pass is a single ~700 line shell script wrapping gpg and optionally git.
while long for a shell script, that's pretty easy reading for a password manager, and easy enough to understand.
while long for a shell script, that's pretty easy reading for a password manager, and easy enough to understand.
Not saying that a company could not have a malicious release. It could. I just think the odds are much lower because their release process has better security controls and is generally audited better.