docs/changelog.md (f9248f3) - derivepassphrase.git

changelog.md

# Changelog for `derivepassphrase`

[![Keeping a changelog][CHANGELOG_BADGE]][KEEP_A_CHANGELOG]
[![Using Semantic Versioning][SEMVER_BADGE]][SEMANTIC_VERSIONING]

[CHANGELOG_BADGE]: Keep_a_changelog-E05735.svg
  [SEMVER_BADGE]: SemVer-3F4551.svg
  [KEEP_A_CHANGELOG]: https://keepachangelog.com/en/1.1.0/ 'Keeping a changelog'
  [SEMANTIC_VERSIONING]: https://semver.org/ 'Using Semantic Versioning'

??? info "Definition: the <q>public API</q> of `derivepassphrase`"

The <dfn>public API</dfn>, as defined by Semantic Versioning, is
 outlined in the [Reference section][REFERENCE]: the set of documented
 modules, classes, attributes, methods, functions and function
 parameters, and the documented behavior, options and arguments of the
 command-line tools.

Certain **exceptions to this rule** are explicitly and prominently
    marked as implementation details/not part of the public API.

??? info "Interpretation of the version number"

The terminology major, minor and patch follows the
 Semantic Versioning and Keep a Changelog definitions.

* For version numbers with major version zero, *any* new release may
 effectively constitute a new major release.
 * For version numbers with major version one or higher,
 * Fixed entries justify a patch release;
 * Added and Deprecated entries justify
 a minor release;
 * Changed and Removed entries justify a major
 release.
 * Security can justify any type of release; if major
 or minor, these are accompanied by corresponding entries
 of the respective types above.

!!! abstract inline end "Legend: symbols"

<ul style="list-style-type: none;">
 <li>:material-bug: --- a related bug entry from the wishlist page
 <li>:material-file-document-plus-outline: --- a related wishlist entry from the wishlist page
 </ul>

<aside markdown>
(All entries are from the perspective of a user of the program or the API.
As an exception, entries partaining to developers of `derivepassphrase` are
specifically marked as such.)
</aside>

## 0.6.1 (2026-07-06) {#v0.6.1}

### Changed {#changed-in-v0.6.1}

- For developers: The [SSH agent
    client][derivepassphrase.ssh_agent.SSHAgentClient] has separate internal
    methods for the "send" and the "receive" halves of a request, each of
    which can be stubbed individually.

- For developers: Several internal and mostly-minor changes to the
    categorization and organization of the test suite should make it
    altogether faster to run if "correctness tests" are not desired, but
    fast feedback/"regression tests" are:

- The `dev` and `intense` [hypothesis][] profiles are
        replaced by `regression`/`debug-regression` and `correctness`.
        The `flaky` profile has been dropped without replacement.
      - Some parametrized tests that should be property-based tests are now
        stubbed property-based tests.
        Likewise, some exhaustive property-based tests with only few inputs
        are now parametrized tests.
        There is explicit machinery for converting parametrized tests into
        stubbed property-based tests without too much writing effort.

Other test suite improvements are not primarily based on the
    "correctness"/"regression" split, but nonetheless should make the test
    suite faster and/or easier to use:

- SSH agent configurations and built-in SSH agent socket providers are
        now stored as an enum.
        SSH protocol numbers serialize as their byte representation.
      - A new "agent protocol response queue" class provides stub methods
        for the "send" and "receive" halves of an SSH agent request which
        map fixed request messages to fixed lists of response messages.
      - The stubbed SSH agent better mimics real-world agent communication
        channel behavior (incomplete requests, pipelined requests, channel
        shutdown).
      - SSH agent interaction tests run against the stubbed SSH agent or the
        agent protocol response queue where possible.
      - Some common functionality has been moved into `tests.data`,
        `tests.machinery` or `conftest`.

### Fixed {#fixed-in-v0.6.1}

- Work around a bug in the OpenSSH `ssh-agent` where a `query`
    request would receive a spurious
    [`SUCCESS`][derivepassphrase._types.SSH_AGENT.SUCCESS] response, so
    subsequent interactions (request-response pairs) would be misaligned.
    This only affects OpenSSH 10.3/10.3p1.
    →[:material-bug:][BUG_OPENSSH_BUG3967_WORKAROUND]

- Changes in the test runner behavior of `click` 8.2.0 and higher are now
    accommodated in the test suite.
    (User-visible behavior is still the same.)

## 0.6 (2026-04-02)  {#v0.6}

### Added  {#added-in-v0.6}

- For `derivepassphrase vault`, in the SSH agent client, introduce a new
 abstraction layer responsible for establishing the connection to the SSH
 agent: "SSH agent socket providers".
 Reframe the existing code for connecting to SSH agents on UNIX as
 a standard socket provider, and reserve a second standard socket
 provider, yet to be written, for <abbr title="Microsoft Windows">The
 Annoying OS</abbr>.[^the-annoying-os]

(The system is based on Python package [entry
    points][importlib.metadata.entry_points], and is open for third-party
    developers to develop their own socket providers in case the standard
    socket providers are insufficient.)

- `derivepassphrase vault --version` now defers testing for SSH agent
    support (the "master SSH key" feature) to the SSH agent client
    constructor, instead of examining the environment itself and drawing its
    own conclusions.

- For `derivepassphrase vault`, support interacting with SSH agents on
 <abbr title="Microsoft Windows">The Annoying OS</abbr>, using Windows
 named pipes and the `SSH_AUTH_SOCK` environment variable.
 Also support the two major SSH agents Pageant ([PuTTY][]) and
 `ssh-agent` ([OpenSSH][]) specifically, without needing the user to
 specify the address of the Windows named pipe.
 [GnuPG][]'s `gpg-agent` (masquerading as OpenSSH's `ssh-agent`) is also
 known to work.

This support is based on the [`ctypes.WinDLL`][] interface, and requires
 access to the `kernel32.dll` library on <abbr title="Microsoft
 Windows">The Annoying OS</abbr> at runtime.
 `derivepassphrase vault --version` will reliably report whether this
 feature -- the `windows_named_pipe`, `pageant_on_windows` and
 `openssh_on_windows` SSH agent socket providers -- is available.

Caveat: On <abbr title="Microsoft Windows">The Annoying
 OS</abbr>, the user or developer should [mark all SSH agents as
 non-reentrant](#changed-in-v0.6-non-reentrant-ssh-agents) and run the
 test suite without parallelization, because the test suite cannot spawn
 isolated agents on <abbr title="Microsoft Windows">The Annoying
 OS</abbr>.
 The OpenSSH agent implementation interacts very badly with the feature
 detection logic from the test suite, because it shuts down the
 connection upon negative responses of any kind (in violation of the
 protocol); the user or developer may want to use GnuPG's emulation
 instead, or restrict themselves to PuTTY.
 →[:material-bug:][BUG_WINDOWS_SSH_AGENT_SUPPORT]

- For `derivepassphrase vault`, support specifying the desired SSH agent
    socket provider via the command-line option
    `--ssh-agent-socket-provider` and via the configuration option
    `ssh-agent-socket-provider` in the `vault` table.
    The list of available providers can be queried with `derivepassphrase
    vault --version`.
    The command-line option takes precedence over the configuration option.

- For developers: Feature flags and similar enum values are now
    self-testing, i.e., they include [their own code for testing whether they
    are active/enabled/supported][derivepassphrase._types.FeatureTestEnum].

### Changed  {#changed-in-v0.6}

- The error message "Cannot connect to an SSH agent because this Python
    version does not support UNIX domain sockets." (code: `NO_AF_UNIX`) now
    reads "Cannot connect to an SSH agent because this Python version does
    not support communicating with it." and has a new code
    (`NO_AGENT_SUPPORT`).
    `derivepassphrase` may also try out certain communication channels
    (depending on the installation environment), and issue warnings relating
    to its failure to establish communication on those channels, before
    issuing the above error.

The `NO_AF_UNIX` code is reused by the new warning message "Cannot
    connect to an SSH agent via UNIX domain sockets because this Python
    version does not support them.", which is one of the aforementioned
    related warning messages.

The manpages document both the old and the new codes, with appropriate
    notices.

- For developers: The internal helper function
    `derivepassphrase._internals.cli_helpers.key_to_phrase` now takes
    mandatory callback parameters to handle warning and error messages.
    This is a side-effect of the "SSH agent socket providers" system, which
    necessitates more complicated error and warning handling.

We considered making the callback parameters optional and supplying
    a default handler that suppress warnings and exit on error, but then we
    learned the hard way that those defaults make it too easy to suppress
    warnings *by accident*, just because we forgot to supply a certain
    function parameter.

- For developers: The test suite now distinguishes between
 <dfn>isolated</dfn> SSH agents (spawned and managed by the test suite)
 and non-isolated ones (spawned by the user, potentially in use by other
 programs).

All tests involving SSH agents are included in a separate group, so that
    the test harness distributes them to the same worker process.

- For developers: The test suite now supports selectively enabling
 SSH agents to test with via the `PERMITTED_SSH_AGENTS` environment
 variable, which takes a comma-separated list of internal IDs of known
 SSH agent implementations.
 (Invalid entries are silently ignored.)
 The test suite will only attempt to spawn or interface with agents of
 permitted types, and skip tests otherwise.

Intended to avoid spawning certain SSH agents just because they are
    installed, or spawning unrelated executables that are mistaken for
    the respective SSH agent due to identical executable names.

- For developers: The test suite now supports marking SSH agents as
 non-reentrant via the `NON_REENTRANT_SSH_AGENTS` environment
 variable, which takes a comma-separated list of internal IDs of known
 SSH agent implementations.
 (Invalid entries are silently ignored.)
 The test suite will avoid constructing multiple SSH agent clients
 connecting to such an SSH agent by reusing client instances, or skipping
 the test altogether.

Intended to avoid deadlocks with shared agent instances that do not
    cleanly support multiple simultaneous clients.

- [GnuPG][] v2.4.8 appears to use a single thread to both accept
        incoming SSH agent client connections and service them;
        running two clients simultaneously blocks the second client from
        connecting until the first client disconnects.
        This precludes normal usage in the test suite, where the test suite
        keeps a client connection to the agent open for the duration of the
        test run (to upload test keys at the beginning and remove them at
        the end).

- Pageant principally supports multiple simultaneous clients.
        However, the test suite sporadically triggers errors where responses
        from Pageant contain extra blocks of NUL characters, confusing
        `derivepassphrase`.
        We have not observed any such errors yet when treating Pageant as
        non-reentrant.

(So far, we have *only* been able to trigger these errors during
        test suite runs, not during instrumented calls specifically
        attempting to trigger this behavior.
        We are also unsure if this is a bug in Pageant, a bug in
        `derivepassphrase`, a bug or a limitation in Python's [`ctypes`][]
        implementation, or a bug or a limitation of Windows named pipes, or
        perhaps some combination of the aforementioned.)

### Fixed  {#fixed-in-v0.6}

- Officially and systematically test on Python 3.14.

Unofficial, non-systematic testing was already being done since v0.5.

- For developers: Refactor the test suite into more fine-grained modules,
    and deduplicate code in the test methods in favor of parametrization.
    Both measures should make the test suite easier to navigate and less
    prone to copy-and-paste and code desynchronization mistakes.

- For developers: The manpage diagnostics helper scripts now explicitly
    support documentation of message codes that exist only as marks in the
    manpages, not in the program code.
    This allows documenting message codes that have since been removed from
    the program code.

## 0.5.2 (2025-08-03)  {#v0.5.2}

### Fixed  {#fixed-in-v0.5.2}

- Correctly report (in `--version` output) the current version as v0.5.2,
    instead of v0.5 alpha 1, development build #1.
    This happened because---ironically---our machinery for updating embedded
    version numbers automatically overlooked the *one* embedded version
    number that the `--version` output handler actually uses.

- For developers: Add slightly more details to the release checklist.

- For developers: Fix some errors in the test suite (both code and
 dependency declaration) that cause the suite to fail to even start on
 <abbr title="Microsoft Windows">The Annoying
 OS</abbr>.
 These mistakes were already present in v0.5.

- For developers: Fix a copy-and-paste error in the parsed data for the
    ECDSA NIST P-521 SSH test key, which would cause *all* agents to fail
    when signing with that key, even if the agent otherwise supported the
    key type.
    Add additional testing code to catch this kind of test data
    inconsistency.

- For developers: Provide expected signatures and equivalent master
    passphrases for all test keys under Pageant, using both the
    [RFC 6979][] scheme and the Pageant pre-0.80 scheme.

Furthermore, provide a script to emit test key data for all defined test
    keys, augmented with the current agent's signatures and equivalent
    master passphrases, in a format that can be easily pasted into the test
    module's code (with only minor reformatting).

## 0.5.1 (2025-06-24)  {#v0.5.1}

### Fixed  {#fixed-in-v0.5.1}

- Add icons and more internal links (reference documentation, wishlist
    entries) to the changelog.

- Change the upstream URLs for the issue/wishlist tracking and the source
    code away from the GitHub mirror, and to the private hosting sites.

- Declare support for Python 3.14 (as of beta 3).

## 0.5 (2025-06-14)  {#v0.5}

### Removed  {#removed-in-v0.5}

- For [`derivepassphrase`][CLI], remove [support for (automatic) colored
    output or output with embedded text styling, as introduced in
    v0.4.0](#added-in-v0.4.0-color-support).

This is a stopgap measure.
    There exist pseudo-standards (the `NO_COLOR` and `FORCE_COLOR`
    environment variables) governing how to influence this automatic
    detection, but they are under-specified with regard to their interaction
    with each other.
    Until a consensus is reached and automatic colored/styled output can be
    requested or rejected reliably across different terminal programs, we
    will rather emit only uncolored, unstyled, lowest-common-denominator
    device-independent output.
    →[:material-file-document-plus-outline:][WISH_CONVENTIONAL_CONFIGURABLE_TEXT_STYLING]

### Added  {#added-in-v0.5}

- For the [`Vault`][derivepassphrase.vault.Vault] API, support reporting
    on whether two master passphrases are interchangeable with respect to
    the service passphrases they can derive.
    This is an artefact of how the master passphrase is converted to the
    random bit sequence with which the service passphrases are generated.
    See the corresponding [FAQ entry: What are "interchangeable passphrases"
    in vault?][INTERCHANGEABLE_PASSPHRASES] for details, including the
    practical security (non-)implications.

The [`derivepassphrase vault`][CLI_VAULT] command-line interface does
    not address this in any manner, mostly because the "non-standard"
    interchangeable variants of a given master password tend to be ugly to
    type in, and because they do not have practical security implications.

- For the [`Vault`][derivepassphrase.vault.Vault] API, accept arbitrary
    [Buffer][collections.abc.Buffer] objects as passphrases or service
    names, beyond [`bytes`][] and [`bytearray`][].

- Expose [the vault UUID][derivepassphrase.vault.Vault.UUID] and [the
    character sets][derivepassphrase.vault.Vault.CHARSETS] as public
    attributes.

- For [`derivepassphrase vault`][CLI_VAULT], support selecting the [editor
    interface](#changed-in-v0.5-editor-interface) when editing notes via the
    `--modern-editor-interface` and `--vault-legacy-editor-interface`
    options.

- For [`derivepassphrase vault`][CLI_VAULT], support printing the service
    notes before the passphrase, as an alternative, instead of always
    printing them *after* the passphrase.
    →[:material-file-document-plus-outline:][WISH_PRINT_SERVICE_NOTES_ABOVE]

- In the `--version` option of [`derivepassphrase`][CLI] and each
    subcommand, additionally report build and environment information, such
    as supported subcommands, derivation schemes, foreign configuration
    formats and active [PEP 508 extras](https://peps.python.org/pep-0508/).
    (Each subcommand only reports the items relevant to that subcommand.)
    →[:material-file-document-plus-outline:][WISH_REPORT_BUILD_FLAGS_AND_FEATURES]

- For developers: Rewrite the tests concerning [`derivepassphrase
    vault`][CLI_VAULT] and `--notes` usage into [hypothesis][]-based tests
    where feasible.

- For developers: Add scripts to the source tree to ensure consistent code
    quality: automatic linting, formatting and type checking, and optional
    running of the test suite and building of the documentation.
    The master quality control script doubles as a servicable (but
    heavyweight) "pre-commit" hook for git.

### Changed  {#changed-in-v0.5}

- Support a new, unified interface
    [`ExportVaultConfigDataFunction`][derivepassphrase.exporter.ExportVaultConfigDataFunction]
    in the export handlers for "storeroom" and "vault-native" configuration
    data,
    [`export_storeroom_data`][derivepassphrase.exporter.storeroom.export_storeroom_data]
    and
    [`export_vault_native_data`][derivepassphrase.exporter.vault_native.export_vault_native_data].
    A new dispatch function
    [`export_vault_config_data`][derivepassphrase.exporter.export_vault_config_data]
    automatically calls the correct backend, based on the requested format.

This is a **breaking API change** due to the change in function
    parameter names and return types.

- Convert `KeyCommentPair` from [`derivepassphrase._types`][], and
    `KeyPair` and `MasterKeys` from
    [`derivepassphrase.exporter.storeroom`][], to
    [`NamedTuple`s][typing.NamedTuple]. Also rename them to
    [`SSHKeyCommentPair`][derivepassphrase._types.SSHKeyCommentPair],
    [`StoreroomKeyPair`][derivepassphrase._types.StoreroomKeyPair] and
    [`StoreroomMasterKeys`][derivepassphrase._types.StoreroomMasterKeys],
    respectively, in the [`derivepassphrase._types`][] module.

This is a **breaking API change**.

- Move the non-essential content of the [`derivepassphrase.cli`][] module
    into the "internals" subpackage.

This is a **breaking API change** due to the removal of most functions
    from the [`derivepassphrase.cli`][] module.

- For [`derivepassphrase vault`][CLI_VAULT], change the handling of the
 notes for better compatibility with vault(1) and for better
 internal consistency:

1. Correctly require the `--config` option in addition to the `--notes`
 option to request that the service notes be edited, for
 compatibility with vault(1).
 Issue a warning if `--notes` is used without `--config`.

2.  `notes` is now also a valid setting name for `--unset` to take.

3.  Editing the notes successfully in any way, including no-op edits,
        will register the service name as a known service to
        [`derivepassphrase vault`][CLI_VAULT], even if the settings are
        otherwise empty.

- For [`derivepassphrase vault`][CLI_VAULT], by default, use an editor interface that matches
 vault(1): the contents of the edited text file are used directly
 as the service notes, without interpretation.

Previously, we post-processed the text file to remove comments and our
    instruction texts, and interpreted an empty file as a request to abort
    the edit.
    These two editor interfaces ("legacy" and "modern") can be explicitly
    selected, and for the legacy interface, which is less resilient against
    data entry or usage errors, a backup copy of the old notes content is
    made.

- For developers: Use a different feature matrix and different
    [hypothesis][] profiles in the test suite.
    The slowdown caused by coverage measurement is now more accurately
    estimated and adjusted for in the [hypothesis][] settings.

- For developers: Clean up, partly reorganize, and document the test
    suite, at least rudimentarily.
    Also add several new [hypothesis][]-based tests, particularly to test
    the core assumptions of the [vault][derivepassphrase.vault] derivation
    scheme about sensitivity (or lack thereof) to its inputs and its input
    formats.

- For developers: For [`derivepassphrase vault`][CLI_VAULT], store our
    `vault.json` data file in pretty-printed form.
    This is a stopgap measure to ease debugging and introspection until
    better built-in query functionality for the effective configuration is
    available, because users should not be rewarded for meddling around in
    data files.
    →[:material-file-document-plus-outline:][WISH_PRETTY_PRINT_JSON]

### Fixed  {#fixed-in-v0.5}

- Fix the misbehaving shell completion for `zsh` in the presence of colons
    in the completion item.
    This was due to an overzealous workaround for
    [`pallets/click#2703`](https://github.com/pallets/click/issues/2703).

- For [`derivepassphrase vault`][CLI_VAULT], when exporting a vault
    configuration, export a pretty-printed configuration, to ease debugging
    and introspection.
    →[:material-file-document-plus-outline:][WISH_PRETTY_PRINT_JSON]

- For [`derivepassphrase vault`][CLI_VAULT], also print the service notes
 (if any) when deriving a service passphrase, just like vault(1)
 does.
 →[:material-bug:][BUG_PRINT_SERVICE_NOTES]

- Lock our internals and their configuration against concurrent
    modifications.
    →[:material-bug:][BUG_CONCURRENCY_AUDIT]

- Test against PyPy 3.11.

- Test on <abbr title="Microsoft Windows">The Annoying OS</abbr> in its
 baseline version, i.e., without SSH agent functionality but with
 `cryptography` support.
 Fix all incompatibilities in the test suite if essential and/or
 feasible, otherwise document them as skips or expected failures.

(The latter case currently only concerns one single test that is
 supposed to trigger OS errors while attempting to read the
 `derivepassphrase` configuration files.
 <abbr title="Microsoft Windows">The Annoying OS</abbr> happily returns
 an empty file instead.)

- For developers: Include build machinery to ensure consistency of our
    version number and our diagnostic messages between the documentation and
    the code, instead of having to check this by hand.

(The canonical way to get the version number is the
    [`importlib.metadata.version`][] standard library interface.)

- For developers: Test our locking implementation for correctness, on both
    sides of the API.
    Specifically, test that the respective platform-specific locking
    primitives provide the requested mutual exclusion properties, and that
    the locking system as a whole, when given functioning locking
    primitives, correctly serializes access to the facilities it is supposed
    to guard.
    →[:material-bug:][BUG_CONCURRENCY_TESTING_IN_TEST_SUITE]

## 0.4.0 (2025-01-07)  {#v0.4.0}

### Added  {#added-in-v0.4.0}

- For [`derivepassphrase vault`][CLI_VAULT] and [`derivepassphrase export
    vault`][CLI_EXPORT_VAULT], support changing the amount of diagnostic
    output we emit via new command-line options `--debug`, `-v`/`--verbose`
    and `-q`/`--quiet`.
    Internally, we use Python's standard [logging][] and [warnings][]
    systems.

- Use a central configuration file, and additional data files, some of
    which are service-specific.
    (The `vault.json` configuration file is now rebranded as a data file.)
    The configuration files are user-editable, the data files are
    [`derivepassphrase`][CLI]-editable.

The configuration files are in TOML format, so installing
    `derivepassphrase` on Python 3.10 and older requires the
    [`tomli`][tomli] package.

- For [`derivepassphrase vault --config`][CLI_VAULT], support an `--unset`
    option which unsets any given named setting prior to applying any other
    configuration changes.

- For [`derivepassphrase vault --export`][CLI_VAULT], support exporting
    the current configuration as a POSIX `sh` script, using the
    `--export-as=sh` option.  The default (and previous behavior) is
    `--export-as=json`.

- Include basic support for localization: if the necessary translations
    are installed, then the diagnostics and help texts can be emitted in
    different languages.
    Internally, we use Python's standard [`gettext`][] system.

(As of this version, no translations have actually been prepared yet.)

- For [`derivepassphrase`][CLI], explicitly support shell completion, in
    particular filename and service name completion in the [`export
    vault`][CLI_EXPORT_VAULT] and [`vault`][CLI_VAULT] subcommands.

However, because of restrictions regarding the exchange of data between
    `derivepassphrase` and the shell, `derivepassphrase` will not offer any
    service names containing ASCII control characters for completion, and
    a warning will be issued when importing or configuring such a service.
    They may still otherwise be used normally.

- Support the semi-standard
 `NO_COLOR` and the `FORCE_COLOR` environment variables to suppress
 or force color output from [`derivepassphrase`][CLI]. (`FORCE_COLOR`
 overrides `NO_COLOR` if both are set.)

### Changed  {#changed-in-v0.4.0}

- Calling
    [`derivepassphrase_export`][derivepassphrase.cli.derivepassphrase_export],
    [`derivepassphrase_export_vault`][derivepassphrase.cli.derivepassphrase_export_vault]
    or
    [`derivepassphrase_vault`][derivepassphrase.cli.derivepassphrase_vault],
    or calling [`derivepassphrase`][derivepassphrase.cli.derivepassphrase]
    via its [`.main`][click.Command.main] method, causes those functions
    to use the standard Python [logging][] and [warnings][] facilities to
    issue diagnostic messages, without output to standard error.
    (This includes using [`click.testing.CliRunner`][], which uses `.main`
    calls under the hood.)
    Calling [`derivepassphrase`][derivepassphrase.cli.derivepassphrase]
    directly as a function diverts diagnostic messages to standard error.

- Unicode normalization settings for `vault` service names and stored
    passphrases are now stored in the central configuration file, instead of
    the `vault` data file.

- `derivepassphrase` changed its license from [MIT][] to [zlib/libpng][].
    This should only make a difference to people redistributing altered
    versions of `derivepassphrase`; the basic freedoms, and the
    combinability of `derivepassphrase` with other software should be
    unaffected.

[MIT]: https://spdx.org/licenses/MIT.html
[zlib/libpng]: https://spdx.org/licenses/Zlib.html

## 0.3.3 (2024-11-28)  {#v0.3.3}

### Added  {#added-in-v0.3.3}

- Checking whether an SSH key is suitable now also depends on the SSH
    agent in use.
    API functions now optionally take an additional
    [`SSHAgentClient`][derivepassphrase.ssh_agent.SSHAgentClient] object to
    test agent-specific key suitability.
    If not given, then the old behavior is retained: SSH keys are suitable
    if they are suitable under any (conforming) SSH agent.

### Fixed  {#fixed-in-v0.3.3}

- If the SSH agent supports deterministic DSA/ECDSA signatures (e.g.
    [RFC 6979][]), then mark DSA and ECDSA SSH keys as suitable.

## 0.3.2 (2024-10-21)  {#v0.3.2}

### Fixed  {#fixed-in-v0.3.2}

- _*Actually* actually_ remove the `derivepassphrase_export` program,
    which was turned into a subcommand in v0.2.0 and supposed to have been
    removed in v0.3.1 already.
    Removed on disk is not the same as removed in version control.

## 0.3.1 (2024-10-21)  {#v0.3.1}

### Fixed  {#fixed-in-v0.3.1}

- Fix PyPI classification: Python 3.9 is supported.
  - *Actually* remove the `derivepassphrase_export` program, which was
    turned into a subcommand in v0.2.0.

## 0.3.0 (2024-10-15)  {#v0.3.0}

### Added  {#added-in-v0.3.0}

- Convert changelog management from towncrier to [scriv][].
  - Add SSH agent spawning support to the test suite.
    Use this support to test the agent functionality on all known major SSH
    agent implementations automatically.
    →[:material-file-document-plus-outline:][WISH_TEST_SUITE_ISOLATED_SSH_AGENT]
  - Add [hypothesis][]-based tests to the test suite.
  - Update README to add explanations for virtual environments and package
    extras.
  - Update README to demonstrate configuration storing and SSH agent use.
    Include comments on Windows support for SSH agents.
    →[:material-bug:][BUG_WINDOWS_SSH_AGENT_SUPPORT]
  - Use cross-references in the documentation of function signatures.
  - Add proper support for Buffer types in the SSH agent client.
    Any Python object supporting the buffer protocol can be used as input to
    a function of the client, and any output from the client is returned as
    bytes objects.
    Because of the zero-copy semantics of the underlying data/memory block,
    this should stay relatively time- and space-efficient.
  - Add [hypothesis][]-based tests for serialization to and
    deserialization from the SSH agent wire format.
  - Support Python 3.9 and 3.13.

### Changed  {#changed-in-v0.3.0}

- Change links to point to public project repositories, if possible.
    For legal reasons.

- Use the same filename/URL convention for API reference as the Python
    standard library does.

- Rewrite functionality for checking for valid vault(1)
 configurations: include an actual validation function which throws
 errors upon encountering format violations, and which allows specifying
 which types of extensions (unknown settings, `derivepassphrase`-only
 settings) to tolerate during validation.

This is a **breaking API change** because the function return annotation
    changed, from [`typing.TypeGuard`][] to [`typing_extensions.TypeIs`][].
    These were the originally intended semantics, but when
    `derivepassphrase` was first designed, the Python type system did not
    support this kind of partial type narrowing.

- Fail earlier, and more gracefully/specifically, when we cannot talk to
    the SSH agent because Python does not support UNIX domain sockets on
    this system.
    In particular, this is the current situation on Windows.
    →[:material-bug:][BUG_FAIL_GRACEFULLY_WITHOUT_AF_UNIX]
    [:material-bug:][BUG_WINDOWS_SSH_AGENT_SUPPORT]

This adds another failure case to the `SSHAgentClient` constructor, and
    therefore constitutes a **breaking API change**.

- In [`derivepassphrase vault`][CLI_VAULT], accept `key` and `phrase`
 entries just like vault(1) does: `key` always overrides `phrase`
 in the configuration, no matter the level.

This is a command-line only change.

- In [`derivepassphrase vault`][CLI_VAULT], when importing settings,
    accept falsy values everywhere `vault` does, with a warning.
    Depending on the setting, they are equivalent to zero, the empty string,
    or "not set".
    →[:material-bug:][BUG_FALSY_VAULT_CONFIG_VALUES]

This is a command-line only change, and only affects importing.
    The API provides a new function to normalize falsy settings, but still
    otherwise requires settings to be of the correct type.
    Storing a malformed configuration with such falsy values will still
    generate errors when [`derivepassphrase vault`][CLI_VAULT] loads the
    settings from disk.

- In [`derivepassphrase vault`][CLI_VAULT], when importing configurations,
 correctly merge them with the existing one, same as vault(1):
 keep all named services and their settings (and the global settings if
 applicable) that are not mentioned in the imported configuration.
 The import procedure is thus more akin to a section-wise import of
 the configurations, instead of a "full" import, and the resulting
 configuration generally is a merge of both inputs.
 →[:material-bug:][BUG_AMEND_VAULT_CONFIG]

- The following operations or configuration settings now raise
    warnings:

* in imported configurations: using falsy values of the wrong type
      * in imported configurations: using falsy values with no practical
        effect
      * setting a passphrase in the configuration if a key is already
        set
      * using an empty service name on the command-line or in an
        imported configuration

### Fixed  {#fixed-in-v0.3.0}

- Fixed the textual description of the return value for
    [`SSHAgentClient.request`][derivepassphrase.ssh_agent.SSHAgentClient.request],
    which didn't match the declared type annotation.

## 0.2.0 (2024-09-12)  {#v0.2.0}

### Added  {#added-in-v0.2.0}

- Support configuration data export from `vault` in v0.2, v0.3 and
    storeroom formats.

This feature requires the `cryptography` Python module, but is available
    even if `vault` is not installed.
    →[:material-file-document-plus-outline:][WISH_EXPORT_VAULT_FORMATS]

### Fixed  {#fixed-in-v0.2.0}

- Deploy versioned documentation with [mike][].
 Set up a "latest" tag and the "0.<var>x</var>" version of the
 documentation with the contents so far.

### Changed  {#changed-in-v0.2.0}

- Changed `sequin` and `ssh_agent_client` to be submodules of
    `derivepassphrase`.
    Further moved `derivepassphrase.Vault` and
    `derivepassphrase.AmbiguousByteRepresentation` into a new submodule
    `vault`, and renamed submodule `ssh_agent_client` to `ssh_agent`.
    →[:material-bug:][BUG_SINGLE_TOPLEVEL_MODULE]
  - Changed internal error handling and error messages, to better work in
    the context of a command-line tool.
    →[:material-bug:][BUG_BETTER_ERROR_MESSAGES]
  - Combine and consolidate `derivepassphrase.types` and
    `derivepassphrase.ssh_agent.types` into a new submodule
    `derivepassphrase._types`.
    Despite the name, the module is public.
    →[:material-bug:][BUG_NO_STDLIB_MODULE_NAMES]
  - Warn the user when entering (directly, or via configuration
    editing/importing) a passphrase that is not in the configured Unicode
    normalization form.
    (But don't otherwise reject any textual master passphrases.)
    →[:material-bug:][BUG_ALLOW_ALL_UNICODE_PASSPHRASES]
  - Move all existing functionality into a subcommand, in anticipation of
    other passphrase derivation schemes, with different settings.
    Automatically forward calls without a subcommand to the "vault"
    subcommand.

Also store the settings in a file specific to the respective subsystem,
    instead of globally.
    Automatically fall back to, and migrate, the old global settings file if
    no subsystem-specific configuration was found.
    →[:material-file-document-plus-outline:][WISH_OTHER_DERIVATION_SCHEMES]
    [:material-file-document-plus-outline:][WISH_SCHEME_SPECIFIC_CLI_AND_CONFIG]

- Make `derivepassphrase_export` a subcommand: [`derivepassphrase
    export`][CLI_EXPORT].
    →[:material-file-document-plus-outline:][WISH_EXPORTER_SCRIPT_AS_SUBCOMMAND]

### Deprecated  {#deprecated-in-v0.2.0}

- Using the implied subcommand or the implied global settings file is
    deprecated, and will be removed in v1.0.

## 0.1.3 (2024-07-28)  {#v0.1.3}

### Fixed  {#fixed-in-v0.1.3}

- Do not crash upon selecting a key on the command-line if there already
    is a key stored in the configuration.
    →[:material-bug:][BUG_ONE_TIME_KEY_OVERRIDE_FAILS]
  - Create the configuration directory upon saving, if it does not yet
    exist.
    →[:material-bug:][BUG_CONFIGURATION_DIRECTORY_MUST_EXIST]
  - Isolate the tests properly and consistently from the user's
    configuration, so that user configuration problems do not cause
    unrelated test failures.
    →[:material-bug:][BUG_TEST_FILESYSTEM_ISOLATION]
  - Add an alternate MkDocs configuration for building the documentation in
    offline mode.
  - Fix typing issues according to `mypy`'s strict mode.

## 0.1.2 (2024-07-22)  {#v0.1.2}

### Fixed  {#fixed-in-v0.1.2}

- Include and exclude the correct files in the `sdist` and `wheel`
    distributions.
    (Previously, `sdist` contained VCS artifacts, and `wheel` was missing
    some paths.)
  - Lint and reformat all code using [ruff][].
  - Mention [`mkdocstrings-python`][mkdocstrings-python] in the
    documentation's page footer.
  - Remove JavaScript and external font loading from documentation website,
    so that the site works even in restricted browser settings.
  - Set up a changelog, using [towncrier][].

## 0.1.1 (2024-07-14)  {#v0.1.1}

### Fixed  {#fixed-in-v0.1.1}

- Restore the `__version__` attribute in all top-level packages.
  - Declare compatibility with Python 3.10 in project metadata, and include
    necessary version-specific dependencies.
  - Publish the documentation online, and link to it in the repository
    metadata and the Python package metadata.

## 0.1.0 (2024-07-14)  {#v0.1.0}

### Added  {#added-in-v0.1.0}

- Initial release.

[^the-annoying-os]: Hat tip---and apologies---to
    [Timothée Mazzucotelli (`@pawamoy`)](https://github.com/pawamoy/) for
    the fitting terminology.

[hypothesis]: https://pypi.org/project/hypothesis/
[mike]: https://pypi.org/project/mike/
[mkdocstrings-python]: https://pypi.org/project/mkdocstrings-python/
[ruff]: https://pypi.org/project/ruff/
[scriv]: https://pypi.org/project/scriv/
[tomli]: https://pypi.org/project/tomli/
[towncrier]: https://pypi.org/project/towncrier/

[RFC 6979]: https://www.rfc-editor.org/rfc/rfc6979

[OpenSSH]: https://www.openssh.org
[PuTTY]: https://putty.software
[GnuPG]: https://gnupg.org

[CLI]: reference/derivepassphrase.1.md
[CLI_EXPORT]: reference/derivepassphrase-export.1.md
[CLI_EXPORT_VAULT]: reference/derivepassphrase-export-vault.1.md
[CLI_VAULT]: reference/derivepassphrase-vault.1.md
[INTERCHANGEABLE_PASSPHRASES]: explanation/faq-vault-interchangeable-passphrases.md
[REFERENCE]: reference/index.md

[BUG_ALLOW_ALL_UNICODE_PASSPHRASES]: wishlist/allow-all-unicode-passphrases.md "Bug entry: “Allow all Unicode text strings as master passphrases”"
[BUG_AMEND_VAULT_CONFIG]: wishlist/amend-vault-config.md "Bug entry: “derivepassphrase vault --import overwrites config instead of amending it”"
[BUG_BETTER_ERROR_MESSAGES]: wishlist/better-error-messages.md "Bug entry: “Improve common error messages in the command-line interface”"
[BUG_CONCURRENCY_AUDIT]: wishlist/concurrency-audit.md "Bug entry: “Audit derivepassphrase for concurrency/thread-safety issues”"
[BUG_CONCURRENCY_TESTING_IN_TEST_SUITE]: wishlist/concurrency-testing-in-test-suite.md "Bug entry: “Test for concurrency and assert thread-safety in derivepassphrase's test suite”"
[BUG_CONFIGURATION_DIRECTORY_MUST_EXIST]: wishlist/configuration-directory-must-exist.md "Bug entry: “derivepassphrase --config requires configuration directory to exist”"
[BUG_FAIL_GRACEFULLY_WITHOUT_AF_UNIX]: wishlist/fail-gracefully-without-af-unix.md "Bug entry: “Fail gracefully if support for UNIX domain sockets is unavailable”"
[BUG_FALSY_VAULT_CONFIG_VALUES]: wishlist/falsy-vault-config-values.md "Bug entry: “derivepassphrase vault differs from vault(1) behavior with falsy stored configuration values”"
[BUG_NO_STDLIB_MODULE_NAMES]: wishlist/no-stdlib-module-names.md "Bug entry: “Rename types submodules to _types”"
[BUG_ONE_TIME_KEY_OVERRIDE_FAILS]: wishlist/one-time-key-override-fails.md "Bug entry: “derivepassphrase -k fails when overriding the chosen key on the command-line”"
[BUG_OPENSSH_BUG3967_WORKAROUND]: wishlist/openssh-bug3967-workaround.md "Bug entry: “Work around faulty query response in OpenSSH 10.3”"
[BUG_PRINT_SERVICE_NOTES]: wishlist/print-service-notes.md "Bug entry: “derivepassphrase vault does not print service notes”"
[BUG_SINGLE_TOPLEVEL_MODULE]: wishlist/single-toplevel-module.md "Bug entry: “Move sequin and ssh_agent_client modules into derivepassphrase package”"
[BUG_TEST_FILESYSTEM_ISOLATION]: wishlist/test-filesystem-isolation.md "Bug entry: “Isolate tests properly from the filesystem”"
[BUG_WINDOWS_SSH_AGENT_SUPPORT]: wishlist/windows-ssh-agent-support.md "Bug entry: “Support PuTTY/Pageant (and maybe OpenSSH/ssh-agent) on Windows”"
[WISH_CONVENTIONAL_CONFIGURABLE_TEXT_STYLING]: wishlist/conventional-configurable-text-styling.md "Wish entry: “derivepassphrase vault should support conventional and configurable text styling”"
[WISH_EXPORTER_SCRIPT_AS_SUBCOMMAND]: wishlist/exporter-script-as-subcommand.md "Wish entry: “Make the exporter a subcommand of derivepassphrase”"
[WISH_EXPORT_VAULT_FORMATS]: wishlist/export-vault-formats.md "Wish entry: “Support data export from vault v0.2, vault v0.3, and storeroom storage formats”"
[WISH_OTHER_DERIVATION_SCHEMES]: wishlist/other-derivation-schemes.md "Wish entry: “Consider implementing passphrase schemes other than vault's”"
[WISH_PRETTY_PRINT_JSON]: wishlist/pretty-print-json.md "Wish entry: “derivepassphrase vault should store and export the vault configuration in pretty-printed JSON”"
[WISH_PRINT_SERVICE_NOTES_ABOVE]: wishlist/print-service-notes-above.md "Wish entry: “derivepassphrase vault should be able to print service notes above the passphrase”"
[WISH_REPORT_BUILD_FLAGS_AND_FEATURES]: wishlist/report-build-flags-and-features.md "Wish entry: “derivepassphrase should report its build flags and supported features”"
[WISH_SCHEME_SPECIFIC_CLI_AND_CONFIG]: wishlist/scheme-specific-cli-and-config.md "Wish entry: “Move vault-specific command-line interface into a separate CLI subcommand and matching configuration file”"
[WISH_TEST_SUITE_ISOLATED_SSH_AGENT]: wishlist/test-suite-isolated-ssh-agent.md "Wish entry: “Support and isolate OpenSSH's ssh-agent and PuTTY's pageant in the test suite”"

derivepassphrase.git

Fix more instances of the common typo at "interchangeable"