After upgrading from Bullseye to Bookworm, pwsafe crashes after
supplying the master password. Terminal output shows:

===8<----------------------------------------
pwsafe: ./src/core/PWSfileV1V2.cpp:391: size_t PWSfileV1V2::ReadCBC(unsigned char&, StringX&): Assertion `wcLen != 0' failed.
===8<----------------------------------------

I was previously able to access my passwords with version
1.12.0+dfsg-1. So this is a regression.

It’s worth noting that my DB file was originally created by Bruce
Schneier’s “pwsafe” CLI tool. That package died for some reason and as
a refugee I was forced to adopt this GUI “passwordsafe”, which was
originally claimed to be compatible with Schneier’s CLI tool. However,
it was only compatible in terms of *reading* the DB. Edits result in
corruption (yikes!). So I was crippled with version 1.12.0+dfsg-1 but
at least I could /read/ my DB. Of course this crash in version
1.16.0+dfsg-4 is a total show stopper.

Hi, thanks for your report.

If you have the ability to test 1.17 from testing/unstable, or 1.18 from
upstream, it would be helpful to know if you do/don't see the same
assertion failure with those.

In the mean time, I'll try to look at it and see if I can figure out
what's causing it.

This is a common misconception.

Bruce's original PasswordSafe was a (windows-only) GUI application, and
the GUI version we're shipping in Debian is a direct descendant of that
original code [1].

The CLI-only version was a unix-compatible clone from another developer [2]
(towards the bottom, "pwsafe password database" for Unix) that got
popular because there was no official Linux version at that time.

That developer was unresponsive for several years, and the package was
dropped from Debian [3] [4].  The author has since resurfaced [5], but has
stated that he doesn't plan on supporting the current database version
(v3) [6].

Not that any of that changes the issue you're having.

[1] https://www.schneier.com/academic/passsafe/
[2] http://pwsafe.org/relatedprojects.shtml
[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601300
[4] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=619704
[5] https://github.com/nsd20463/pwsafe
[6] https://github.com/nsd20463/pwsafe/issues/13#issuecomment-328247430

Assuming this corruption is similar to what was reported upstream [7],
the database itself should be unchanged, and the corrupted changes you see
should only be in the GUI.  That doesn't really make it any more useable for
you, but at least it hopefully shouldn't be trashing your data.

That said, v3 was released in 2006, and v1 and v2 have been deprecated
for quite a while. So if you want to continue using PasswordSafe, you'll want
to import your v2 database, then save it as v3 in order to edit it going
forward [8]. Of course, in doing that, you won't be able to open it in the
old CLI any more, since it doesn't support v3.

[7] https://github.com/pwsafe/pwsafe/issues/367
[8] https://github.com/pwsafe/pwsafe/issues/180


Also, if CLI is a sticking point for you, upstream has been working on a
CLI-based version for a while, but we're not currently shipping it as
part of the Debian package. I can look into adding that if it would be
helpful.  Though I haven't used it, so I can't speak to how it is.


Best regards,
Bill

Hi, thanks for your report.

If you have the ability to test 1.17 from testing/unstable, or 1.18 from
upstream, it would be helpful to know if you do/don't see the same
assertion failure with those.

In the mean time, I'll try to look at it and see if I can figure out
what's causing it.

This is a common misconception.

Bruce's original PasswordSafe was a (windows-only) GUI application, and
the GUI version we're shipping in Debian is a direct descendant of that
original code [1].

The CLI-only version was a unix-compatible clone from another developer [2]
(towards the bottom, "pwsafe password database" for Unix) that got
popular because there was no official Linux version at that time.

That developer was unresponsive for several years, and the package was
dropped from Debian [3] [4].  The author has since resurfaced [5], but has
stated that he doesn't plan on supporting the current database version
(v3) [6].

Not that any of that changes the issue you're having.

[1] https://www.schneier.com/academic/passsafe/
[2] http://pwsafe.org/relatedprojects.shtml
[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601300
[4] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=619704
[5] https://github.com/nsd20463/pwsafe
[6] https://github.com/nsd20463/pwsafe/issues/13#issuecomment-328247430

Assuming this corruption is similar to what was reported upstream [7],
the database itself should be unchanged, and the corrupted changes you see
should only be in the GUI.  That doesn't really make it any more useable for
you, but at least it hopefully shouldn't be trashing your data.

That said, v3 was released in 2006, and v1 and v2 have been deprecated
for quite a while. So if you want to continue using PasswordSafe, you'll want
to import your v2 database, then save it as v3 in order to edit it going
forward [8]. Of course, in doing that, you won't be able to open it in the
old CLI any more, since it doesn't support v3.

[7] https://github.com/pwsafe/pwsafe/issues/367
[8] https://github.com/pwsafe/pwsafe/issues/180


Also, if CLI is a sticking point for you, upstream has been working on a
CLI-based version for a while, but we're not currently shipping it as
part of the Debian package. I can look into adding that if it would be
helpful.  Though I haven't used it, so I can't speak to how it is.


Best regards,
Bill