derivepassphrase.git

@@ -247,9 +247,7 @@ select = [

     'CPY', 'C4', 'DTZ', 'T10', 'DJ', 'EM', 'EXE', 'FA',

     'ISC', 'ICN', 'LOG', 'G', 'INP', 'PIE', 'T20', 'PYI',

     'PT', 'Q', 'RET', 'SLF', 'SLOT', 'SIM', 'TID', 'TC',

-    'INT', 'ARG',

-    # We currently do not use pathlib. Disable 'PTH'.

-    'TD',

+    'INT', 'ARG', 'PTH', 'TD',

     # We use TODOs and FIXMEs as notes for later, and don't want the

     # linter to nag about every occurrence.  Disable 'FIX'.

     #

@@ -24,6 +24,7 @@ import functools

 import gettext

 import inspect

 import os

+import pathlib

 import string

 import sys

 import textwrap

@@ -48,7 +49,7 @@ PROG_NAME = 'derivepassphrase'

 def load_translations(

-    localedirs: list[str] | None = None,

+    localedirs: list[str | bytes | os.PathLike] | None = None,

     languages: Sequence[str] | None = None,

     class_: type[gettext.NullTranslations] | None = None,

 ) -> gettext.NullTranslations:  # pragma: no cover

@@ -71,29 +72,36 @@ def load_translations(

     Returns:

         A (potentially dummy) translation catalog.

+    Raises:

+        RuntimeError:

+            `APPDATA` (on Windows) or `XDG_DATA_HOME` (otherwise) is not

+            set.  We attempted to compute the default value, but failed

+            to determine the home directory.

+

     """

     if localedirs is None:

         if sys.platform.startswith('win'):

-            xdg_data_home = os.environ.get(

-                'APPDATA',

-                os.path.expanduser('~'),

+            xdg_data_home = (

+                pathlib.Path(os.environ['APPDATA'])

+                if os.environ.get('APPDATA')

+                else pathlib.Path('~').expanduser()

             )

         elif os.environ.get('XDG_DATA_HOME'):

-            xdg_data_home = os.environ['XDG_DATA_HOME']

+            xdg_data_home = pathlib.Path(os.environ['XDG_DATA_HOME'])

         else:

-            xdg_data_home = os.path.join(

-                os.path.expanduser('~'), '.local', 'share'

+            xdg_data_home = (

+                pathlib.Path('~').expanduser() / '.local' / '.share'

             )

         localedirs = [

-            os.path.join(xdg_data_home, 'locale'),

-            os.path.join(sys.prefix, 'share', 'locale'),

-            os.path.join(sys.base_prefix, 'share', 'locale'),

+            pathlib.Path(xdg_data_home, 'locale'),

+            pathlib.Path(sys.prefix, 'share', 'locale'),

+            pathlib.Path(sys.base_prefix, 'share', 'locale'),

         ]

     for localedir in localedirs:

         with contextlib.suppress(OSError):

             return gettext.translation(

                 PROG_NAME,

-                localedir=localedir,

+                localedir=os.fsdecode(localedir),

                 languages=languages,

                 class_=class_,

             )

@@ -17,6 +17,7 @@ import inspect

 import json

 import logging

 import os

+import pathlib

 import shlex

 import sys

 import unicodedata

@@ -50,7 +51,6 @@ else:

     import tomli as tomllib

 if TYPE_CHECKING:

-    import pathlib

     import socket

     import types

     from collections.abc import (

@@ -1468,7 +1468,7 @@ def derivepassphrase_export_vault(

 def _config_filename(

     subsystem: str | None = 'old settings.json',

-) -> str | bytes | pathlib.Path:

+) -> pathlib.Path:

     """Return the filename of the configuration file for the subsystem.

     The (implicit default) file is currently named `settings.json`,

@@ -1495,9 +1495,9 @@ def _config_filename(

         The subsystem will be mandatory to specify.

     """

-    path: str | bytes | pathlib.Path

-    path = os.getenv(PROG_NAME.upper() + '_PATH') or click.get_app_dir(

-        PROG_NAME, force_posix=True

+    path = pathlib.Path(

+        os.getenv(PROG_NAME.upper() + '_PATH')

+        or click.get_app_dir(PROG_NAME, force_posix=True)

     )

     # Use match/case here once Python 3.9 becomes unsupported.

     if subsystem is None:

@@ -1511,7 +1511,7 @@ def _config_filename(

     else:  # pragma: no cover

         msg = f'Unknown configuration subsystem: {subsystem!r}'

         raise AssertionError(msg)

-    return os.path.join(path, filename)

+    return path / filename

 def _load_config() -> _types.VaultConfig:

@@ -1532,7 +1532,7 @@ def _load_config() -> _types.VaultConfig:

     """

     filename = _config_filename(subsystem='vault')

-    with open(filename, 'rb') as fileobj:

+    with filename.open('rb') as fileobj:

         data = json.load(fileobj)

     if not _types.is_vault_config(data):

         raise ValueError(_INVALID_VAULT_CONFIG)

@@ -1563,12 +1563,12 @@ def _migrate_and_load_old_config() -> tuple[

     """

     new_filename = _config_filename(subsystem='vault')

     old_filename = _config_filename(subsystem='old settings.json')

-    with open(old_filename, 'rb') as fileobj:

+    with old_filename.open('rb') as fileobj:

         data = json.load(fileobj)

     if not _types.is_vault_config(data):

         raise ValueError(_INVALID_VAULT_CONFIG)

     try:

-        os.replace(old_filename, new_filename)

+        old_filename.rename(new_filename)

     except OSError as exc:

         return data, exc

     else:

@@ -1591,17 +1591,13 @@ def _save_config(config: _types.VaultConfig, /) -> None:

         ValueError:

             The data cannot be stored as a vault(1)-compatible config.

-    """  # noqa: DOC501

+    """

     if not _types.is_vault_config(config):

         raise ValueError(_INVALID_VAULT_CONFIG)

     filename = _config_filename(subsystem='vault')

-    filedir = os.path.dirname(os.path.abspath(filename))

-    try:

-        os.makedirs(filedir, exist_ok=False)

-    except FileExistsError:

-        if not os.path.isdir(filedir):

-            raise

-    with open(filename, 'w', encoding='UTF-8') as fileobj:

+    filedir = filename.resolve().parent

+    filedir.mkdir(parents=True, exist_ok=True)

+    with filename.open('w', encoding='UTF-8') as fileobj:

         json.dump(config, fileobj)

@@ -1622,7 +1618,7 @@ def _load_user_config() -> dict[str, Any]:

     """

     filename = _config_filename(subsystem='user configuration')

-    with open(filename, 'rb') as fileobj:

+    with filename.open('rb') as fileobj:

         return tomllib.load(fileobj)

@@ -2489,8 +2485,8 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

     delete_service_settings: bool = False,

     delete_globals: bool = False,

     clear_all_settings: bool = False,

-    export_settings: TextIO | pathlib.Path | os.PathLike[str] | None = None,

-    import_settings: TextIO | pathlib.Path | os.PathLike[str] | None = None,

+    export_settings: TextIO | os.PathLike[str] | None = None,

+    import_settings: TextIO | os.PathLike[str] | None = None,

     overwrite_config: bool = False,

     unset_settings: Sequence[str] = (),

     export_as: Literal['json', 'sh'] = 'json',

@@ -2676,10 +2672,8 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

                 backup_config, exc = _migrate_and_load_old_config()

             except FileNotFoundError:

                 return {'services': {}}

-            old_name = os.path.basename(

-                _config_filename(subsystem='old settings.json')

-            )

-            new_name = os.path.basename(_config_filename(subsystem='vault'))

+            old_name = _config_filename(subsystem='old settings.json').name

+            new_name = _config_filename(subsystem='vault').name

             deprecation.warning(

                 _msg.TranslatedString(

                     _msg.WarnMsgTemplate.V01_STYLE_CONFIG,

@@ -8,6 +8,7 @@ from __future__ import annotations

 import importlib

 import os

+import pathlib

 from typing import TYPE_CHECKING, Protocol

 import derivepassphrase as dpp

@@ -34,10 +35,10 @@ class NotAVaultConfigError(ValueError):

     def __init__(

         self,

-        path: str | bytes,

+        path: str | bytes | os.PathLike,

         format: str | None = None,  # noqa: A002

     ) -> None:

-        self.path = path

+        self.path = os.fspath(path)

         self.format = format

     def __str__(self) -> str:  # pragma: no cover

@@ -79,7 +80,7 @@ def get_vault_key() -> bytes:

     return username

-def get_vault_path() -> str | bytes | os.PathLike:

+def get_vault_path() -> pathlib.Path:

     """Automatically determine the vault(1) configuration path.

     Query the `VAULT_PATH` environment variable, or default to

@@ -96,13 +97,9 @@ def get_vault_path() -> str | bytes | os.PathLike:

             manually to the correct value.

     """

-    result = os.path.join(

-        os.path.expanduser('~'), os.environ.get('VAULT_PATH', '.vault')

-    )

-    if result.startswith('~'):

-        msg = 'Cannot determine home directory'

-        raise RuntimeError(msg)

-    return result

+    return pathlib.Path(

+        '~', os.environ.get('VAULT_PATH', '.vault')

+    ).expanduser()

 class ExportVaultConfigDataFunction(Protocol):  # pragma: no cover

@@ -25,12 +25,12 @@ should *not* be used or relied on.

 from __future__ import annotations

 import base64

-import fnmatch

 import importlib

 import json

 import logging

 import os

 import os.path

+import pathlib

 import struct

 from typing import TYPE_CHECKING, Any

@@ -107,6 +107,8 @@ def export_storeroom_data(  # noqa: C901,D417,PLR0912,PLR0914,PLR0915

     importlib.import_module('cryptography')

     if path is None:

         path = exporter.get_vault_path()

+    else:

+        path = pathlib.Path(os.fsdecode(path))

     if key is None:

         key = exporter.get_vault_key()

     if format != 'storeroom':  # pragma: no cover

@@ -115,15 +117,11 @@ def export_storeroom_data(  # noqa: C901,D417,PLR0912,PLR0914,PLR0915

         )

         raise ValueError(msg)

     try:

-        master_keys_file = open(  # noqa: SIM115

-            os.path.join(os.fsdecode(path), '.keys'),

+        master_keys_file = pathlib.Path(path, '.keys').open(  # noqa: SIM115

             encoding='utf-8',

         )

     except FileNotFoundError as exc:

-        raise exporter.NotAVaultConfigError(

-            os.fsdecode(path),

-            format='storeroom',

-        ) from exc

+        raise exporter.NotAVaultConfigError(path, format='storeroom') from exc

     with master_keys_file:

         header = json.loads(master_keys_file.readline())

         if header != {'version': 1}:

@@ -149,14 +147,7 @@ def export_storeroom_data(  # noqa: C901,D417,PLR0912,PLR0914,PLR0915

     config_structure: dict[str, Any] = {}

     json_contents: dict[str, bytes] = {}

-    # Use glob.glob(..., root_dir=...) here once Python 3.9 becomes

-    # unsupported.

-    storeroom_path_str = os.fsdecode(path)

-    valid_hashdirs = [

-        hashdir_name

-        for hashdir_name in os.listdir(storeroom_path_str)

-        if fnmatch.fnmatch(hashdir_name, '[01][0-9a-f]')

-    ]

+    valid_hashdirs = list(path.glob('[01][0-9a-f]'))

     for file in valid_hashdirs:

         logger.info(

             _msg.TranslatedString(

@@ -165,8 +156,7 @@ def export_storeroom_data(  # noqa: C901,D417,PLR0912,PLR0914,PLR0915

             )

         )

         bucket_contents = [

-            bytes(item)

-            for item in _decrypt_bucket_file(file, master_keys, root_dir=path)

+            bytes(item) for item in _decrypt_bucket_file(file, master_keys)

         ]

         bucket_index = json.loads(bucket_contents.pop(0))

         for pos, item in enumerate(bucket_index):

@@ -669,7 +659,7 @@ def _decrypt_bucket_item(

 def _decrypt_bucket_file(

-    filename: str,

+    filename: str | bytes | os.PathLike,

     master_keys: _types.StoreroomMasterKeys,

     *,

     root_dir: str | bytes | os.PathLike = '.',

@@ -705,9 +695,9 @@ def _decrypt_bucket_file(

     """

     master_keys = master_keys.toreadonly()

-    with open(

-        os.path.join(os.fsdecode(root_dir), filename), 'rb'

-    ) as bucket_file:

+    root_dir = pathlib.Path(os.fsdecode(root_dir))

+    filename = pathlib.Path(os.fsdecode(filename))

+    with (root_dir / filename).open('rb') as bucket_file:

         header_line = bucket_file.readline()

         try:

             header = json.loads(header_line)

@@ -31,6 +31,7 @@ import importlib

 import json

 import logging

 import os

+import pathlib

 import warnings

 from typing import TYPE_CHECKING

@@ -107,7 +108,9 @@ def export_vault_native_data(  # noqa: D417

     importlib.import_module('cryptography')

     if path is None:

         path = exporter.get_vault_path()

-    with open(path, 'rb') as infile:

+    else:

+        path = pathlib.Path(os.fsdecode(path))

+    with path.open('rb') as infile:

         contents = base64.standard_b64decode(infile.read())

     if key is None:

         key = exporter.get_vault_key()

@@ -123,10 +126,7 @@ def export_vault_native_data(  # noqa: D417

     try:

         return parser_class(contents, key)()

     except ValueError as exc:

-        raise exporter.NotAVaultConfigError(

-            os.fsdecode(path),

-            format=format,

-        ) from exc

+        raise exporter.NotAVaultConfigError(path, format=format) from exc

 def _h(bs: Buffer) -> str:

@@ -615,10 +615,7 @@ class VaultNativeV02ConfigParser(VaultNativeConfigParser):

             value (if any):

             ~~~~ python

-

-            data = block_input = b''.join([

-                previous_block, input_string, salt

-            ])

+            data = block_input = b''.join([previous_block, input_string, salt])

             for i in range(iteration_count):

                 data = message_digest(data)

             block = data

@@ -728,7 +724,7 @@ if __name__ == '__main__':

     import os

     logging.basicConfig(level=('DEBUG' if os.getenv('DEBUG') else 'WARNING'))

-    with open(exporter.get_vault_path(), 'rb') as infile:

+    with exporter.get_vault_path().open('rb') as infile:

         contents = base64.standard_b64decode(infile.read())

     password = exporter.get_vault_key()

     try:

@@ -12,6 +12,7 @@ import importlib.util

 import json

 import logging

 import os

+import pathlib

 import re

 import shlex

 import stat

@@ -1440,18 +1441,16 @@ def isolated_config(

         stack.enter_context(

             cli.StandardCLILogging.ensure_standard_warnings_logging()

         )

-        monkeypatch.setenv('HOME', os.getcwd())

-        monkeypatch.setenv('USERPROFILE', os.getcwd())

+        cwd = str(pathlib.Path.cwd().resolve())

+        monkeypatch.setenv('HOME', cwd)

+        monkeypatch.setenv('USERPROFILE', cwd)

         monkeypatch.delenv(env_name, raising=False)

         config_dir = cli._config_filename(subsystem=None)

-        os.makedirs(config_dir, exist_ok=True)

+        config_dir.mkdir(parents=True, exist_ok=True)

         if isinstance(main_config_str, str):

-            with open(

-                cli._config_filename('user configuration'),

-                'w',

-                encoding='UTF-8',

-            ) as outfile:

-                outfile.write(main_config_str)

+            cli._config_filename('user configuration').write_text(

+                main_config_str, encoding='UTF-8'

+            )

         yield

@@ -1466,7 +1465,7 @@ def isolated_vault_config(

         monkeypatch=monkeypatch, runner=runner, main_config_str=main_config_str

     ):

         config_filename = cli._config_filename(subsystem='vault')

-        with open(config_filename, 'w', encoding='UTF-8') as outfile:

+        with config_filename.open('w', encoding='UTF-8') as outfile:

             json.dump(vault_config, outfile)

         yield

@@ -1486,15 +1485,18 @@ def isolated_vault_exporter_config(

         except AttributeError:

             @contextlib.contextmanager

-            def chdir(newpath: str) -> Iterator[None]:  # pragma: no branch

-                oldpath = os.getcwd()

+            def chdir(

+                newpath: str | bytes | os.PathLike,

+            ) -> Iterator[None]:  # pragma: no branch

+                oldpath = pathlib.Path.cwd().resolve()

                 os.chdir(newpath)

                 yield

                 os.chdir(oldpath)

     with runner.isolated_filesystem():

-        monkeypatch.setenv('HOME', os.getcwd())

-        monkeypatch.setenv('USERPROFILE', os.getcwd())

+        cwd = str(pathlib.Path.cwd().resolve())

+        monkeypatch.setenv('HOME', cwd)

+        monkeypatch.setenv('USERPROFILE', cwd)

         monkeypatch.delenv('VAULT_PATH', raising=False)

         monkeypatch.delenv('VAULT_KEY', raising=False)

         monkeypatch.delenv('LOGNAME', raising=False)

@@ -1502,16 +1504,16 @@ def isolated_vault_exporter_config(

         monkeypatch.delenv('USERNAME', raising=False)

         if vault_key is not None:

             monkeypatch.setenv('VAULT_KEY', vault_key)

+        vault_config_path = pathlib.Path('.vault').resolve()

         # Use match/case here once Python 3.9 becomes unsupported.

         if isinstance(vault_config, str):

-            with open('.vault', 'w', encoding='UTF-8') as outfile:

-                print(vault_config, file=outfile)

+            vault_config_path.write_text(f'{vault_config}\n', encoding='UTF-8')

         elif isinstance(vault_config, bytes):

-            os.makedirs('.vault', mode=0o700, exist_ok=True)

+            vault_config_path.mkdir(parents=True, mode=0o700, exist_ok=True)

             # Use parenthesized context manager expressions here once

             # Python 3.9 becomes unsupported.

             with contextlib.ExitStack() as stack:

-                stack.enter_context(chdir('.vault'))

+                stack.enter_context(chdir(vault_config_path))

                 tmpzipfile = stack.enter_context(

                     tempfile.NamedTemporaryFile(suffix='.zip')

                 )

@@ -1562,7 +1564,7 @@ def make_file_readonly(

     and are susceptible to race conditions.

     """

-    fname: int | str | bytes | os.PathLike[str]

+    fname: int | str | bytes | os.PathLike

     if try_race_free_implementation and {os.stat, os.chmod} <= os.supports_fd:

         fname = os.open(

             pathname,

@@ -1573,13 +1575,13 @@ def make_file_readonly(

     else:

         fname = pathname

     try:

-        orig_mode = os.stat(fname).st_mode

+        orig_mode = os.stat(fname).st_mode  # noqa: PTH116

         new_mode = (

             orig_mode & ~stat.S_IWUSR & ~stat.S_IWGRP & ~stat.S_IWOTH

             | stat.S_IREAD

         )

-        os.chmod(fname, stat.S_IREAD)

-        os.chmod(fname, new_mode)

+        os.chmod(fname, stat.S_IREAD)  # noqa: PTH101

+        os.chmod(fname, new_mode)  # noqa: PTH101

     finally:

         if isinstance(fname, int):

             os.close(fname)

@@ -12,6 +12,7 @@ import io

 import json

 import logging

 import os

+import pathlib

 import shlex

 import shutil

 import socket

@@ -926,8 +927,8 @@ class TestCLI:

                 input=json.dumps(config),

                 catch_exceptions=False,

             )

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config2 = json.load(infile)

         result = tests.ReadableResult.parse(result_)

@@ -965,8 +966,8 @@ class TestCLI:

                 input=json.dumps(config),

                 catch_exceptions=False,

             )

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config3 = json.load(infile)

         result = tests.ReadableResult.parse(result_)

@@ -1020,10 +1021,9 @@ class TestCLI:

         # configuration file ourselves afterwards, inside the context.

         # We also might as well use `isolated_config` instead.

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            with open(

-                cli._config_filename(subsystem='vault'), 'w', encoding='UTF-8'

-            ) as outfile:

-                print('This string is not valid JSON.', file=outfile)

+            cli._config_filename(subsystem='vault').write_text(

+                'This string is not valid JSON.\n', encoding='UTF-8'

+            )

             dname = cli._config_filename(subsystem=None)

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -1049,8 +1049,7 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            with contextlib.suppress(FileNotFoundError):

-                os.remove(cli._config_filename(subsystem='vault'))

+            cli._config_filename(subsystem='vault').unlink(missing_ok=True)

             result_ = runner.invoke(

                 # Test parent context navigation by not calling

                 # `cli.derivepassphrase_vault` directly.  Used e.g. in

@@ -1104,9 +1103,9 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            with contextlib.suppress(FileNotFoundError):

-                os.remove(cli._config_filename(subsystem='vault'))

-            os.makedirs(cli._config_filename(subsystem='vault'))

+            config_file = cli._config_filename(subsystem='vault')

+            config_file.unlink(missing_ok=True)

+            config_file.mkdir(parents=True, exist_ok=True)

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', '-', *export_options],

@@ -1158,10 +1157,10 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

+            config_dir = cli._config_filename(subsystem=None)

             with contextlib.suppress(FileNotFoundError):

-                shutil.rmtree('.derivepassphrase')

-            with open('.derivepassphrase', 'w', encoding='UTF-8') as outfile:

-                print('Obstruction!!', file=outfile)

+                shutil.rmtree(config_dir)

+            config_dir.write_text('Obstruction!!\n')

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', '-', *export_options],

@@ -1197,8 +1196,8 @@ contents go here

             )

             result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(empty_stderr=True), 'expected clean exit'

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config = json.load(infile)

             assert config == {

@@ -1223,8 +1222,8 @@ contents go here

             )

             result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(empty_stderr=True), 'expected clean exit'

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config = json.load(infile)

             assert config == {'global': {'phrase': 'abc'}, 'services': {}}

@@ -1246,8 +1245,8 @@ contents go here

             )

             result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(empty_stderr=True), 'expected clean exit'

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config = json.load(infile)

             assert config == {

@@ -1274,8 +1273,8 @@ contents go here

             assert result.error_exit(error='the user aborted the request'), (

                 'expected known error message'

             )

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config = json.load(infile)

             assert config == {'global': {'phrase': 'abc'}, 'services': {}}

@@ -1346,8 +1345,8 @@ contents go here

             )

             result = tests.ReadableResult.parse(result_)

             assert result.clean_exit(), 'expected clean exit'

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config = json.load(infile)

             assert config == result_config, (

@@ -1457,7 +1456,8 @@ contents go here

             runner=runner,

             vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

-            monkeypatch.setenv('SSH_AUTH_SOCK', os.getcwd())

+            cwd = pathlib.Path.cwd().resolve()

+            monkeypatch.setenv('SSH_AUTH_SOCK', str(cwd))

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--key', '--config'],

@@ -1674,16 +1674,8 @@ contents go here

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            shutil.rmtree('.derivepassphrase')

-            os_makedirs_called = False

-            real_os_makedirs = os.makedirs

-

-            def makedirs(*args: Any, **kwargs: Any) -> Any:

-                nonlocal os_makedirs_called

-                os_makedirs_called = True

-                return real_os_makedirs(*args, **kwargs)

-

-            monkeypatch.setattr(os, 'makedirs', makedirs)

+            with contextlib.suppress(FileNotFoundError):

+                shutil.rmtree(cli._config_filename(subsystem=None))

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--config', '-p'],

@@ -1695,9 +1687,8 @@ contents go here

             assert result.stderr == 'Passphrase:', (

                 'program unexpectedly failed?!'

             )

-            assert os_makedirs_called, 'os.makedirs has not been called?!'

-            with open(

-                cli._config_filename(subsystem='vault'), encoding='UTF-8'

+            with cli._config_filename(subsystem='vault').open(

+                encoding='UTF-8'

             ) as infile:

                 config_readback = json.load(infile)

             assert config_readback == {

@@ -1717,12 +1708,10 @@ contents go here

             save_config_ = cli._save_config

             def obstruct_config_saving(*args: Any, **kwargs: Any) -> Any:

+                config_dir = cli._config_filename(subsystem=None)

                 with contextlib.suppress(FileNotFoundError):

-                    shutil.rmtree('.derivepassphrase')

-                with open(

-                    '.derivepassphrase', 'w', encoding='UTF-8'

-                ) as outfile:

-                    print('Obstruction!!', file=outfile)

+                    shutil.rmtree(config_dir)

+                config_dir.write_text('Obstruction!!\n')

                 monkeypatch.setattr(cli, '_save_config', save_config_)

                 return save_config_(*args, **kwargs)

@@ -2089,7 +2078,7 @@ class TestCLIUtils:

             monkeypatch=monkeypatch, runner=runner, vault_config=config

         ):

             config_filename = cli._config_filename(subsystem='vault')

-            with open(config_filename, encoding='UTF-8') as fileobj:

+            with config_filename.open(encoding='UTF-8') as fileobj:

                 assert json.load(fileobj) == config

             assert cli._load_config() == config

@@ -2600,8 +2589,8 @@ Boo.

                 assert result.clean_exit(empty_stderr=True), (

                     'expected clean exit'

                 )

-                with open(

-                    cli._config_filename(subsystem='vault'), encoding='UTF-8'

+                with cli._config_filename(subsystem='vault').open(

+                    encoding='UTF-8'

                 ) as infile:

                     config_readback = json.load(infile)

                 assert config_readback == result_config

@@ -2844,11 +2833,9 @@ class TestCLITransition:

     ) -> None:

         runner = click.testing.CliRunner()

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            config_filename = cli._config_filename(

-                subsystem='old settings.json'

+            cli._config_filename(subsystem='old settings.json').write_text(

+                json.dumps(config, indent=2) + '\n', encoding='UTF-8'

             )

-            with open(config_filename, 'w', encoding='UTF-8') as fileobj:

-                print(json.dumps(config, indent=2), file=fileobj)

             assert cli._migrate_and_load_old_config()[0] == config

     @pytest.mark.parametrize(

@@ -2875,11 +2862,9 @@ class TestCLITransition:

     ) -> None:

         runner = click.testing.CliRunner()

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            config_filename = cli._config_filename(

-                subsystem='old settings.json'

+            cli._config_filename(subsystem='old settings.json').write_text(

+                json.dumps(config, indent=2) + '\n', encoding='UTF-8'

             )

-            with open(config_filename, 'w', encoding='UTF-8') as fileobj:

-                print(json.dumps(config, indent=2), file=fileobj)

             assert cli._migrate_and_load_old_config() == (config, None)

     @pytest.mark.parametrize(

@@ -2906,12 +2891,12 @@ class TestCLITransition:

     ) -> None:

         runner = click.testing.CliRunner()

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            config_filename = cli._config_filename(

-                subsystem='old settings.json'

+            cli._config_filename(subsystem='old settings.json').write_text(

+                json.dumps(config, indent=2) + '\n', encoding='UTF-8'

+            )

+            cli._config_filename(subsystem='vault').mkdir(

+                parents=True, exist_ok=True

             )

-            with open(config_filename, 'w', encoding='UTF-8') as fileobj:

-                print(json.dumps(config, indent=2), file=fileobj)

-            os.mkdir(cli._config_filename(subsystem='vault'))

             config2, err = cli._migrate_and_load_old_config()

             assert config2 == config

             assert isinstance(err, OSError)

@@ -2941,11 +2926,9 @@ class TestCLITransition:

     ) -> None:

         runner = click.testing.CliRunner()

         with tests.isolated_config(monkeypatch=monkeypatch, runner=runner):

-            config_filename = cli._config_filename(

-                subsystem='old settings.json'

+            cli._config_filename(subsystem='old settings.json').write_text(

+                json.dumps(config, indent=2) + '\n', encoding='UTF-8'

             )

-            with open(config_filename, 'w', encoding='UTF-8') as fileobj:

-                print(json.dumps(config, indent=2), file=fileobj)

             with pytest.raises(ValueError, match=cli._INVALID_VAULT_CONFIG):

                 cli._migrate_and_load_old_config()

@@ -3077,17 +3060,13 @@ class TestCLITransition:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            with open(

-                cli._config_filename(subsystem='old settings.json'),

-                'w',

-                encoding='UTF-8',

-            ) as fileobj:

-                print(

+            cli._config_filename(subsystem='old settings.json').write_text(

                 json.dumps(

                     {'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS}},

                     indent=2,

-                    ),

-                    file=fileobj,

+                )

+                + '\n',

+                encoding='UTF-8',

             )

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -3113,17 +3092,13 @@ class TestCLITransition:

             monkeypatch=monkeypatch,

             runner=runner,

         ):

-            with open(

-                cli._config_filename(subsystem='old settings.json'),

-                'w',

-                encoding='UTF-8',

-            ) as fileobj:

-                print(

+            cli._config_filename(subsystem='old settings.json').write_text(

                 json.dumps(

                     {'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS}},

                     indent=2,

-                    ),

-                    file=fileobj,

+                )

+                + '\n',

+                encoding='UTF-8',

             )

             def raiser(*_args: Any, **_kwargs: Any) -> None:

@@ -3134,6 +3109,7 @@ class TestCLITransition:

                 )

             monkeypatch.setattr(os, 'replace', raiser)

+            monkeypatch.setattr(pathlib.Path, 'rename', raiser)

             result_ = runner.invoke(

                 cli.derivepassphrase_vault,

                 ['--export', '-'],

@@ -3161,9 +3137,8 @@ class TestCLITransition:

         ):

             old_name = cli._config_filename(subsystem='old settings.json')

             new_name = cli._config_filename(subsystem='vault')

-            with contextlib.suppress(FileNotFoundError):

-                os.remove(old_name)

-            os.rename(new_name, old_name)

+            old_name.unlink(missing_ok=True)

+            new_name.rename(old_name)

             assert cli._shell_complete_service(

                 click.Context(cli.derivepassphrase),

                 click.Argument(['some_parameter']),

@@ -4183,7 +4158,7 @@ class TestShellCompletion:

             runner=runner,

             vault_config={'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS}},

         ):

-            os.remove(cli._config_filename(subsystem='vault'))

+            cli._config_filename(subsystem='vault').unlink(missing_ok=True)

             assert not cli._shell_complete_service(

                 click.Context(cli.derivepassphrase),

                 click.Argument(['some_parameter']),

@@ -7,7 +7,7 @@ from __future__ import annotations

 import base64

 import contextlib

 import json

-import os

+import pathlib

 from typing import TYPE_CHECKING

 import click.testing

@@ -180,11 +180,12 @@ class TestCLI:

             vault_config='',

             vault_key=tests.VAULT_MASTER_KEY,

         ):

-            os.remove('.vault')

-            os.mkdir('.vault')

+            p = pathlib.Path('.vault')

+            p.unlink()

+            p.mkdir()

             result_ = runner.invoke(

                 cli.derivepassphrase_export_vault,

-                ['.vault'],

+                [str(p)],

             )

         result = tests.ReadableResult.parse(result_)

         assert result.error_exit(

@@ -322,10 +323,11 @@ class TestStoreroom:

             runner=runner,

             vault_config=tests.VAULT_STOREROOM_CONFIG_ZIPPED,

         ):

-            with open('.vault/20', 'w', encoding='UTF-8') as outfile:

+            p = pathlib.Path('.vault', '20')

+            with p.open('w', encoding='UTF-8') as outfile:

                 print(config, file=outfile)

             with pytest.raises(ValueError, match='Invalid bucket file: '):

-                list(storeroom._decrypt_bucket_file('.vault/20', master_keys))

+                list(storeroom._decrypt_bucket_file(p, master_keys))

     @pytest.mark.parametrize(

         ['data', 'err_msg'],

@@ -356,7 +358,8 @@ class TestStoreroom:

             vault_config=tests.VAULT_STOREROOM_CONFIG_ZIPPED,

             vault_key=tests.VAULT_MASTER_KEY,

         ):

-            with open('.vault/.keys', 'w', encoding='UTF-8') as outfile:

+            p = pathlib.Path('.vault', '.keys')

+            with p.open('w', encoding='UTF-8') as outfile:

                 print(data, file=outfile)

             with pytest.raises(RuntimeError, match=err_msg):

                 handler(format='storeroom')

@@ -5,6 +5,7 @@

 from __future__ import annotations

 import os

+import pathlib

 from typing import TYPE_CHECKING, Any

 import click.testing

@@ -65,26 +66,29 @@ class Test001ExporterUtils:

     @pytest.mark.parametrize(

         ['expected', 'path'],

         [

-            ('/tmp', '/tmp'),

-            ('~', os.path.curdir),

-            ('~/.vault', None),

+            (pathlib.Path('/tmp'), pathlib.Path('/tmp')),

+            (pathlib.Path('~'), pathlib.Path()),

+            (pathlib.Path('~/.vault'), None),

         ],

     )

     def test_210_get_vault_path(

         self,

         monkeypatch: pytest.MonkeyPatch,

-        expected: str,

-        path: str | None,

+        expected: pathlib.Path,

+        path: str | os.PathLike[str] | None,

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_vault_exporter_config(

             monkeypatch=monkeypatch, runner=runner

         ):

             if path:

-                monkeypatch.setenv('VAULT_PATH', path)

-            assert os.fsdecode(

-                os.path.realpath(exporter.get_vault_path())

-            ) == os.path.realpath(os.path.expanduser(expected))

+                monkeypatch.setenv(

+                    'VAULT_PATH', os.fspath(path) if path is not None else None

+                )

+            assert (

+                exporter.get_vault_path().resolve()

+                == expected.expanduser().resolve()

+            )

     def test_220_register_export_vault_config_data_handler(

         self, monkeypatch: pytest.MonkeyPatch

@@ -126,7 +130,11 @@ class Test001ExporterUtils:

     def test_310_get_vault_path_without_home(

         self, monkeypatch: pytest.MonkeyPatch

     ) -> None:

-        monkeypatch.setattr(os.path, 'expanduser', lambda x: x)

+        def raiser(*_args: Any, **_kwargs: Any) -> Any:

+            raise RuntimeError('Cannot determine home directory.')  # noqa: EM101,TRY003

+

+        monkeypatch.setattr(pathlib.Path, 'expanduser', raiser)

+        monkeypatch.setattr(os.path, 'expanduser', raiser)

         with pytest.raises(

             RuntimeError, match=r'[Cc]annot determine home directory'

         ):