derivepassphrase.git

@@ -83,3 +83,10 @@ nav:

     - Release checklist: _release_checklist.md

   - Wishlist:

     - wishlist/index.md

+

+plugins:

+  mkdocstrings:

+    handlers:

+      python:

+        options:

+          filters: []

@@ -434,6 +434,23 @@ implicit_reexport = false

 sqlite_cache = true

 enable_error_code = ['ignore-without-code']

+[tool.pyrefly]

+project-includes = [

+    "src/**/*.py",

+    "tests/**/*.py",

+]

+search-path = [

+    "src",

+    "other-stubs",

+    ".",

+]

+preset = "legacy"

+infer-return-types = "never"

+permissive-ignores = true

+

+[tool.pyrefly.errors]

+unnecessary-type-conversion = "ignore"

+

 [tool.pytest.ini_options]

 addopts = '--doctest-modules --dist=loadgroup --import-mode=importlib'

 pythonpath = ['src']

@@ -136,7 +136,7 @@ def shell_complete_service(

     ctx: click.Context,

     parameter: click.Parameter,

     value: str,

-) -> list[str | click.shell_completion.CompletionItem]:

+) -> list[str]:

     """Return known vault service names as completion items.

     Service names are looked up in the vault configuration file.  All

@@ -137,7 +137,7 @@ class DebugTranslations(gettext.NullTranslations):

         cache = _debug_translation_message_cache

         for enum_class in MSG_TEMPLATE_CLASSES:

             for member in enum_class.__members__.values():

-                value = cast("TranslatableString", member.value)

+                value = member.value

                 queue: list[tuple[TranslatableString, frozenset[str]]] = [

                     (value, frozenset())

                 ]

@@ -170,7 +170,7 @@ class DebugTranslations(gettext.NullTranslations):

             return message if not message_plural or n == 1 else message_plural

         return cls._format_enum_name_maybe_with_fields(

             enum_name=str(enum_value),

-            ts=cast("TranslatableString", enum_value.value),

+            ts=enum_value.value,

             trimmed=trimmed,

         )

@@ -194,7 +194,6 @@ class DebugTranslations(gettext.NullTranslations):

     def gettext(

         self,

         message: str,

-        /,

     ) -> str:

         return self._locate_message(message)

@@ -204,7 +203,6 @@ class DebugTranslations(gettext.NullTranslations):

         msgid1: str,

         msgid2: str,

         n: int,

-        /,

     ) -> str:  # pragma: no cover [unused]

         """"""  # noqa: D419

         return self._locate_message(msgid1, message_plural=msgid2, n=n)

@@ -214,7 +212,6 @@ class DebugTranslations(gettext.NullTranslations):

         self,

         context: str,

         message: str,

-        /,

     ) -> str:

         return self._locate_message(message, context=context)

@@ -225,7 +222,6 @@ class DebugTranslations(gettext.NullTranslations):

         msgid1: str,

         msgid2: str,

         n: int,

-        /,

     ) -> str:  # pragma: no cover [unused]

         """"""  # noqa: D419

         return self._locate_message(

@@ -501,9 +497,18 @@ class TranslatedString:

                 More keyword arguments to be passed to [`str.format`][].

         """

-        if isinstance(template, MSG_TEMPLATE_CLASSES):

-            template = cast("TranslatableString", template.value)

-        self.template = template

+        # The cast is still needed for mypy.  For this use case --

+        # multiple related enums, all values of which share the same

+        # type, even across enums -- mypy's type inference is

+        # frustratingly surface-level.

+        #

+        # pyrefly: ignore [redundant-cast]

+        self.template = cast(

+            "str | TranslatableString",

+            template.value

+            if isinstance(template, MSG_TEMPLATE_CLASSES)

+            else template,

+        )

         self.kwargs = {**args_dict, **kwargs}

         self._rendered: str | None = None

@@ -2470,7 +2475,7 @@ def _write_po_file(  # noqa: C901,PLR0912

     entries: dict[str, dict[str, MsgTemplate]] = {}

     for enum_class in MSG_TEMPLATE_CLASSES:

         for member in enum_class.__members__.values():

-            value = cast("TranslatableString", member.value)

+            value = member.value

             ctx = value.l10n_context

             msg = value.singular

             if (

@@ -2569,7 +2574,7 @@ def _write_po_file(  # noqa: C901,PLR0912

         for _msg, enum_value in sorted(

             subdict.items(), key=lambda kv: str(kv[1])

         ):

-            value = cast("TranslatableString", enum_value.value)

+            value = enum_value.value

             value2 = value.maybe_without_filename()

             fileobj.writelines(

                 _format_po_entry(

@@ -2627,7 +2632,7 @@ def _format_po_entry(

 ) -> tuple[str, ...]:  # pragma: no cover [internal]

     """"""  # noqa: D419

     ret: list[str] = ["\n"]

-    ts = transformed_string or cast("TranslatableString", enum_value.value)

+    ts = transformed_string or enum_value.value

     if ts.translator_comments:

         comments = ts.translator_comments.splitlines(False)  # noqa: FBT003

         comments.extend(["", f"Message-ID: {enum_value}"])

@@ -1283,7 +1283,7 @@ class _VaultContext:  # noqa: PLR0904

             notes_legacy_instructions = _msg.TranslatedString(

                 _msg.Label.DERIVEPASSPHRASE_VAULT_NOTES_LEGACY_INSTRUCTION_TEXT

             )

-            old_notes_value = subtree.get("notes", "")

+            old_notes_value = cast("str", subtree.get("notes", ""))

             if modern_editor_interface:

                 text = "\n".join([

                     str(notes_instructions),

@@ -1292,8 +1292,9 @@ class _VaultContext:  # noqa: PLR0904

                 ])

             else:

                 text = old_notes_value or str(notes_legacy_instructions)

+            # pyrefly: ignore [bad-argument-type]

             notes_value = click.edit(text=text, require_save=False)

-            assert notes_value is not None

+            assert isinstance(notes_value, str)

             if (

                 not modern_editor_interface

                 and notes_value.strip() != old_notes_value.strip()

@@ -1428,7 +1429,7 @@ class _VaultContext:  # noqa: PLR0904

             "symbol",

         }

         kwargs = {

-            cast("str", k): cast("int", settings[k])

+            k: cast("int", settings[k])

             for k in vault_service_keys

             if k in settings

         }

@@ -391,7 +391,7 @@ def _decrypt_master_keys_data(

         padded_plaintext.extend(decryptor.finalize())

         unpadder = padding.PKCS7(IV_SIZE * 8).unpadder()

         plaintext = bytearray()

-        plaintext.extend(unpadder.update(padded_plaintext))

+        plaintext.extend(unpadder.update(bytes(padded_plaintext)))

         plaintext.extend(unpadder.finalize())

         hashing_key, encryption_key, signing_key = struct.unpack(

             f"{KEY_SIZE}s {KEY_SIZE}s {KEY_SIZE}s", plaintext

@@ -484,7 +484,7 @@ def _decrypt_session_keys(

         padded_plaintext.extend(decryptor.finalize())

         unpadder = padding.PKCS7(IV_SIZE * 8).unpadder()

         plaintext = bytearray()

-        plaintext.extend(unpadder.update(padded_plaintext))

+        plaintext.extend(unpadder.update(bytes(padded_plaintext)))

         plaintext.extend(unpadder.finalize())

         session_encryption_key, session_signing_key = struct.unpack(

             f"{KEY_SIZE}s {KEY_SIZE}s", plaintext

@@ -590,7 +590,7 @@ def _decrypt_contents(

     padded_plaintext.extend(decryptor.finalize())

     unpadder = padding.PKCS7(IV_SIZE * 8).unpadder()

     plaintext = bytearray()

-    plaintext.extend(unpadder.update(padded_plaintext))

+    plaintext.extend(unpadder.update(bytes(padded_plaintext)))

     plaintext.extend(unpadder.finalize())

     logger.debug(

@@ -429,7 +429,7 @@ class VaultNativeConfigParser(abc.ABC):

         )

         unpadder = padding.PKCS7(iv_size * 8).unpadder()

         plaintext = bytearray()

-        plaintext.extend(unpadder.update(padded_plaintext))

+        plaintext.extend(unpadder.update(bytes(padded_plaintext)))

         plaintext.extend(unpadder.finalize())

         logger.debug(

             _msg.TranslatedString(

@@ -258,15 +258,13 @@ except (

         dwFlagsAndAttributes: DWORD,  # noqa: N803

         hTemplateFile: HANDLE | None,  # noqa: N803

     ) -> HANDLE:  # pragma: no cover [external]

-        del (

-            lpFilename,

-            dwDesiredAccess,

-            dwShareMode,

-            lpSecurityAttributes,

-            dwCreationDisposition,

-            dwFlagsAndAttributes,

-            hTemplateFile,

-        )

+        del lpFilename

+        del dwDesiredAccess

+        del dwShareMode

+        del lpSecurityAttributes

+        del dwCreationDisposition

+        del dwFlagsAndAttributes

+        del hTemplateFile

         msg = "This Python version does not support Windows named pipes."

         raise WindowsNamedPipesNotAvailableError(msg)

@@ -277,13 +275,11 @@ except (

         lpNumberOfBytesRead: LPDWORD,  # noqa: N803

         lpOverlapped: LPOVERLAPPED,  # noqa: N803

     ) -> BOOL:  # pragma: no cover [external]

-        del (

-            hFile,

-            lpBuffer,

-            nNumberOfBytesToRead,

-            lpNumberOfBytesRead,

-            lpOverlapped,

-        )

+        del hFile

+        del lpBuffer

+        del nNumberOfBytesToRead

+        del lpNumberOfBytesRead

+        del lpOverlapped

         raise OSError(errno.ENOTSUP, os.strerror(errno.ENOTSUP))

     def WriteFile(  # noqa: N802

@@ -293,13 +289,11 @@ except (

         lpNumberOfBytesWritten: LPDWORD,  # noqa: N803

         lpOverlapped: LPOVERLAPPED,  # noqa: N803

     ) -> BOOL:  # pragma: no cover [external]

-        del (

-            hFile,

-            lpBuffer,

-            nNumberOfBytesToWrite,

-            lpNumberOfBytesWritten,

-            lpOverlapped,

-        )

+        del hFile

+        del lpBuffer

+        del nNumberOfBytesToWrite

+        del lpNumberOfBytesWritten

+        del lpOverlapped

         raise OSError(errno.ENOTSUP, os.strerror(errno.ENOTSUP))

     def CloseHandle(  # noqa: N802

@@ -162,7 +162,7 @@ class Vault:

         self._required: list[bytes] = []

         def subtract_or_require(

-            count: int | None, characters: bytes | bytearray

+            count: int | None, characters: bytes

         ) -> None:

             if not isinstance(count, int):

                 return

@@ -479,15 +479,14 @@ class Vault:

         """

         key = bytes(key)

         TestFunc: TypeAlias = "Callable[[bytes | bytearray], bool]"

-        deterministic_signature_types: dict[str, TestFunc]

-        deterministic_signature_types = {

+        deterministic_signature_types: dict[str, TestFunc] = {

             "ssh-ed25519": lambda k: k.startswith(

                 b"\x00\x00\x00\x0bssh-ed25519"

             ),

             "ssh-ed448": lambda k: k.startswith(b"\x00\x00\x00\x09ssh-ed448"),

             "ssh-rsa": lambda k: k.startswith(b"\x00\x00\x00\x07ssh-rsa"),

         }

-        dsa_signature_types = {

+        dsa_signature_types: dict[str, TestFunc] = {

             "ssh-dss": lambda k: k.startswith(b"\x00\x00\x00\x07ssh-dss"),

             "ecdsa-sha2-nistp256": lambda k: k.startswith(

                 b"\x00\x00\x00\x13ecdsa-sha2-nistp256"

@@ -499,7 +498,7 @@ class Vault:

                 b"\x00\x00\x00\x13ecdsa-sha2-nistp521"

             ),

         }

-        criteria = [

+        criteria: list[Callable[[], bool]] = [

             lambda: any(

                 v(key) for v in deterministic_signature_types.values()

             ),

@@ -292,7 +292,6 @@ class CliRunner:

             or "",

             stderr or "",

         )

-        return ReadableResult.parse(raw_result)

     def isolated_filesystem(

         self,

@@ -24,6 +24,7 @@ import sys

 from typing import TYPE_CHECKING

 import hypothesis

+import hypothesis.errors

 from hypothesis import strategies

 from derivepassphrase import _types

@@ -19,6 +19,7 @@ from __future__ import annotations

 import base64

 import contextlib

+import importlib.metadata

 import importlib.util

 import json

 import os

@@ -128,7 +129,7 @@ def xfail_on_the_annoying_os(

         empty, will follow.

     """

-    import hypothesis  # noqa: PLC0415

+    import hypothesis.errors  # noqa: PLC0415

     base_reason = "The Annoying OS behaves differently."

     full_reason = base_reason if not reason else f"{base_reason}  {reason}"

@@ -154,7 +154,7 @@ def minimize_openssh_keyfile_padding(

     new_private_block.extend(padding)

     result.extend(string(new_private_block))

-    return result

+    return bytes(result)

 class Parametrize:

@@ -124,7 +124,7 @@ class Strategies:

     @strategies.composite

     @staticmethod

     def service_name_and_data_strategy(

-        draw: hypothesis.strategies.DrawFn,

+        draw: strategies.DrawFn,

         num_entries: int,

     ) -> tuple[tuple[str, _types.VaultConfigServicesSettings], ...]:

         """Return a strategy for tuples of service names and settings.

@@ -366,10 +366,14 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

         """

         config = copy.deepcopy(config)

         setting = copy.deepcopy(setting)

-        config_global = config.get("global", {})

+        config_global = config.get(

+            "global", cast("_types.VaultConfigGlobalSettings", {})

+        )

         maybe_unset = set(maybe_unset) - setting.keys()

         if overwrite:

-            config["global"] = config_global = {}

+            config["global"] = config_global = cast(

+                "_types.VaultConfigGlobalSettings", {}

+            )

         elif maybe_unset:

             for key in maybe_unset:

                 config_global.pop(key, None)  # type: ignore[misc]

@@ -437,7 +441,7 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

         self,

         service: str,

         config: _types.VaultConfig,

-        setting: _types.VaultConfigGlobalSettings,

+        setting: _types.VaultConfigServicesSettings,

         maybe_unset: AbstractSet[str],

         overwrite: bool,

     ) -> tuple[_types.VaultConfig, AbstractSet[str]]:

@@ -471,7 +475,7 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

         config_service = config["services"].get(service, {})

         maybe_unset = set(maybe_unset) - setting.keys()

         if overwrite:

-            config["services"][service] = config_service = {}

+            config["services"][service] = config_service = cast("_types.VaultConfigServicesSettings", {})

         elif maybe_unset:

             for key in maybe_unset:

                 config_service.pop(key, None)  # type: ignore[misc]

@@ -11,7 +11,7 @@ import json

 import types

 from typing import TYPE_CHECKING

-import click.testing

+import click.shell_completion

 import pytest

 from typing_extensions import Any

@@ -513,11 +513,11 @@ class TestStoreroom:

         encryptor = ciphers.Cipher(

             algorithms.AES256(key), modes.CBC(iv)

         ).encryptor()

-        ciphertext = bytearray(encryptor.update(plaintext))

+        ciphertext = bytearray(encryptor.update(bytes(plaintext)))

         ciphertext.extend(encryptor.finalize())

         mac_obj = hmac.HMAC(key, hashes.SHA256())

         mac_obj.update(iv)

-        mac_obj.update(ciphertext)

+        mac_obj.update(bytes(ciphertext))

         data = iv + bytes(ciphertext) + mac_obj.finalize()

         with pytest.raises(

             ValueError,

@@ -320,9 +320,7 @@ class TestCLIUtilities:

         """

         with self._setup_environment() as monkeypatch:

             if path:

-                monkeypatch.setenv(

-                    "VAULT_PATH", os.fspath(path) if path is not None else None

-                )

+                monkeypatch.setenv("VAULT_PATH", os.fspath(path))

             assert (

                 exporter.get_vault_path().resolve()

                 == expected.expanduser().resolve()

@@ -1322,7 +1322,7 @@ class TestAgentErrorResponses:

         with self._setup_agent_and_request_handler({

             data.AgentProtocolRequest(

                 _types.SSH_AGENTC.REQUEST_IDENTITIES, b""

-            ): [data.AgentProtocolResponse(response_code, response)],

+            ): [data.AgentProtocolResponse(response_code, bytes(response))],

         }) as contexts:

             _, client = contexts

             with pytest.raises(exc_type, match=exc_pattern):

@@ -1361,7 +1361,7 @@ class TestAgentErrorResponses:

         with self._setup_agent_and_request_handler({

             data.AgentProtocolRequest(

                 _types.SSH_AGENTC.SIGN_REQUEST, sign_payload

-            ): [data.AgentProtocolResponse(response_code, response)],

+            ): [data.AgentProtocolResponse(response_code, bytes(response))],

         }) as contexts:

             monkeypatch, client = contexts

             monkeypatch.setattr(client, "list_keys", lambda: loaded_keys)

@@ -12,7 +12,7 @@ import gettext

 import os

 import re

 import types

-from typing import TYPE_CHECKING, TypeVar, cast

+from typing import TYPE_CHECKING, TypeVar

 import hypothesis

 import pytest

@@ -57,16 +57,13 @@ class Strategies:

         ]

     ] = {}

     for enum_class in msg.MSG_TEMPLATE_CLASSES:

-        all_translatable_strings_dict.update({

-            cast("msg.TranslatableString", v.value): v for v in enum_class

-        })

+        all_translatable_strings_dict.update({v.value: v for v in enum_class})

     all_translatable_strings_enum_values = tuple(

         sorted(all_translatable_strings_dict.values(), key=str)

     )

     all_translatable_strings = tuple(

-        cast("msg.TranslatableString", v.value)

-        for v in all_translatable_strings_enum_values

+        v.value for v in all_translatable_strings_enum_values

     )

     error_codes = tuple(

@@ -132,7 +129,7 @@ class Strategies:

     @classmethod

     def translatable_strings(

         cls,

-    ) -> strategies.SearchStrategy[msg.MsgTemplate]:

+    ) -> strategies.SearchStrategy[msg.TranslatableString]:

         """Return a strategy for translatable messages."""

         return strategies.sampled_from(cls.all_translatable_strings)

@@ -201,9 +198,7 @@ class TestDebugTranslations:

         value: msg.MsgTemplate,

     ) -> None:

         """Translating a MsgTemplate operates on the enum value."""

-        self._test_interpolated(

-            str(value), cast("msg.TranslatableString", value.value)

-        )

+        self._test_interpolated(str(value), value.value)

 @pytest.mark.usefixtures("use_debug_translations")