DotGhostBoard 2.0.0 'Cerberus': Building a Native Cryptographic Clipboard & Vault for Linux

Meet DotGhostBoard 2.0.0 — a lightweight, zero-telemetry Linux clipboard manager featuring an encrypted Vault, Shannon entropy secret detection, multi-channel updates, tiling WM support, and native notifications.

Every developer and power user on Linux has wrestled with the clipboard dilemma:

1. The Classic Utilities: Tools like xclip or basic clipboards do their job, but lack visual search, organization, and security.
2. The Modern Web Wrappers: Modern tools often arrive packaged in Electron, consuming 400MB+ of RAM just to hold text strings, with opaque network calls and zero encryption.
3. The Security Risk: Your clipboard regularly holds your most sensitive data — database passwords, GitHub personal access tokens, AWS keys, JWT tokens, and SSH commands. Storing that in plaintext on disk is a massive vulnerability.

We built DotGhostBoard to solve this: a native, lightweight, privacy-first, and cryptographic clipboard security station designed specifically for Linux.

Today, after months of development, architectural refactoring, and rigorous testing, we are excited to release DotGhostBoard v2.0.0 "Cerberus" — our biggest milestone yet! 🚀

⚡ What Makes DotGhostBoard Different?

DotGhostBoard is engineered with pure native technologies: Python 3.11+, PyQt6, SQLite, and cryptography.

• Zero Cloud & Zero Telemetry: Everything stays strictly local on your device. No analytics, no phone-home pings, no external network requests.
• SQLite Secure Deletion: Uses PRAGMA secure_delete = ON to reduce residual deleted data in SQLite storage by overwriting freed SQLite database pages, paired with explicit handling of Write-Ahead Logs (WAL) and storage cleanup.
• Fast Global Hotkeys: Low-overhead global hotkey listeners (Ctrl+Alt+V for Dashboard, Ctrl+Alt+Space for Spotlight Quick Search) with responsive window summoning and instant focus.
• Ultra-Lightweight Footprint: Starts near-instantaneously and uses a fraction of the memory footprint of web-based alternatives.

🔍 What Changed in 2.0.0

Cerberus is not a single feature release. It is an architectural rebuild focused on four foundational areas:

• Local Cryptographic Storage: AES-256-GCM envelope encryption with ephemeral in-memory reveal for credentials and tokens.
• Secret Detection and Handling: Real-time Shannon entropy heuristics that intercept sensitive tokens before clipboard exposure.
• Safe Release Channels: Multi-tier delivery (Stable, Beta, Alpha) with strict opt-in pre-releases.
• Native Linux Desktop Integration: Direct X11/EWMH workspace migration and FreeDesktop notification support.

🛡️ The Architecture of 2.0.0: Core Subsystems

Here is an engineering deep-dive into everything under the hood:

1. The Encrypted Vault UI Subsystem (ui/vault/)

While DotGhostBoard has always featured Eclipse Mode for local item encryption, 2.0.0 introduces The Vault — a dedicated, sliding drawer panel accessible via Ctrl+Shift+V or the sidebar button.

• Envelope Encryption (AES-256-GCM): Secrets are protected with authenticated symmetric encryption; plaintexts are never persisted to disk unencrypted.
• Category Filtering: Organize passwords, API keys, tokens, SSH credentials, and secure notes with real-time filtering pills.
• In-Memory Ephemeral Reveal: Secrets stay masked (••••••••••••••••) by default to prevent shoulder surfing, revealing only on-demand in monospace font and auto-scrubbing from memory when locked.
• Zero-Plaintext Deduplication: Computes an in-memory HMAC digest of candidate secrets and evaluates them against existing in-memory secret signatures using constant-time hmac.compare_digest. This prevents storing duplicate secrets without ever persisting plaintext hashes or pre-images into SQLite storage.

2. Zero-Log Password & Secret Detector

One of the most dangerous clipboard events is accidentally copying a production secret. DotGhostBoard 2.0.0 integrates a real-time detection engine (core/security/detector.py):

• Shannon Entropy Analysis: Computes the mathematical information entropy ($\ge 3.0$) of copied text alongside character class distribution (mixed casing, digits, symbols).
• Smart Heuristics: Identifies API tokens (AWS keys, GitHub PATs, JWTs, Stripe keys, generic credentials).
• False-Positive Reduction & Guardrails: Intelligently filters file paths, environment variables (like $PWD), git branch names, code function calls, and multiline snippets to significantly minimize false positives while preserving true secret catches.
• Zero-Loss Auto-Encryption: If you copy a secret and miss the toast prompt, the 60-second TTL fallback automatically encrypts the clip into Eclipse history rather than discarding it.

3. Direct "Send to Vault" Workflow

Found an API token in your clipboard history that you want to keep permanently safe?

• Text cards now feature a dedicated 🛡️ Send to Vault button and context menu action.
• Automatically prefills the secret dialog, decrypts on the fly if previously encrypted under Eclipse, and cleans up the history card seamlessly upon confirmation.

4. Multi-Channel Update Engine (Stable, Beta, Alpha)

Keeping local native desktop apps updated without waiting for distribution package maintainers can be tedious. DotGhostBoard 2.0.0 introduces an integrated Multi-Channel Release Engine:

• Select your desired update track in Settings → General:
  • Stable: Verified, production-ready releases.
  • Beta: Pre-releases and release candidates for early adopters.
  • Alpha: Bleeding-edge experimental builds.
• Safe Channel Guarantee: Stable is the default channel. Pre-release builds (Beta and Alpha) are strictly opt-in.
• The update dialog features live byte-progress indicators, changelog display, and seamless one-click binary restart.

5. System-Native FreeDesktop Notifications

Instead of relying solely on system tray balloons, 2.0.0 talks directly to FreeDesktop notification daemons (/usr/bin/notify-send and D-Bus):

• Rich desktop alerts for secret detections, sync events, and updates.
• Interactive Click Callback: Clicking a notification immediately foregrounds DotGhostBoard on your active monitor.
• Graceful fallback to QSystemTrayIcon if an external notification daemon is not running.

6. Tiling Window Manager & EWMH Workspace Migration

Tiling window manager users (tested on Qtile, and compatible with EWMH-compliant window managers) often suffer from popup clipboard managers getting stuck on inactive workspaces or behaving strangely when toggled.

DotGhostBoard 2.0.0 implements direct EWMH (Extended Window Manager Hints) interaction using Python's standard ctypes directly against libX11.so.6:

• When you summon DotGhostBoard (Ctrl+Alt+V or dotghostboard --toggle) from Workspace 2 while the window was previously opened on Workspace 1, DotGhostBoard:
  1. Detects _NET_CURRENT_DESKTOP vs _NET_WM_DESKTOP.
  2. Resolves the X11 limitation where Qt reports isVisible() == True even on unmapped workspaces.
  3. Sends _NET_WM_DESKTOP and _NET_ACTIVE_WINDOW ClientMessages with pager priority (source=2).
  4. Automatically migrates the window to your active workspace and focuses it instantly without hiding!
• Modal Safety: Dialogs (LockScreen, UnlockDialog) are prepared with prepare_dialog_for_current_workspace() before exec(), guaranteeing modal focus without breaking the Qt event loop.
• Kill Switch: DOTGHOST_NO_EWMH=1 is supported for users who prefer traditional window manager handling.

🎨 Cyber-Stealth Phantom Visual Identity

With 2.0.0, we retired the legacy 8-bit ghost icon in favor of the Cyber-Stealth Phantom:

• Dark graphite matte squircle paired with a radiant neon green visor (#00ff41).
• High-precision downsampling pipeline using Lanczos resampling and unsharp masking, ensuring pixel-perfect sharpness from 16x16 system tray icons up to 512x512 desktop launchers.

🧪 Engineering Quality & Verification

We believe security and privacy utilities must be held to the highest code quality standards:

• 489 Automated Tests (100% Passing): Unit tests, mock isolation, raw disk zero-overwrite verification, and live integration tests running inside virtual X11 displays (Xvfb) against both Openbox and real Qtile 0.36.0.
• Strict Modularity & File Budgets: Architecture guardrails ensure complex UI components remain decoupled and maintainable (ui/dashboard.py strictly adheres to a $\le 500$ LOC limit to eliminate God-object bloat).
• Targeted Code Quality: Core coordination modules, window management routines, and security controllers adhere strictly to PEP8/flake8 standards.

📦 How to Get DotGhostBoard 2.0.0

DotGhostBoard is 100% open source under the Apache-2.0 License.

1. OpenDesktop / KDE Store / Pling

You can grab the release package, AppImage, or leave a review on OpenDesktop:
👉 DotGhostBoard on OpenDesktop / Pling

2. GitHub Repository & Releases

Download standalone binaries, AppImages, Debian .deb packages, or inspect the source code:
👉 GitHub: kareem2099/DotGhostBoard

Quick Install from Source:

# Clone the repository
git clone https://github.com/kareem2099/DotGhostBoard.git
cd DotGhostBoard

# Set up environment
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Run DotGhostBoard
python3 main.py

Enable Global Shortcuts:

• Toggle Dashboard: Ctrl+Alt+V
• Spotlight Quick Search: Ctrl+Alt+Space
• Toggle Encrypted Vault: Ctrl+Shift+V

🤝 Join the Community

Whether you're on Arch, Debian, Ubuntu, Fedora, or Kali Linux — and whether you use GNOME, KDE, or Qtile — DotGhostBoard was built to give you total control and security over your clipboard.

• ⭐ Star the repo on GitHub
• 💬 Share feedback and submit feature requests via GitHub Issues
• 🌐 Check out our listing on OpenDesktop

Cerberus is ultimately about one principle: sensitive clipboard data should remain under the user's control — locally stored, explicitly protected, and never silently promoted to the network.

Happy hacking and secure copying! 👻🔒