derivepassphrase.git

@@ -215,8 +215,8 @@ class VaultNativeConfigParser(abc.ABC):

     ) -> bytes:

         """Generate a key from a password.

-        Uses PBKDF2 with HMAC-SHA1, with the vault UUID as a fixed salt

-        value.

+        Uses PBKDF2 with HMAC-SHA1, with [vault.Vault.UUID][] as a fixed

+        salt value.

         Args:

             password:

@@ -246,7 +246,7 @@ class VaultNativeConfigParser(abc.ABC):

         raw_key = pbkdf2.PBKDF2HMAC(

             algorithm=hashes.SHA1(),

             length=key_size // 2,

-            salt=vault.Vault._UUID,  # noqa: SLF001

+            salt=vault.Vault.UUID,

             iterations=iterations,

         ).derive(bytes(password))

         result_key = raw_key.hex().lower().encode('ASCII')

@@ -254,7 +254,7 @@ class VaultNativeConfigParser(abc.ABC):

             _msg.TranslatedString(

                 _msg.DebugMsgTemplate.VAULT_NATIVE_PBKDF2_CALL,

                 password=password,

-                salt=vault.Vault._UUID,  # noqa: SLF001

+                salt=vault.Vault.UUID,

                 iterations=iterations,

                 key_size=key_size // 2,

                 algorithm='sha1',

@@ -12,7 +12,7 @@ import hashlib

 import hmac

 import math

 import types

-from typing import TYPE_CHECKING

+from typing import TYPE_CHECKING, Final

 from typing_extensions import TypeAlias, assert_type

@@ -49,18 +49,18 @@ class Vault:

     """

-    _UUID = b'e87eb0f4-34cb-46b9-93ad-766c5ab063e7'

+    UUID: Final = b'e87eb0f4-34cb-46b9-93ad-766c5ab063e7'

     """A tag used by vault in the bit stream generation."""

-    _CHARSETS = types.MappingProxyType(

+    CHARSETS: Final = types.MappingProxyType(

         collections.OrderedDict([

             ('lower', b'abcdefghijklmnopqrstuvwxyz'),

             ('upper', b'ABCDEFGHIJKLMNOPQRSTUVWXYZ'),

             (

                 'alpha',

                 (

-                    # _CHARSETS['lower']

+                    # CHARSETS['lower']

                     b'abcdefghijklmnopqrstuvwxyz'

-                    # _CHARSETS['upper']

+                    # CHARSETS['upper']

                     b'ABCDEFGHIJKLMNOPQRSTUVWXYZ'

                 ),

             ),

@@ -68,11 +68,11 @@ class Vault:

             (

                 'alphanum',

                 (

-                    # _CHARSETS['lower']

+                    # CHARSETS['lower']

                     b'abcdefghijklmnopqrstuvwxyz'

-                    # _CHARSETS['upper']

+                    # CHARSETS['upper']

                     b'ABCDEFGHIJKLMNOPQRSTUVWXYZ'

-                    # _CHARSETS['number']

+                    # CHARSETS['number']

                     b'0123456789'

                 ),

             ),

@@ -82,15 +82,15 @@ class Vault:

             (

                 'all',

                 (

-                    # _CHARSETS['lower']

+                    # CHARSETS['lower']

                     b'abcdefghijklmnopqrstuvwxyz'

-                    # _CHARSETS['upper']

+                    # CHARSETS['upper']

                     b'ABCDEFGHIJKLMNOPQRSTUVWXYZ'

-                    # _CHARSETS['number']

+                    # CHARSETS['number']

                     b'0123456789'

-                    # _CHARSETS['space']

+                    # CHARSETS['space']

                     b' '

-                    # _CHARSETS['symbol']

+                    # CHARSETS['symbol']

                     b'!"#$%&\'()*+,./:;<=>?@[\\]^{|}~-_'

                 ),

             ),

@@ -160,7 +160,7 @@ class Vault:

         self._phrase = self._get_binary_string(phrase)

         self._length = length

         self._repeat = repeat

-        self._allowed = bytearray(self._CHARSETS['all'])

+        self._allowed = bytearray(self.CHARSETS['all'])

         self._required: list[bytes] = []

         def subtract_or_require(

@@ -174,12 +174,12 @@ class Vault:

                 for _ in range(count):

                     self._required.append(characters)

-        subtract_or_require(lower, self._CHARSETS['lower'])

-        subtract_or_require(upper, self._CHARSETS['upper'])

-        subtract_or_require(number, self._CHARSETS['number'])

-        subtract_or_require(space, self._CHARSETS['space'])

-        subtract_or_require(dash, self._CHARSETS['dash'])

-        subtract_or_require(symbol, self._CHARSETS['symbol'])

+        subtract_or_require(lower, self.CHARSETS['lower'])

+        subtract_or_require(upper, self.CHARSETS['upper'])

+        subtract_or_require(number, self.CHARSETS['number'])

+        subtract_or_require(space, self.CHARSETS['space'])

+        subtract_or_require(dash, self.CHARSETS['dash'])

+        subtract_or_require(symbol, self.CHARSETS['symbol'])

         if len(self._required) > self._length:

             msg = 'requested passphrase length too short'

             raise ValueError(msg)

@@ -297,8 +297,8 @@ class Vault:

                 primitive.  If a string, then the UTF-8 encoding of the

                 string is used.

             service:

-                A vault service name.  Will be suffixed with

-                `Vault._UUID`, and then used as the salt value for

+                A vault service name.  Will be suffixed with the

+                [`UUID`][], and then used as the salt value for

                 PBKDF2.  If a string, then the UTF-8 encoding of the

                 string is used.

             length:

@@ -335,7 +335,7 @@ class Vault:

         """

         phrase = cls._get_binary_string(phrase)

         assert isinstance(phrase, bytes)

-        salt = cls._get_binary_string(service) + cls._UUID

+        salt = cls._get_binary_string(service) + cls.UUID

         return hashlib.pbkdf2_hmac(

             hash_name='sha1',

             password=phrase,

@@ -526,9 +526,9 @@ class Vault:

         """Obtain the master passphrase from a configured SSH key.

         vault allows the usage of certain SSH keys to derive a master

-        passphrase, by signing the vault UUID with the SSH key.  The key

-        type must ensure that signatures are deterministic (perhaps only

-        in conjunction with the given SSH agent).

+        passphrase, by signing the vault [`UUID`][] with the SSH key.

+        The key type must ensure that signatures are deterministic

+        (perhaps only in conjunction with the given SSH agent).

         Args:

             key:

@@ -538,8 +538,8 @@ class Vault:

                 [`ssh_agent.SSHAgentClient.ensure_agent_subcontext`][].

         Returns:

-            The signature of the vault UUID under this key, unframed but

-            encoded in base64.

+            The signature of the vault [`UUID`][] under this key,

+            unframed but encoded in base64.

         Raises:

             KeyError:

@@ -588,7 +588,7 @@ class Vault:

                     'signature not deterministic under this agent'

                 )

                 raise ValueError(msg)

-            raw_sig = client.sign(key, cls._UUID)

+            raw_sig = client.sign(key, cls.UUID)

         _keytype, trailer = ssh_agent.SSHAgentClient.unstring_prefix(raw_sig)

         signature_blob = ssh_agent.SSHAgentClient.unstring(trailer)

         return bytes(base64.standard_b64encode(signature_blob))

@@ -1708,7 +1708,7 @@ def sign(

     """

     del self  # Unused.

-    assert message == vault.Vault._UUID

+    assert message == vault.Vault.UUID

     for value in SUPPORTED_KEYS.values():

         if value.public_key_data == key:  # pragma: no branch

             assert value.expected_signature is not None

@@ -641,7 +641,7 @@ class TestCLI:

     ) -> None:

         """Named character classes can be disabled on the command-line."""

         option = f'--{charset_name}'

-        charset = vault.Vault._CHARSETS[charset_name].decode('ascii')

+        charset = vault.Vault.CHARSETS[charset_name].decode('ascii')

         runner = click.testing.CliRunner(mix_stderr=False)

         # TODO(the-13th-letter): Rewrite using parenthesized

         # with-statements.

@@ -3757,7 +3757,7 @@ class TestCLITransition:

     ) -> None:

         """Forwarding arguments from top-level to "vault" works."""

         option = f'--{charset_name}'

-        charset = vault.Vault._CHARSETS[charset_name].decode('ascii')

+        charset = vault.Vault.CHARSETS[charset_name].decode('ascii')

         runner = click.testing.CliRunner(mix_stderr=False)

         # TODO(the-13th-letter): Rewrite using parenthesized

         # with-statements.

@@ -459,11 +459,11 @@ class TestAgentInteraction:

         if public_key_data not in key_comment_pairs:  # pragma: no cover

             pytest.skip('prerequisite SSH key not loaded')

         signature = bytes(

-            client.sign(payload=vault.Vault._UUID, key=public_key_data)

+            client.sign(payload=vault.Vault.UUID, key=public_key_data)

         )

         assert signature == expected_signature, 'SSH signature mismatch'

         signature2 = bytes(

-            client.sign(payload=vault.Vault._UUID, key=public_key_data)

+            client.sign(payload=vault.Vault.UUID, key=public_key_data)

         )

         assert signature2 == expected_signature, 'SSH signature mismatch'

         assert (

@@ -666,7 +666,7 @@ class TestVault:

         for key in ('lower', 'upper', 'number', 'space', 'dash', 'symbol'):

             if config[key] > 0:

                 assert (

-                    sum(c in vault.Vault._CHARSETS[key] for c in password)

+                    sum(c in vault.Vault.CHARSETS[key] for c in password)

                     >= config[key]

                 ), (

                     'Password does not satisfy '

@@ -678,7 +678,7 @@ class TestVault:

                 assert True

             else:

                 assert (

-                    sum(c in vault.Vault._CHARSETS[key] for c in password) == 0

+                    sum(c in vault.Vault.CHARSETS[key] for c in password) == 0

                 ), 'Password does not satisfy character ban constraints.'

         T = TypeVar('T', str, bytes)