together') diff --git a/site/DESIGN.md b/site/DESIGN.md index 18ffa40..23588a1 100644 --- a/site/DESIGN.md +++ b/site/DESIGN.md @@ -43,9 +43,9 @@ Keep keyboard targets at least 44px high, and preserve forced-color outlines. ## Product boundaries and checks -`data/release.json` owns stable URLs and the verified v1.2 PLGX checksum. -`data/profiles-v1.3.json` is the checksum-bound candidate export and owns the four upcoming v1.3 profile policies. Both the -release banner and profile/gallery descriptions disclose the preview status. +`data/release.json` owns stable URLs and the verified v1.3 PLGX checksum. +`data/profiles-v1.3.json` is the checksum-bound candidate export and owns the four stable v1.3 profile policies. Both the +release banner and profile/gallery descriptions identify the published release. Keep detailed study limitations on benchmarks.html and privacy caveats on privacy.html. Use local SVGs and retain their Simple Icons license files. @@ -55,4 +55,4 @@ Firefox and WebKit. Inspect real screenshots in light/dark, phone/desktop, 200% text and no-JavaScript modes. Retain axe incomplete findings as well as violations; automated passes are not full WCAG or physical-device certification. -The independent website publication keeps `data/profiles.json` tied to the compiled branch catalog. `data/profiles-v1.3.json` is the accepted 9f0b43f export; its source commit and hash are recorded in release.json. The website uses this frozen preview so publishing documentation does not change the plugin or weaken its export check. Update the snapshot deliberately with the next accepted candidate. +The independent website publication keeps `data/profiles.json` tied to the compiled branch catalog. `data/profiles-v1.3.json` is the accepted 9f0b43f export; its source commit and hash are recorded in release.json. The website retains this frozen release snapshot, which matches the compiled 1.3 catalog, so publishing documentation does not change the plugin or weaken its export check. Update the snapshot deliberately with the next accepted candidate. diff --git a/site/PRODUCT.md b/site/PRODUCT.md index 2ef867b..5efe80d 100644 --- a/site/PRODUCT.md +++ b/site/PRODUCT.md @@ -17,7 +17,7 @@ sample domains. Its before/after interaction is an explicitly labeled illustrati ## Product truth and boundaries -- The stable download is v1.2.0. The described v1.3.0 features are a source preview. +- The stable download is v1.3.0. The described features and screenshots match that release. `data/release.json` and the synchronizer own generated release links and labels. - `data/profiles-v1.3.json` is the checksum-bound candidate export and owns managed profile facts. Do not tune time budgets, providers, names or evidence as a design change. @@ -56,4 +56,4 @@ Automated browser checks and screenshots do not establish physical-device, screen-reader or native KeePass compatibility. Record which checks ran and keep those remaining acceptance checks explicit. -The independent website publication keeps `data/profiles.json` tied to the compiled branch catalog. `data/profiles-v1.3.json` is the accepted 9f0b43f export; its source commit and hash are recorded in release.json. The website uses this frozen preview so publishing documentation does not change the plugin or weaken its export check. Update the snapshot deliberately with the next accepted candidate. +The independent website publication keeps `data/profiles.json` tied to the compiled branch catalog. `data/profiles-v1.3.json` is the accepted 9f0b43f export; its source commit and hash are recorded in release.json. The website retains this frozen release snapshot, which matches the compiled 1.3 catalog, so publishing documentation does not change the plugin or weaken its export check. Update the snapshot deliberately with the next accepted candidate. diff --git a/site/README.md b/site/README.md index 8bf9af2..a9266b2 100644 --- a/site/README.md +++ b/site/README.md @@ -25,7 +25,7 @@ and builds the website, then deploys that directory when website changes reach Release links, profile summary cards and comparison tables are synchronized from `data/release.json` and `data/profiles.json` by `eng/sync-site-profiles.py`. Preserve the generated block markers. Run the synchronizer without `--check` -after changing those inputs. v1.2 is stable; v1.3 is a source preview. +after changing those inputs. v1.3 is stable; its published assets and checksums are linked throughout the site. The theme and motion controls save device-local preferences when storage is available. System reduced motion takes precedence. Content, primary navigation, diff --git a/site/benchmarks.html b/site/benchmarks.html index b99240c..d335a9a 100644 --- a/site/benchmarks.html +++ b/site/benchmarks.html @@ -8,7 +8,7 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0

KeeFetch / Benchmarks

Evidence behind the profiles.

KeeFetch provider study methods, corpus, machine-review provenance, limitations and reproduction.

Expanded study complete

The v1.3 source candidate uses a fresh 19-candidate comparison, including the full chain without Yandex. All 133 cells and 827 reviewed icon units passed validation. Four unresolved app identities remain ambiguous and receive zero usability credit under the owner's conservative-scoring decision.

@@ -17,5 +17,5 @@

What the numbers cannot promise

Network timing, provider behavior and website icons change. A census removes sampling error for its population, not reviewer judgment error. Results apply to the measured corpus and candidates, not every site. Candidate names containing “thorough” are experiment identifiers; the user-facing profile is Precise.

Interrupted partial cells were quarantined and rerun; no resumed latency was accepted. Collection used a shared developer machine. The strict ambiguity replay changed Precise's winner, so the owner explicitly chose conservative failure scoring. Fast, Balanced and Privacy remained stable across replay scenarios; Precise did not. The two leading precision candidates are close, and this result does not establish broad superiority.

Inspect and reproduce

Evidence links below point to the completed study snapshot, not an older report on the default branch.

Full study report · Public corpus · Harness and selector

powershell -NoProfile -ExecutionPolicy Bypass -File eng/benchmark-presets.ps1 -Experiment eng/benchmark/experiments/profile-candidates-v13-complete.json

Use the matching source revision, a built plugin and KeePass 2.60. A live run contacts the public fixtures and enabled providers. Preserve fingerprints and complete the census before selecting winners. The accepted selection uses -AmbiguityPolicy ConservativeFailure; the default selector still requires stable winners.

diff --git a/site/contributing.html b/site/contributing.html index d218089..e9d78e4 100644 --- a/site/contributing.html +++ b/site/contributing.html @@ -8,7 +8,7 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0

KeeFetch / Contributing

Make the next fetch better.

Build KeeFetch, run its offline tests, add providers and contribute documentation.

Build locally

Use the .NET SDK, .NET Framework 4.8 targeting pack and KeePass 2.60. Production remains C# 5 compatible because KeePass compiles PLGX through a legacy compiler. Tests use the project's separate language setting.

git clone https://github.com/tzii/KeeFetch.git
@@ -25,5 +25,5 @@
 
Keep the study reproducible
Managed profiles are generated from reviewed evidence. Do not hand-edit the generated catalog or reuse evidence after changing its binary, experiment, corpus or execution harness. Preserve actual machine-review provenance.

 
Package and propose
KeePass PLGX creation uses the legacy KeeFetch.plgx.csproj and all listed source/resources. Validate the resulting artifact in a disposable KeePass host. Explain the problem, resulting behavior and relevant tests in your pull request.
View pull requests
diff --git a/site/data/release.json b/site/data/release.json index 9c6a5d8..b085338 100644 --- a/site/data/release.json +++ b/site/data/release.json @@ -1,15 +1,14 @@ { "schema": 1, - "version": "1.2.0", - "tag": "v1.2.0", + "version": "1.3.0", + "tag": "v1.3.0", "status": "stable", - "previewVersion": "1.3.0", - "releaseUrl": "https://github.com/tzii/KeeFetch/releases/tag/v1.2.0", - "plgxUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.2.0/KeeFetch.plgx", - "dllUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.2.0/KeeFetch.dll", - "checksumsUrl": null, - "plgxSha256": "1fd7e12590bfc2d23ede93c1ae5e61de0662187321caccdfeeb0bbcb995f5275", - "plgxChecksumUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.2.0/KeeFetch.plgx.sha256", + "releaseUrl": "https://github.com/tzii/KeeFetch/releases/tag/v1.3.0", + "plgxUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.3.0/KeeFetch.plgx", + "dllUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.3.0/KeeFetch.dll", + "checksumsUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.3.0/SHA256SUMS.txt", + "plgxSha256": "4742355b5cadb089c7898b99d7a6ff95d068f8319ad97b3a1eb15b1d186a53a8", + "plgxChecksumUrl": "https://github.com/tzii/KeeFetch/releases/download/v1.3.0/SHA256SUMS.txt", "previewProfiles": { "file": "profiles-v1.3.json", "sourceCommit": "9f0b43f64335803d24ca99d6ccc7e0e7abac3bb8", diff --git a/site/getting-started.html b/site/getting-started.html index 15c0d42..8b214cc 100644 --- a/site/getting-started.html +++ b/site/getting-started.html @@ -8,15 +8,15 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0

KeeFetch / Getting started

Get your first icon.

Install, use, update, verify and roll back the KeeFetch plugin for KeePass.

Requirements

KeePass 2.x and .NET Framework 4.8. The release validation target is KeePass 2.60 on Windows. This plugin is for KeePass, not KeePassXC.

Install

  1. Download KeeFetch.plgx from the latest stable release.
  2. Close KeePass. Copy the plugin into the Plugins folder beside KeePass.exe. For a portable install this is KeePass/Plugins/; a typical installed path is %ProgramFiles%/KeePass Password Safe 2/Plugins/.
  3. Restart KeePass. Check Tools → Plugins and the Tools → KeeFetch menu.

Use one format: PLGX, or the release DLL. Do not install both copies.

-

First run

In the v1.3 preview, the first download asks you to choose a profile and explains third-party requests. Confirming saves the choice; Cancel leaves settings unchanged and aborts the download. Change your choice later under Tools → KeeFetch → Settings.

+

First run

In v1.3, the first download asks you to choose a profile and explains third-party requests. Confirming saves the choice; Cancel leaves settings unchanged and aborts the download. Change your choice later under Tools → KeeFetch → Settings.

Welcome to KeeFetch with Balanced recommended, its provider description, the privacy disclosure and Confirm and Continue button.
The first download starts with a profile choice. Select the screenshot to view it at full size.

Change your settings

Settings has Overview, Downloads, Providers and Advanced tabs. Save applies the draft; Cancel discards it.

-
KeeFetch Settings Overview tab with the Privacy profile selected and its description above Save and Cancel controls.
Overview in the v1.3 preview, with Privacy selected. Select the screenshot to view it at full size.
+
KeeFetch Settings Overview tab with the Privacy profile selected and its description above Save and Cancel controls.
Overview in v1.3, with Privacy selected. Select the screenshot to view it at full size.
KeeFetch Settings Providers tab with a checked provider list and Move up, Move down and Reset controls.
The Providers tab lets you edit the enabled providers and their order. Select the screenshot to view it at full size.

Single entry

Select an entry, open its context menu, and choose KeeFetch – Download Favicons. KeeFetch reads the URL and can use the title as a domain fallback if configured.

@@ -27,8 +27,8 @@

Change your settings

Settings has Overview, Downloads, Providers and

Update

Back up the database and KeePass configuration, close KeePass, replace the old plugin, and restart. Legacy Fast, Balanced and Thorough migrate to Fast, Balanced and Precise. Custom and unknown legacy values use Custom; verify your providers and timeouts after migration.

Uninstall

Close KeePass and remove KeeFetch from its Plugins folder. Downloaded icons stay in the database. KeeFetch configuration keys can remain in the KeePass configuration.

Roll back

Close KeePass, replace the plugin with the saved earlier version, then restore your backed-up configuration if settings changed. Restore the database backup if you need to undo icon changes. A plugin downgrade alone cannot undo them.

-

Verify release

Download artifacts from the repository's release page. Releases that include SHA256SUMS.txt allow you to compare the exact downloaded files:

Get-FileHash -Algorithm SHA256 ./KeeFetch.plgx
-Get-FileHash -Algorithm SHA256 ./KeeFetch.dll

Compare each hash with its matching filename in the release checksum file before installation. Checksum files are planned for v1.3; they are not advertised as a v1.2 asset.

+

Verify release

Download artifacts from the repository's release page. The v1.3 release includes SHA256SUMS.txt for both the PLGX and DLL:

Get-FileHash -Algorithm SHA256 ./KeeFetch.plgx
+Get-FileHash -Algorithm SHA256 ./KeeFetch.dll

Compare each hash with its matching filename in the release checksum file before installation.

diff --git a/site/index.html b/site/index.html index ac2e5a3..c4f2254 100644 --- a/site/index.html +++ b/site/index.html @@ -7,7 +7,7 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0
The small plugin with an eye for detail.Open source / MIT
@@ -21,7 +21,7 @@

Familiar icons.
Less searching.

Give your KeePass entries their website icons. Find better candidates, skip the duplicates, and make your vault easier to scan.

-Get KeeFetch v1.2.0 +Get KeeFetch v1.3.0 See it in KeePass

For KeePass 2.x on Windows · .NET Framework 4.8
Not compatible with KeePassXC.
Free plugin. No account to create.

Your providers, your choice.
See what fetching shares.

The icon workshop

Local illustration
@@ -114,33 +114,33 @@

Illustration, not a KeePass screenshot. No live requests.

-
Direct-site discovery Bulk fetching Duplicate detectionRead the documentation
+
Direct-site discovery Bulk fetching Duplicate detectionRead the documentation

01 / Built for your vault

Good icons. Less busywork.

The useful details, handled.
You have enough entries to look after.

Go straight to the source.

Read website icon declarations, touch icons and manifests before ranking the available candidates.

Better than a blurry shortcut.

Compare the available icon candidates, including the larger icons sites provide for mobile devices.

A whole group. One fetch.

Process entries and subgroups together. Concurrent requests and caching cut out repetitive work.

Android entries, included.

Map androidapp:// package names to web domains, with built-in mappings and an optional Play Store fallback. Privacy disables store lookup.

Keep the icon. Skip the copy.

SHA-256 checks detect duplicate icons, so entries can reuse what is already in your database.

You pick the providers.

Choose a managed profile, or use Custom to set providers, their order and synthetic fallbacks.

-

02 / Under the hood

From a URL to a familiar face

  1. Read the URL

    Start with an entry URL, reference, or mapped Android package.

  2. Find candidates

    Look for site icons and ask the enabled icon providers.

  3. Rank the results

    Compare candidate quality and trust, not just who replies first.

  4. Check duplicates

    Use a SHA-256 hash to avoid storing the same icon again.

  5. Save & apply

    Assign the icon to your entry and reuse cached results.

The provider path depends on your profile and settings.Explore the architecture
+

02 / Under the hood

From a URL to a familiar face

  1. Read the URL

    Start with an entry URL, reference, or mapped Android package.

  2. Find candidates

    Look for site icons and ask the enabled icon providers.

  3. Rank the results

    Compare candidate quality and trust, not just who replies first.

  4. Check duplicates

    Use a SHA-256 hash to avoid storing the same icon again.

  5. Save & apply

    Assign the icon to your entry and reuse cached results.

The provider path depends on your profile and settings.Explore the architecture

03 / Choose your approach

Your vault.
Your fetching style.

Four managed profiles in v1.3, with Balanced recommended for everyday use.

-

Fast

Large batch fetching with reduced latency

Direct Site → Yandex · 22 s total per-entry budget.

Enabled favicon resolvers may receive the entry’s domain. Synthetic fallbacks are disabled.

Balanced · Recommended

Default everyday use balancing coverage and speed

Direct Site → Google → Twenty Icons · 15 s total per-entry budget.

Enabled favicon resolvers may receive the entry’s domain. Synthetic fallbacks are disabled.

Privacy

Privacy-sensitive fetching without third-party providers

Direct Site · 22 s total per-entry budget.

No favicon resolvers or Android store lookup. Site-linked hosts and redirects remain possible. Synthetic fallbacks are disabled.

Precise

Favor icon precision over finding an icon for every entry

Direct Site → Google · 22 s total per-entry budget.

Enabled favicon resolvers may receive the entry’s domain. Synthetic fallbacks are disabled.

+

Fast

Large batch fetching with reduced latency

Direct Site → Yandex · 22 s total per-entry budget.

Enabled favicon resolvers may receive the entry’s domain. Synthetic fallbacks are disabled.

Balanced · Recommended

Default everyday use balancing coverage and speed

Direct Site → Google → Twenty Icons · 15 s total per-entry budget.

Enabled favicon resolvers may receive the entry’s domain. Synthetic fallbacks are disabled.

Privacy

Privacy-sensitive fetching without third-party providers

Direct Site · 22 s total per-entry budget.

No favicon resolvers or Android store lookup. Site-linked hosts and redirects remain possible. Synthetic fallbacks are disabled.

Precise

Favor icon precision over finding an icon for every entry

Direct Site → Google · 22 s total per-entry budget.

Enabled favicon resolvers may receive the entry’s domain. Synthetic fallbacks are disabled.

-

These controls preview v1.3 profiles; they do not change KeePass settings. The stable v1.2 download uses its earlier presets.

Compare providers, budgets and Custom settings →
+

Explore the v1.3 profiles here, then choose your profile in KeePass settings.

Compare providers, budgets and Custom settings →

Know what leaves your device.

Your vault.
Your choices.

Fetching icons makes network requests. Third-party icon services may receive domains from your entries and can see your IP address.

You can disable individual providers or synthetic fallbacks in KeeFetch settings. Direct-site fetching may also contact icon hosts linked by a website.

Read the privacy notes
-

Inside KeePass / v1.3 preview

A little guidance.
A clear result.

Real KeePass windows from the tested v1.3 candidate. Select a screenshot to see it at full size.

+

Inside KeePass / v1.3

A little guidance.
A clear result.

Real KeePass windows from the tested v1.3 release. Select a screenshot to see it at full size.

First-run profile chooser with Balanced recommended and the network disclosure visible.
Choose once. Change it later.

The first download asks how you want KeeFetch to find icons.

KeeFetch Results for a Privacy demo: 6 total, 6 updated, no misses, errors or cancellations.
See how the batch went.

This six-entry Privacy demo completed successfully. Real batches can also report missing icons, errors and retry options.

KeeFetch Settings Overview showing the Privacy profile.
Find your preferred balance.

Switch profiles in Overview. Changes take effect when you save.

KeeFetch Settings Providers showing provider checkboxes and order controls.
Keep the providers in view.

Use Custom to choose enabled providers and the order KeeFetch tries them.

Walk through setup and your first download →
-

04 / Make yourself at home

A small download.
A more familiar vault.

Start with the stable v1.2 release for KeePass 2.x on Windows. The screens and profile guide above preview the upcoming v1.3 release.

-Download PLGX · v1.2.0 +

04 / Make yourself at home

A small download.
A more familiar vault.

Get the stable v1.3 release for KeePass 2.x on Windows, with guided setup and the profiles shown above.

+Download PLGX · v1.3.0 -
Verify your download

Compare the PLGX file’s SHA-256 with the published checksum for v1.2.0.

1fd7e12590bfc2d23ede93c1ae5e61de0662187321caccdfeeb0bbcb995f5275

Published checksum file ↗
+
Verify your download

Compare the PLGX file’s SHA-256 with the published checksum for v1.3.0.

4742355b5cadb089c7898b99d7a6ff95d068f8319ad97b3a1eb15b1d186a53a8

Published checksum file ↗
-
  1. 1

    Get the plugin.

    Download KeeFetch.plgx from the release above.

  2. 2

    Drop it into Plugins.

    Copy the file into the Plugins folder beside your KeePass executable.

    Where is that folder?

    Portable: KeePass/Plugins/
    Installed: %ProgramFiles%/KeePass Password Safe 2/Plugins/

  3. 3

    Restart. Then fetch.

    Restart KeePass. Right-click an entry and choose KeeFetch - Download Favicons.

    Full installation & usage guide
+
  1. 1

    Get the plugin.

    Download KeeFetch.plgx from the release above.

  2. 2

    Drop it into Plugins.

    Copy the file into the Plugins folder beside your KeePass executable.

    Where is that folder?

    Portable: KeePass/Plugins/
    Installed: %ProgramFiles%/KeePass Password Safe 2/Plugins/

  3. 3

    Restart. Then fetch.

    Restart KeePass. Right-click an entry and choose KeeFetch - Download Favicons.

    Full installation & usage guide

Built in the open.

Small project.
Room for your ideas.

Explore the sourceCode, releases, and the occasional rabbit hole.Found a stubborn favicon?Report a bug or suggest an improvement.Make something betterProviders, tests, docs. All good places to start.
diff --git a/site/privacy.html b/site/privacy.html index 2e80dc9..5ce278e 100644 --- a/site/privacy.html +++ b/site/privacy.html @@ -8,7 +8,7 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0

KeeFetch / Privacy

Know where the requests go.

What KeeFetch reads, which hosts it contacts, and how profiles, certificates and diagnostics affect privacy.

Entry data and network requests

KeeFetch reads entry URLs and, when configured, titles locally. Direct Site requests the resolved URL and can fetch linked icons and manifests from other hosts. Third-party favicon resolvers may receive the target domain. Android store lookup may query Google Play for an app package.

KeeFetch does not upload your database or send username/password fields as a database export. A URL can itself contain sensitive path or query data, and resolved references can put data into a URL: review entries and diagnostics accordingly. There is no telemetry or analytics.

@@ -18,5 +18,5 @@

Local diagnostics

Routine plaintext log and CSV files can include entry titles, resolved URLs, outcomes and provider details. They are written beside the database when possible, otherwise in a temporary directory. The completion summary identifies the actual paths.

Inspect and redact files before sharing them. The Privacy profile does not redact them. Treat CSV contents as untrusted when opening them in spreadsheet software.

Report a security concern

Follow the repository's security policy. Do not attach a real vault, credentials or unredacted diagnostics to a public issue.

diff --git a/site/profiles.html b/site/profiles.html index 11dc422..1b4a3cb 100644 --- a/site/profiles.html +++ b/site/profiles.html @@ -8,16 +8,16 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0

KeeFetch / Profiles

Choose what matters for this run.

Compare KeeFetch profiles, provider order, request budgets, synthetic fallbacks and privacy behavior.

Managed profiles

This v1.3 source candidate uses the completed 19-candidate study and all 827 reviewed icon units. Four unresolved app identities receive zero usability credit. Precise's winner depends on that conservative scoring decision; read the evidence and limitations.

-
Managed profiles in the source preview
ProfileIntended useProvider order and budgetsDisclosure and fallbacks
FastLarge batch fetching with reduced latencyDirect Site → Yandex6 s primary / 3.5 s fallback / 22 s total. Stops on a strong resolver hit.Enabled resolvers receive domainsSynthetic: Disabled. Android store lookup: Enabled.Study evidence
BalancedDefaultDefault everyday use balancing coverage and speedDirect Site → Google → Twenty Icons4 s primary / 2.5 s fallback / 15 s total. Stops on a strong resolver hit.Enabled resolvers receive domainsSynthetic: Disabled. Android store lookup: Enabled.Study evidence
PrivacyPrivacy-sensitive fetching without third-party providersDirect Site6 s primary / 3.5 s fallback / 22 s total. Stops on a strong resolver hit.No favicon resolvers; site-linked hosts possibleSynthetic: Disabled. Android store lookup: Disabled.Study evidence
PreciseFavor icon precision over finding an icon for every entryDirect Site → Google6 s primary / 3.5 s fallback / 22 s total. Stops on a strong resolver hit.Enabled resolvers receive domainsSynthetic: Disabled. Android store lookup: Enabled.Study evidence
+
Managed fetch profiles
ProfileIntended useProvider order and budgetsDisclosure and fallbacks
FastLarge batch fetching with reduced latencyDirect Site → Yandex6 s primary / 3.5 s fallback / 22 s total. Stops on a strong resolver hit.Enabled resolvers receive domainsSynthetic: Disabled. Android store lookup: Enabled.Study evidence
BalancedDefaultDefault everyday use balancing coverage and speedDirect Site → Google → Twenty Icons4 s primary / 2.5 s fallback / 15 s total. Stops on a strong resolver hit.Enabled resolvers receive domainsSynthetic: Disabled. Android store lookup: Enabled.Study evidence
PrivacyPrivacy-sensitive fetching without third-party providersDirect Site6 s primary / 3.5 s fallback / 22 s total. Stops on a strong resolver hit.No favicon resolvers; site-linked hosts possibleSynthetic: Disabled. Android store lookup: Disabled.Study evidence
PreciseFavor icon precision over finding an icon for every entryDirect Site → Google6 s primary / 3.5 s fallback / 22 s total. Stops on a strong resolver hit.Enabled resolvers receive domainsSynthetic: Disabled. Android store lookup: Enabled.Study evidence

Time budgets cap the provider pipeline for an entry; they are not promises for total batch duration. Network conditions, timeouts, and the number of entries affect elapsed time.

Custom stays in your hands.

Choose enabled providers, their order, timeouts, synthetic fallbacks and Android store behavior. Selecting a managed profile applies that profile's policy; use Custom for manual choices. Settings edits take effect only on Save.

What each provider does

ProviderRole
Direct SiteFetches the target site, linked icons and manifests; can follow cross-host links and redirects.
Twenty Icons, DuckDuckGo, Google, YandexThird-party favicon resolvers. Enabled services may receive the target domain.
Favicone, Icon HorseAdditional third-party sources whose returned candidates may include generated fallbacks.

Selection ranks site-canonical candidates, strong resolved candidates, then synthetic fallbacks. Enabling a provider does not guarantee it will produce a usable icon.

Privacy and synthetic icons

Privacy disables favicon resolvers and Android store lookup. Direct Site still contacts the target and may fetch linked assets on another host. A synthetic fallback is a generated representation such as a letter mark, used when no stronger real icon survives selection.

Understand the network and diagnostic boundaries →
diff --git a/site/troubleshooting.html b/site/troubleshooting.html index 72af2bb..7b3742f 100644 --- a/site/troubleshooting.html +++ b/site/troubleshooting.html @@ -8,7 +8,7 @@
-v1.3.0 source preview · Stable download: v1.2.0 +Stable download: v1.3.0

KeeFetch / Troubleshooting

Get back to fetching.

Resolve KeeFetch loading issues, missing icons, slow runs, TLS errors and diagnostic questions.

The plugin does not load

Check KeePass 2.x, .NET Framework 4.8 and the Plugins folder beside the running KeePass executable. Install only one copy of KeeFetch. Restart KeePass after replacement; PLGX compilation happens in the host. Record the full compilation error if loading fails.

@@ -19,5 +19,5 @@

Find diagnostics

Use the paths shown in the completion screen. Logs are beside the database when possible, with a temporary-directory fallback. A long path can be copied from the summary. Review titles and URLs before sharing.

Report a reproducible bug

Include KeeFetch/KeePass versions, Windows version, plugin format, profile or Custom settings, expected versus actual behavior, and steps using a synthetic entry. For layout bugs include display scaling, theme and the affected form. Attach only redacted diagnostics and non-sensitive screenshots.

Open the issue tracker
From 9575b7185ae050e6f2679779c66953a8d01857f9 Mon Sep 17 00:00:00 2001 From: Simon Date: Fri, 11 Sep 2026 00:45:56 +0200 Subject: [PATCH 2/2] Record published 1.3 release and verified public package identities --- .agent/STATE.md | 4 ++-- docs/validation/2026-09-11-v1.3-publication.md | 6 +++++- docs/validation/v1.3-release-validation.md | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.agent/STATE.md b/.agent/STATE.md index fa03fa2..1ca60c5 100644 --- a/.agent/STATE.md +++ b/.agent/STATE.md @@ -4,9 +4,9 @@ Status: WORKING Agent: Codex Focus: Publish KeeFetch v1.3.0 with the accepted packages and update the official website. -Next: Finalize public release text and merge PR8 after its final checks pass. +Next: Complete PR18 CI, merge the stable website update and verify GitHub Pages. Pointer: https://tzii.github.io/KeeFetch/ -As-of: 2026-09-11 Europe/Rome · PR16 merged as a5c3ef6 and Pages deployment 34536083847 succeeded. All 34 public files match Git; 14 live browser cases and download/checksum checks pass. Final PR16 and PR8 website CI each pass 384 page cases, 123 machine cases and 84 axe scans; 20 static fixtures pass. PR8 at 15dc7d3 is mergeable/CLEAN with green Windows CI, 237 tests and all source/harness/export/package gates. The owner authorized completion of the v1.3 release on September 11. Live GitHub state reverified; both retained package hashes match the accepted values. +As-of: 2026-09-11 Europe/Rome · PR16 merged as a5c3ef6 and Pages deployment 34536083847 succeeded. All 34 public files match Git; 14 live browser cases and download/checksum checks pass. Final PR16 and PR8 website CI each pass 384 page cases, 123 machine cases and 84 axe scans; 20 static fixtures pass. PR8 at 15dc7d3 is mergeable/CLEAN with green Windows CI, 237 tests and all source/harness/export/package gates. The owner authorized completion on September 11. PR8 merged as 0c3f15c; merge/tag CI passed. v1.3.0 is published as latest stable, and all three public downloads match the retained candidate. PR18 carries the stable website cutover. Notes: - Official hosting is GitHub Pages only. The four original screenshots are published without pixel edits. The clean completion shows the verified six-entry Privacy demo; mixed-outcome functional evidence remains preserved. diff --git a/docs/validation/2026-09-11-v1.3-publication.md b/docs/validation/2026-09-11-v1.3-publication.md index 82332c3..fa00928 100644 --- a/docs/validation/2026-09-11-v1.3-publication.md +++ b/docs/validation/2026-09-11-v1.3-publication.md @@ -39,4 +39,8 @@ The maintainer receives the publication links and verification result in the rel ## Execution record -Publication preparation is complete. The release and website steps above remain to be executed; their final commit, workflow and downloaded-asset results will be recorded after publication. +- PR8 merged as `0c3f15cdb61d740759418d33daa53b26606e3273`; the annotated `v1.3.0` tag points to that merge. Final PR checks passed in [Windows run 34538010106](https://github.com/tzii/KeeFetch/actions/runs/34538010106) and [website run 34538010147](https://github.com/tzii/KeeFetch/actions/runs/34538010147). +- Both [merge validation 34538504891](https://github.com/tzii/KeeFetch/actions/runs/34538504891) and [tag validation 34538510863](https://github.com/tzii/KeeFetch/actions/runs/34538510863) passed, including the tag's separate checksum-verification job. +- [KeeFetch 1.3.0](https://github.com/tzii/KeeFetch/releases/tag/v1.3.0) was published as the latest stable release at 2026-09-10 22:44:46 UTC (September 11 in Europe/Rome). Its three public assets were downloaded without authentication and all byte counts and SHA-256 hashes match the table above. +- The stable website cutover is tracked in [PR18](https://github.com/tzii/KeeFetch/pull/18). It updates release/download/documentation links, the visible PLGX checksum and source-preview wording, while retaining the accepted design, four original screenshots and frozen profile snapshot. The snapshot and compiled 1.3 catalog have the same SHA-256: `1bc1fc582c5dc6d1c5033699ac7246d6c8388d8fc42284249a237a2f9a0d686f`. +- GitHub Pages publishes the stable website after its green PR merges. Deployment status is available in [Pages workflow history](https://github.com/tzii/KeeFetch/actions/workflows/pages.yml). Download receipts, workflow results and post-deployment public-file/browser checks are retained under `artifacts/v1.3-preparation/publication-20260911` in the maintainer checkout. diff --git a/docs/validation/v1.3-release-validation.md b/docs/validation/v1.3-release-validation.md index dd27fc6..7d99af0 100644 --- a/docs/validation/v1.3-release-validation.md +++ b/docs/validation/v1.3-release-validation.md @@ -31,7 +31,7 @@ Record the actual build environment, commands, source identity and artifact path | Visible host checks | PASS — owner reported and explicitly confirmed the complete functional checklist, including all four display scales, keyboard and High Contrast. Codex remains unable to operate KeePass; this is not a Codex-observed visual pass. See [manual acceptance](2026-09-10-v1.3-manual-host-results.md) | | Install, upgrade and rollback | PASS — owner explicitly confirmed both DLL/PLGX, migration cases and authentic upgrade/rollback; other checklist tests, including the long path, were reported satisfactory. Exact candidate and installed PLGX hashes reverified | | Release notes / media | Final [release notes](../releases/v1.3.0.md) contain the accepted study results, exact final hashes and known limitations. All four genuine final-host screenshots are accepted and integrated; see [media acceptance](2026-09-10-v1.3-media-intake.md). | -| Human review / publication authorization | Owner authorized completing the 1.3 release and website update on September 11. [PR #8](https://github.com/tzii/KeeFetch/pull/8) is ready for review, mergeable and green at `15dc7d3`. Final documentation cleanup is followed by current-head checks, merge/tag validation, exact-asset publication and the stable website update. Actual publication results are recorded in the [publication record](2026-09-11-v1.3-publication.md). | +| Human review / publication authorization | Owner authorized completing the 1.3 release and website update on September 11. [PR #8](https://github.com/tzii/KeeFetch/pull/8) merged at `0c3f15c` after all final-head checks passed. Merge/tag validation passed and [v1.3.0](https://github.com/tzii/KeeFetch/releases/tag/v1.3.0) is published as latest stable. All three public downloads match the retained files. Stable website cutover is [PR18](https://github.com/tzii/KeeFetch/pull/18); details are in the [publication record](2026-09-11-v1.3-publication.md). | ## Publication and recovery contract