The maintainer responsible for building Debian packages for the KeePassXC password manager has switched to providing a heavily stripped-down version of the program, which retains only the basic functionality necessary for securely storing passwords on a local system. Advanced features, including the capability for network interaction, IPC control code, components for integration with web browsers, auto-fill password functions, and support for Yubikey keys, have been removed from the standard keepassxc package. This is explained by a desire to eliminate unnecessary features that increase the attack surface and can potentially harm security and privacy.
For users who require the full version of KeePassXC, a separate keepassxc-full package has been offered, which includes all the extended capabilities present in the original version. The stripped-down package is located in the Debian sid (unstable) and testing repositories, replacing the old full package of the same name, which has led to discontent among some users who encountered a lack of familiar functionality after the update and perceived the change as a failure. Those unhappy with the change are urging the KeePassXC maintainer in Debian to restore the original version of the package and to place the stripped version under the name keepassxc-minimal.
Criticism of the decision has also come from a KeePassXC developer, who noted that users associate the loss of functionality with the main project and direct complaints to KeePassXC developers rather than to the Debian package maintainer. This change could negatively impact KeePassXC's reputation and place an additional burden on project members. Furthermore, the question has been raised regarding the legality of distributing a package under the project name while having a fundamentally different functionality from the base build provided by the main developers.
In the discussion, supporters of the change point out that each included plugin potentially introduces a risk of vulnerabilities or backdoor implementation. Additionally, it is noted that the stripped-down package is only located in the unstable and testing repositories, which are meant for testing rather than stable releases of the distribution.
KeePassXC developers clarified that the use of the term plugins for remote additional features is incorrect, as this is built-in functionality that is disabled by default but can be activated in the settings by the user. The mention of eliminating external libraries is also deemed baseless, as the code for supporting Yubikey is no longer reliant on the external library libyubikey, and all components necessary for its operation are included in the main codebase of KeePassXC.
Source: opennet.ru
