derivepassphrase.git

@@ -123,7 +123,7 @@ detached = false

 [tool.hatch.envs.hatch-static-analysis]

 config-path = "/dev/null"

 dependencies = [

-  "ruff ~= 0.6.0",

+  "ruff ~= 0.8.0",

 ]

 [tool.hatch.envs.hatch-test]

@@ -245,7 +245,7 @@ select = [

     'ANN', 'ASYNC', 'S', 'BLE', 'FBT', 'B', 'A', 'COM',

     'CPY', 'C4', 'DTZ', 'T10', 'DJ', 'EM', 'EXE', 'FA',

     'ISC', 'ICN', 'LOG', 'G', 'INP', 'PIE', 'T20', 'PYI',

-    'PT', 'Q', 'RET', 'SLF', 'SLOT', 'SIM', 'TID', 'TCH',

+    'PT', 'Q', 'RET', 'SLF', 'SLOT', 'SIM', 'TID', 'TC',

     'INT', 'ARG',

     # We currently do not use pathlib. Disable 'PTH'.

     'TD',

@@ -1245,7 +1245,7 @@ def _write_pot_file(fileobj: TextIO) -> None:  # pragma: no cover

     appearing in the enums of this module.  Certain parts of the

     .po header are hard-coded, as is the source filename.

-    """

+    """  # noqa: DOC501

     entries: dict[

         str,

         dict[

@@ -1266,7 +1266,7 @@ def _write_pot_file(fileobj: TextIO) -> None:  # pragma: no cover

                 msg in entries.setdefault(ctx, {})

                 and entries[ctx][msg] != member

             ):

-                raise AssertionError(  # noqa: DOC501,TRY003

+                raise AssertionError(  # noqa: TRY003

                     f'Duplicate entry for ({ctx!r}, {msg!r}): '  # noqa: EM102

                     f'{entries[ctx][msg]!r} and {member!r}'

                 )

@@ -288,8 +288,7 @@ def validate_vault_config(  # noqa: C901,PLR0912

     def err_unknown_setting(key: str, path: Sequence[str], /) -> str:

         json_path_str = json_path(path)

         return (

-            f'vault config entry {json_path_str} uses '

-            f'unknown setting {key!r}'

+            f'vault config entry {json_path_str} uses unknown setting {key!r}'

         )

     def err_bad_number(

@@ -370,7 +369,7 @@ def is_vault_config(obj: Any) -> TypeIs[VaultConfig]:  # noqa: ANN401

     Returns:

         True if this is a vault config, false otherwise.

-    """

+    """  # noqa: DOC501

     try:

         validate_vault_config(

             obj,

@@ -379,7 +378,7 @@ def is_vault_config(obj: Any) -> TypeIs[VaultConfig]:  # noqa: ANN401

         )

     except (TypeError, ValueError) as exc:

         if 'vault config ' not in str(exc):  # pragma: no cover

-            raise  # noqa: DOC501

+            raise

         return False

     return True

@@ -1124,9 +1124,9 @@ def _shell_complete_path(

     parameter: click.Parameter,

     value: str,

 ) -> list[str | click.shell_completion.CompletionItem]:

-    """Request standard path completion for the `path` argument."""

+    """Request standard path completion for the `path` argument."""  # noqa: DOC201

     del ctx, parameter, value

-    return [click.shell_completion.CompletionItem('', type='file')]  # noqa: DOC201

+    return [click.shell_completion.CompletionItem('', type='file')]

 # The standard `click` shell completion scripts serialize the completion

@@ -1294,7 +1294,7 @@ class _DefaultToVaultGroup(CommandWithHelpGroups, click.Group):

         derivepassphrase".  Furthermore, all "pragma" and "noqa" comments

         are also modifications for derivepassphrase.

-        """

+        """  # noqa: DOC201

         cmd_name = click.utils.make_str(args[0])

         # Get the command

@@ -1335,7 +1335,7 @@ class _DefaultToVaultGroup(CommandWithHelpGroups, click.Group):

             #

             # END modifications for derivepassphrase

             ####

-        return cmd_name if cmd else None, cmd, args[1:]  # noqa: DOC201

+        return cmd_name if cmd else None, cmd, args[1:]

 class _TopLevelCLIEntryPoint(_DefaultToVaultGroup):

@@ -1800,7 +1800,7 @@ def _save_config(config: _types.VaultConfig, /) -> None:

         ValueError:

             The data cannot be stored as a vault(1)-compatible config.

-    """

+    """  # noqa: DOC501

     if not _types.is_vault_config(config):

         raise ValueError(_INVALID_VAULT_CONFIG)

     filename = _config_filename(subsystem='vault')

@@ -1809,7 +1809,7 @@ def _save_config(config: _types.VaultConfig, /) -> None:

         os.makedirs(filedir, exist_ok=False)

     except FileExistsError:

         if not os.path.isdir(filedir):

-            raise  # noqa: DOC501

+            raise

     with open(filename, 'w', encoding='UTF-8') as fileobj:

         json.dump(config, fileobj)

@@ -2795,7 +2795,7 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

             `--export`, selects the format to export the current

             configuration as: JSON ("json", default) or POSIX sh ("sh").

-    """

+    """  # noqa: DOC501

     logger = logging.getLogger(PROG_NAME)

     deprecation = logging.getLogger(PROG_NAME + '.deprecation')

     service_metavar = _msg.TranslatedString(_msg.Label.VAULT_METAVAR_SERVICE)

@@ -2818,7 +2818,7 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

             elif isinstance(param, StandardOption):

                 group = StandardOption

             elif isinstance(param, OptionGroupOption):  # pragma: no cover

-                raise AssertionError(  # noqa: DOC501,TRY003,TRY004

+                raise AssertionError(  # noqa: TRY003,TRY004

                     f'Unknown option group for {param!r}'  # noqa: EM102

                 )

             else:

@@ -3003,7 +3003,7 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

                 param=param.opts[0],

                 service_metavar=service_metavar,

             )

-            raise click.UsageError(str(err_msg))  # noqa: DOC501

+            raise click.UsageError(str(err_msg))

     sv_options = [params_by_str['--notes'], params_by_str['--delete']]

     for param in sv_options:

         if is_param_set(param) and not service is not None:

@@ -3452,9 +3452,9 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

                 for setting in unset_settings:

                     subtree.pop(setting, None)

             subtree.update(view)

-            assert _types.is_vault_config(

-                configuration

-            ), f'Invalid vault configuration: {configuration!r}'

+            assert _types.is_vault_config(configuration), (

+                f'Invalid vault configuration: {configuration!r}'

+            )

             put_config(configuration)

         else:

             assert service is not None

@@ -739,9 +739,9 @@ def export_storeroom_data(  # noqa: C901,PLR0912,PLR0914,PLR0915

                 # Of course, the type checker doesn't necessarily know

                 # this, so we need to use assertions anyway.

                 maybe_obj = obj.get(part)

-                assert isinstance(

-                    maybe_obj, dict

-                ), f'Cannot traverse storage path {_dir!r}'

+                assert isinstance(maybe_obj, dict), (

+                    f'Cannot traverse storage path {_dir!r}'

+                )

                 obj = maybe_obj

         if set(obj.keys()) != set(namelist):

             msg = f'Object key mismatch for path {_dir!r}'

@@ -112,6 +112,10 @@ class VaultNativeConfigParser(abc.ABC):

                 If this is a text string, then the UTF-8 encoding of the

                 string is used as the binary password.

+        Raises:

+            ValueError:

+                The password must not be empty.

+

         Warning:

             Non-public class, provided for didactical and educational

             purposes only. Subject to change without notice, including

@@ -120,7 +124,7 @@ class VaultNativeConfigParser(abc.ABC):

         """

         if not password:

             msg = 'Password must not be empty'

-            raise ValueError(msg)  # noqa: DOC501

+            raise ValueError(msg)

         self._contents = bytes(contents)

         self._iv_size = 0

         self._mac_size = 0

@@ -208,12 +212,12 @@ class VaultNativeConfigParser(abc.ABC):

     def _derive_keys(self) -> None:

         logger.info('Deriving an encryption and signing key')

         self._generate_keys()

-        assert (

-            len(self._encryption_key) == self._encryption_key_size

-        ), 'Derived encryption key is invalid'

-        assert (

-            len(self._signing_key) == self._signing_key_size

-        ), 'Derived signing key is invalid'

+        assert len(self._encryption_key) == self._encryption_key_size, (

+            'Derived encryption key is invalid'

+        )

+        assert len(self._signing_key) == self._signing_key_size, (

+            'Derived signing key is invalid'

+        )

     @abc.abstractmethod

     def _generate_keys(self) -> None:

@@ -348,7 +352,7 @@ class VaultNativeV02ConfigParser(VaultNativeConfigParser):

             buffer = bytearray()

             last_block = b''

             salt = b''

-            logging.debug(

+            logger.debug(

                 (

                     'data = %s, salt = %s, key_size = %s, iv_size = %s, '

                     'buffer length = %s, buffer = %s'

@@ -371,10 +375,10 @@ class VaultNativeV02ConfigParser(VaultNativeConfigParser):

                 block.update(salt)

                 last_block = block.finalize()

                 buffer.extend(last_block)

-                logging.debug(

+                logger.debug(

                     'buffer length = %s, buffer = %s', len(buffer), _h(buffer)

                 )

-            logging.debug(

+            logger.debug(

                 'encryption_key = %s, iv = %s',

                 _h(buffer[:key_size]),

                 _h(buffer[key_size:total_size]),

@@ -457,13 +461,11 @@ def export_vault_native_data(

                 stored_exception = exc

         else:  # pragma: no cover

             msg = (

-                f'Invalid vault native configuration format: '

-                f'{config_format!r}'

+                f'Invalid vault native configuration format: {config_format!r}'

             )

             raise ValueError(msg)

     msg = (

-        f'Not a valid vault native configuration. '

-        f'(We tried: {try_formats!r}.)'

+        f'Not a valid vault native configuration. (We tried: {try_formats!r}.)'

     )

     raise stored_exception or ValueError(msg)

@@ -194,7 +194,7 @@ class Sequin:

             >>> Sequin._big_endian_number([1, 7, 5, 5], base=8) == 0o1755

             True

-        """

+        """  # noqa: DOC501

         if base < 2:  # noqa: PLR2004

             msg = f'invalid base: {base!r}'

             raise ValueError(msg)

@@ -206,7 +206,7 @@ class Sequin:

             x = digits[i]

             if not isinstance(x, int):

                 msg = f'not an integer: {x!r}'

-                raise TypeError(msg)  # noqa: DOC501

+                raise TypeError(msg)

             if x not in allowed_range:

                 msg = f'invalid base {base!r} digit: {x!r}'

                 raise ValueError(msg)

@@ -201,12 +201,12 @@ class SSHAgentClient:

             >>> SSHAgentClient.string(b'ssh-rsa')

             b'\x00\x00\x00\x07ssh-rsa'

-        """

+        """  # noqa: DOC501

         try:

             payload = memoryview(payload)

         except TypeError as e:

             msg = 'invalid payload type'

-            raise TypeError(msg) from e  # noqa: DOC501

+            raise TypeError(msg) from e

         ret = bytearray()

         ret.extend(cls.uint32(len(payload)))

         ret.extend(payload)

@@ -326,7 +326,7 @@ class SSHAgentClient:

                 `conn` was a socket or `None`, and there was an error

                 setting up a socket connection to the agent.

-        """

+        """  # noqa: DOC501

         # Use match/case here once Python 3.9 becomes unsupported.

         if isinstance(conn, SSHAgentClient):

             with contextlib.nullcontext():

@@ -337,7 +337,7 @@ class SSHAgentClient:

         else:  # pragma: no cover

             assert_never(conn)

             msg = f'invalid connection hint: {conn!r}'

-            raise TypeError(msg)  # noqa: DOC501

+            raise TypeError(msg)

     def _agent_is_pageant(self) -> bool:

         """Return True if we are connected to Pageant.

@@ -641,10 +641,10 @@ class SSHAgentClient:

         msg = 'Malformed response from SSH agent'

         msg2 = 'Extension response message does not match request'

         try:

-            _query, response_data = self.unstring_prefix(response_data)

+            query, response_data = self.unstring_prefix(response_data)

         except ValueError as e:

             raise RuntimeError(msg) from e

-        if bytes(_query) != b'query':

+        if bytes(query) != b'query':

             raise RuntimeError(msg2)

         while response_data:

             try:

@@ -232,6 +232,9 @@ class Vault:

         Returns:

             The estimated sufficient hash length.

+        Raises:

+            ValueError: The safety factor is less than 1, or not finite.

+

         Warning:

             This is a heuristic, not an exact computation; it may

             underestimate the true necessary hash length.  It is

@@ -239,15 +242,15 @@ class Vault:

             hash length, usually by doubling the hash length each time

             it does not yet prove so.

-        """

+        """  # noqa: DOC501

         try:

             safety_factor = float(safety_factor)

         except TypeError as e:

             msg = f'invalid safety factor: not a float: {safety_factor!r}'

-            raise TypeError(msg) from e  # noqa: DOC501

+            raise TypeError(msg) from e

         if not math.isfinite(safety_factor) or safety_factor < 1.0:

             msg = f'invalid safety factor {safety_factor!r}'

-            raise ValueError(msg)  # noqa: DOC501

+            raise ValueError(msg)

         # Ensure the bound is strictly positive.

         entropy_bound = max(1, self._entropy())

         return int(math.ceil(safety_factor * entropy_bound / 8))

@@ -254,7 +254,9 @@ def running_ssh_agent(  # pragma: no cover

                 assert (

                     os.environ.get('SSH_AUTH_SOCK', None)

                     == startup_ssh_auth_sock

-                ), f'SSH_AUTH_SOCK mismatch when checking for spawnable {exec_name}'

+                ), (

+                    f'SSH_AUTH_SOCK mismatch when checking for spawnable {exec_name}'

+                )

                 proc = spawn_func(executable=shutil.which(exec_name), env={})

                 if proc is None:

                     continue

@@ -370,7 +372,9 @@ def spawn_ssh_agent(

         else:

             assert (

                 os.environ.get('SSH_AUTH_SOCK', None) == startup_ssh_auth_sock

-            ), f'SSH_AUTH_SOCK mismatch when checking for spawnable {exec_name}'

+            ), (

+                f'SSH_AUTH_SOCK mismatch when checking for spawnable {exec_name}'

+            )

             proc = spawn_func(

                 executable=shutil.which(exec_name), env=agent_env

             )

@@ -310,12 +310,12 @@ class TestAllCLI:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase,

                 [*command, *arguments, *non_eager_arguments],

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(empty_stderr=True), 'expected clean exit'

     @pytest.mark.parametrize('no_color', [False, True])

@@ -351,22 +351,22 @@ class TestAllCLI:

                 monkeypatch.setenv('NO_COLOR', 'yes')

             if force_color:

                 monkeypatch.setenv('FORCE_COLOR', 'yes')

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase,

                 command_line,

                 input=input,

                 catch_exceptions=False,

                 color=isatty,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

         assert (

             not color

             or '\x1b[0m' in result.stderr

             or '\x1b[m' in result.stderr

         ), 'Expected color, but found no ANSI reset sequence'

-        assert (

-            color or '\x1b[' not in result.stderr

-        ), 'Expected no color, but found an ANSI control sequence'

+        assert color or '\x1b[' not in result.stderr, (

+            'Expected no color, but found an ANSI control sequence'

+        )

 class TestCLI:

@@ -379,12 +379,12 @@ class TestCLI:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--help'],

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(

             empty_stderr=True, output='Passphrase generation:\n'

         ), 'expected clean exit, and option groups in help text'

@@ -401,18 +401,18 @@ class TestCLI:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--version'],

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

-        assert result.clean_exit(

-            empty_stderr=True, output=cli.PROG_NAME

-        ), 'expected clean exit, and program name in version text'

-        assert result.clean_exit(

-            empty_stderr=True, output=cli.__version__

-        ), 'expected clean exit, and version in help text'

+            result = tests.ReadableResult.parse(result_)

+        assert result.clean_exit(empty_stderr=True, output=cli.PROG_NAME), (

+            'expected clean exit, and program name in version text'

+        )

+        assert result.clean_exit(empty_stderr=True, output=cli.__version__), (

+            'expected clean exit, and version in help text'

+        )

     @pytest.mark.parametrize(

         'charset_name', ['lower', 'upper', 'number', 'space', 'dash', 'symbol']

@@ -428,18 +428,18 @@ class TestCLI:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 [option, '0', '-p', '--', DUMMY_SERVICE],

                 input=DUMMY_PASSPHRASE,

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(empty_stderr=True), 'expected clean exit:'

         for c in charset:

-            assert (

-                c not in result.output

-            ), f'derived password contains forbidden character {c!r}'

+            assert c not in result.output, (

+                f'derived password contains forbidden character {c!r}'

+            )

     def test_202_disable_repetition(

         self, monkeypatch: pytest.MonkeyPatch

@@ -450,16 +450,16 @@ class TestCLI:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--repeat', '0', '-p', '--', DUMMY_SERVICE],

                 input=DUMMY_PASSPHRASE,

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

-        assert result.clean_exit(

-            empty_stderr=True

-        ), 'expected clean exit and empty stderr'

+            result = tests.ReadableResult.parse(result_)

+        assert result.clean_exit(empty_stderr=True), (

+            'expected clean exit and empty stderr'

+        )

         passphrase = result.output.rstrip('\r\n')

         for i in range(len(passphrase) - 1):

             assert passphrase[i : i + 1] != passphrase[i + 1 : i + 2], (

@@ -503,22 +503,22 @@ class TestCLI:

             monkeypatch.setattr(

                 vault.Vault, 'phrase_from_key', tests.phrase_from_key

             )

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--', DUMMY_SERVICE],

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.clean_exit(

-            empty_stderr=True

-        ), 'expected clean exit and empty stderr'

-        assert _result.stdout_bytes

-        assert (

-            _result.stdout_bytes.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE

-        ), 'known false output: phrase-based instead of key-based'

-        assert (

-            _result.stdout_bytes.rstrip(b'\n') == DUMMY_RESULT_KEY1

-        ), 'expected known output'

+        result = tests.ReadableResult.parse(result_)

+        assert result.clean_exit(empty_stderr=True), (

+            'expected clean exit and empty stderr'

+        )

+        assert result_.stdout_bytes

+        assert result_.stdout_bytes.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE, (

+            'known false output: phrase-based instead of key-based'

+        )

+        assert result_.stdout_bytes.rstrip(b'\n') == DUMMY_RESULT_KEY1, (

+            'expected known output'

+        )

     def test_204b_key_from_command_line(

         self, monkeypatch: pytest.MonkeyPatch

@@ -535,22 +535,22 @@ class TestCLI:

             monkeypatch.setattr(

                 vault.Vault, 'phrase_from_key', tests.phrase_from_key

             )

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['-k', '--', DUMMY_SERVICE],

                 input='1\n',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(), 'expected clean exit'

-        assert _result.stdout_bytes, 'expected program output'

-        last_line = _result.stdout_bytes.splitlines(True)[-1]

-        assert (

-            last_line.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE

-        ), 'known false output: phrase-based instead of key-based'

-        assert (

-            last_line.rstrip(b'\n') == DUMMY_RESULT_KEY1

-        ), 'expected known output'

+        assert result_.stdout_bytes, 'expected program output'

+        last_line = result_.stdout_bytes.splitlines(True)[-1]

+        assert last_line.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE, (

+            'known false output: phrase-based instead of key-based'

+        )

+        assert last_line.rstrip(b'\n') == DUMMY_RESULT_KEY1, (

+            'expected known output'

+        )

     @pytest.mark.parametrize(

         'config',

@@ -593,18 +593,18 @@ class TestCLI:

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch, runner=runner, vault_config=config

             ):

-                _result = runner.invoke(

+                result_ = runner.invoke(

                     cli.derivepassphrase_vault,

                     ['-k', '--', DUMMY_SERVICE],

                     input=f'{key_index}\n',

                 )

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(), 'expected clean exit'

         assert result.output, 'expected program output'

         assert result.stderr, 'expected stderr'

-        assert (

-            'Error:' not in result.stderr

-        ), 'expected no error messages on stderr'

+        assert 'Error:' not in result.stderr, (

+            'expected no error messages on stderr'

+        )

     def test_205_service_phrase_if_key_in_global_config(

         self,

@@ -631,21 +631,21 @@ class TestCLI:

                     },

                 },

             ):

-                _result = runner.invoke(

+                result_ = runner.invoke(

                     cli.derivepassphrase_vault,

                     ['--', DUMMY_SERVICE],

                     catch_exceptions=False,

                 )

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(), 'expected clean exit'

-        assert _result.stdout_bytes, 'expected program output'

-        last_line = _result.stdout_bytes.splitlines(True)[-1]

-        assert (

-            last_line.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE

-        ), 'known false output: phrase-based instead of key-based'

-        assert (

-            last_line.rstrip(b'\n') == DUMMY_RESULT_KEY1

-        ), 'expected known output'

+        assert result_.stdout_bytes, 'expected program output'

+        last_line = result_.stdout_bytes.splitlines(True)[-1]

+        assert last_line.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE, (

+            'known false output: phrase-based instead of key-based'

+        )

+        assert last_line.rstrip(b'\n') == DUMMY_RESULT_KEY1, (

+            'expected known output'

+        )

     @pytest.mark.parametrize(

         ['config', 'command_line'],

@@ -700,13 +700,13 @@ class TestCLI:

                 runner=runner,

                 vault_config=config,

             ):

-                _result = runner.invoke(

+                result_ = runner.invoke(

                     cli.derivepassphrase_vault,

                     command_line,

                     input=DUMMY_PASSPHRASE,

                     catch_exceptions=False,

                 )

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(), 'expected clean exit'

         assert not result.output.strip(), 'expected no program output'

         assert result.stderr, 'expected known error output'

@@ -746,16 +746,16 @@ class TestCLI:

             runner=runner,

         ):

             for value in '-42', 'invalid':

-                _result = runner.invoke(

+                result_ = runner.invoke(

                     cli.derivepassphrase_vault,

                     [option, value, '-p', '--', DUMMY_SERVICE],

                     input=DUMMY_PASSPHRASE,

                     catch_exceptions=False,

                 )

-                result = tests.ReadableResult.parse(_result)

-                assert result.error_exit(

-                    error='Invalid value'

-                ), 'expected error exit and known error message'

+                result = tests.ReadableResult.parse(result_)

+                assert result.error_exit(error='Invalid value'), (

+                    'expected error exit and known error message'

+                )

     @pytest.mark.parametrize(

         ['options', 'service', 'input', 'check_success'],

@@ -780,26 +780,26 @@ class TestCLI:

             runner=runner,

             vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 options if service else [*options, '--', DUMMY_SERVICE],

                 input=input,

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

             if service is not None:

                 err_msg = (

                     ' requires a SERVICE'

                     if service

                     else ' does not take a SERVICE argument'

                 )

-                assert result.error_exit(

-                    error=err_msg

-                ), 'expected error exit and known error message'

+                assert result.error_exit(error=err_msg), (

+                    'expected error exit and known error message'

+                )

             else:

-                assert result.clean_exit(

-                    empty_stderr=True

-                ), 'expected clean exit'

+                assert result.clean_exit(empty_stderr=True), (

+                    'expected clean exit'

+                )

         if check_success:

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch,

@@ -809,13 +809,13 @@ class TestCLI:

                 monkeypatch.setattr(

                     cli, '_prompt_for_passphrase', tests.auto_prompt

                 )

-                _result = runner.invoke(

+                result_ = runner.invoke(

                     cli.derivepassphrase_vault,

                     [*options, '--', DUMMY_SERVICE] if service else options,

                     input=input,

                     catch_exceptions=False,

                 )

-                result = tests.ReadableResult.parse(_result)

+                result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(empty_stderr=True), 'expected clean exit'

     def test_211a_empty_service_name_causes_warning(

@@ -837,34 +837,34 @@ class TestCLI:

             runner=runner,

             vault_config={'services': {}},

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--config', '--length=30', '--', ''],

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(empty_stderr=False), 'expected clean exit'

             assert result.stderr is not None, 'expected known error output'

-            assert all(

-                map(is_expected_warning, caplog.record_tuples)

-            ), 'expected known error output'

+            assert all(map(is_expected_warning, caplog.record_tuples)), (

+                'expected known error output'

+            )

             assert cli._load_config() == {

                 'global': {'length': 30},

                 'services': {},

             }, 'requested configuration change was not applied'

             caplog.clear()

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--import', '-'],

                 input=json.dumps({'services': {'': {'length': 40}}}),

                 catch_exceptions=False,

             )

-            result = tests.ReadableResult.parse(_result)

+            result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(empty_stderr=False), 'expected clean exit'

             assert result.stderr is not None, 'expected known error output'

-            assert all(

-                map(is_expected_warning, caplog.record_tuples)

-            ), 'expected known error output'

+            assert all(map(is_expected_warning, caplog.record_tuples)), (

+                'expected known error output'

+            )

             assert cli._load_config() == {

                 'global': {'length': 30},

                 'services': {'': {'length': 40}},

@@ -889,16 +889,16 @@ class TestCLI:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 [*options, '--', DUMMY_SERVICE] if service else options,

                 input=DUMMY_PASSPHRASE,

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error='mutually exclusive with '

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error='mutually exclusive with '), (

+            'expected error exit and known error message'

+        )

     @pytest.mark.parametrize(

         'config',

@@ -920,7 +920,7 @@ class TestCLI:

             runner=runner,

             vault_config={'services': {}},

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--import', '-'],

                 input=json.dumps(config),

@@ -930,7 +930,7 @@ class TestCLI:

                 cli._config_filename(subsystem='vault'), encoding='UTF-8'

             ) as infile:

                 config2 = json.load(infile)

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(empty_stderr=False), 'expected clean exit'

         assert config2 == config, 'config not imported correctly'

         assert not result.stderr or all(  # pragma: no branch

@@ -959,7 +959,7 @@ class TestCLI:

             runner=runner,

             vault_config={'services': {}},

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--import', '-'],

                 input=json.dumps(config),

@@ -969,7 +969,7 @@ class TestCLI:

                 cli._config_filename(subsystem='vault'), encoding='UTF-8'

             ) as infile:

                 config3 = json.load(infile)

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(empty_stderr=False), 'expected clean exit'

         assert config3 == config2, 'config not imported correctly'

         assert not result.stderr or all(

@@ -982,16 +982,16 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--import', '-'],

                 input='null',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error='Invalid vault config'

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error='Invalid vault config'), (

+            'expected error exit and known error message'

+        )

     def test_213c_import_bad_config_not_json_data(

         self,

@@ -999,16 +999,16 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--import', '-'],

                 input='This string is not valid JSON.',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error='cannot decode JSON'

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error='cannot decode JSON'), (

+            'expected error exit and known error message'

+        )

     def test_213d_import_bad_config_not_a_file(

         self,

@@ -1025,15 +1025,15 @@ class TestCLI:

             ) as outfile:

                 print('This string is not valid JSON.', file=outfile)

             dname = cli._config_filename(subsystem=None)

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--import', os.fsdecode(dname)],

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error=os.strerror(errno.EISDIR)

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error=os.strerror(errno.EISDIR)), (

+            'expected error exit and known error message'

+        )

     @pytest.mark.parametrize(

         'export_options',

@@ -1051,7 +1051,7 @@ class TestCLI:

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

             with contextlib.suppress(FileNotFoundError):

                 os.remove(cli._config_filename(subsystem='vault'))

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 # Test parent context navigation by not calling

                 # `cli.derivepassphrase_vault` directly.  Used e.g. in

                 # the `--export-as=sh` section to autoconstruct the

@@ -1060,7 +1060,7 @@ class TestCLI:

                 ['vault', '--export', '-', *export_options],

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.clean_exit(empty_stderr=True), 'expected clean exit'

     @pytest.mark.parametrize(

@@ -1079,16 +1079,16 @@ class TestCLI:

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch, runner=runner, vault_config={}

         ):

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', '-', *export_options],

                 input='null',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error='Cannot load vault settings:'

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error='Cannot load vault settings:'), (

+            'expected error exit and known error message'

+        )

     @pytest.mark.parametrize(

         'export_options',

@@ -1107,16 +1107,16 @@ class TestCLI:

             with contextlib.suppress(FileNotFoundError):

                 os.remove(cli._config_filename(subsystem='vault'))

             os.makedirs(cli._config_filename(subsystem='vault'))

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', '-', *export_options],

                 input='null',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error='Cannot load vault settings:'

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error='Cannot load vault settings:'), (

+            'expected error exit and known error message'

+        )

     @pytest.mark.parametrize(

         'export_options',

@@ -1133,16 +1133,16 @@ class TestCLI:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

             dname = cli._config_filename(subsystem=None)

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', os.fsdecode(dname), *export_options],

                 input='null',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

-        assert result.error_exit(

-            error='Cannot export vault settings:'

-        ), 'expected error exit and known error message'

+        result = tests.ReadableResult.parse(result_)

+        assert result.error_exit(error='Cannot export vault settings:'), (

+            'expected error exit and known error message'

+        )

     @pytest.mark.parametrize(

         'export_options',

@@ -1162,18 +1162,18 @@ class TestCLI:

                 shutil.rmtree('.derivepassphrase')

             with open('.derivepassphrase', 'w', encoding='UTF-8') as outfile:

                 print('Obstruction!!', file=outfile)

-            _result = runner.invoke(

+            result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', '-', *export_options],

                 input='null',

                 catch_exceptions=False,

             )

-        result = tests.ReadableResult.parse(_result)

+        result = tests.ReadableResult.parse(result_)

         assert result.error_exit(

             error='Cannot load vault settings:'

-        ) or result.error_exit(

-            error='Cannot load user config:'

-        ), 'expected error exit and known error message'

+        ) or result.error_exit(error='Cannot load user config:'), (

+            'expected error exit and known error message'

+        )