derivepassphrase.git

@@ -11,9 +11,10 @@ import enum

 import json

 import math

 import string

-from typing import TYPE_CHECKING

+from typing import TYPE_CHECKING, Generic, TypeVar

 from typing_extensions import (

+    Buffer,

     NamedTuple,

     NotRequired,

     TypedDict,

@@ -577,7 +578,10 @@ def clean_up_falsy_vault_config_values(  # noqa: C901,PLR0912

     return cleanup_completed

-class SSHKeyCommentPair(NamedTuple):

+B = TypeVar('B', bound=Buffer)

+

+

+class SSHKeyCommentPair(NamedTuple, Generic[B]):

     """SSH key plus comment pair.  For typing purposes.

     Attributes:

@@ -586,11 +590,18 @@ class SSHKeyCommentPair(NamedTuple):

     """

-    key: bytes | bytearray

+    key: B

     """"""

-    comment: bytes | bytearray

+    comment: B

     """"""

+    def toreadonly(self) -> SSHKeyCommentPair[bytes]:

+        """Return a copy with read-only entries."""

+        return SSHKeyCommentPair(

+            key=bytes(self.key),

+            comment=bytes(self.comment),

+        )

+

 class SSH_AGENTC(enum.Enum):  # noqa: N801

     """SSH agent protocol numbers: client requests.

@@ -662,7 +673,7 @@ class SSH_AGENT(enum.Enum):  # noqa: N801

     """"""

-class StoreroomKeyPair(NamedTuple):

+class StoreroomKeyPair(NamedTuple, Generic[B]):

     """A pair of AES256 keys, one for encryption and one for signing.

     Attributes:

@@ -674,13 +685,20 @@ class StoreroomKeyPair(NamedTuple):

     """

-    encryption_key: bytes

+    encryption_key: B

     """"""

-    signing_key: bytes

+    signing_key: B

     """"""

+    def toreadonly(self) -> StoreroomKeyPair[bytes]:

+        """Return a copy with read-only entries."""

+        return StoreroomKeyPair(

+            encryption_key=bytes(self.encryption_key),

+            signing_key=bytes(self.signing_key),

+        )

+

-class StoreroomMasterKeys(NamedTuple):

+class StoreroomMasterKeys(NamedTuple, Generic[B]):

     """A triple of AES256 keys, for encryption, signing and hashing.

     Attributes:

@@ -695,9 +713,17 @@ class StoreroomMasterKeys(NamedTuple):

     """

-    hashing_key: bytes

+    hashing_key: B

     """"""

-    encryption_key: bytes

+    encryption_key: B

     """"""

-    signing_key: bytes

+    signing_key: B

     """"""

+

+    def toreadonly(self) -> StoreroomMasterKeys[bytes]:

+        """Return a copy with read-only entries."""

+        return StoreroomMasterKeys(

+            hashing_key=bytes(self.hashing_key),

+            encryption_key=bytes(self.encryption_key),

+            signing_key=bytes(self.signing_key),

+        )

@@ -147,7 +147,7 @@ def derive_master_keys_keys(

     return _types.StoreroomKeyPair(

         encryption_key=encryption_key,

         signing_key=signing_key,

-    )

+    ).toreadonly()

 def decrypt_master_keys_data(

@@ -201,6 +201,7 @@ def decrypt_master_keys_data(

     """

     data = memoryview(data).toreadonly().cast('c')

+    keys = keys.toreadonly()

     ciphertext, claimed_mac = struct.unpack(

         f'{len(data) - MAC_SIZE}s {MAC_SIZE}s', data

     )

@@ -241,7 +242,7 @@ def decrypt_master_keys_data(

         hashing_key=hashing_key,

         encryption_key=encryption_key,

         signing_key=signing_key,

-    )

+    ).toreadonly()

 def decrypt_session_keys(

@@ -293,6 +294,7 @@ def decrypt_session_keys(

     """

     data = memoryview(data).toreadonly().cast('c')

+    master_keys = master_keys.toreadonly()

     ciphertext, claimed_mac = struct.unpack(

         f'{len(data) - MAC_SIZE}s {MAC_SIZE}s', data

     )

@@ -333,7 +335,7 @@ def decrypt_session_keys(

     session_keys = _types.StoreroomKeyPair(

         encryption_key=session_encryption_key,

         signing_key=session_signing_key,

-    )

+    ).toreadonly()

     logger.debug(

         _msg.TranslatedString(

@@ -399,6 +401,7 @@ def decrypt_contents(

     """

     data = memoryview(data).toreadonly().cast('c')

+    session_keys = session_keys.toreadonly()

     ciphertext, claimed_mac = struct.unpack(

         f'{len(data) - MAC_SIZE}s {MAC_SIZE}s', data

     )

@@ -474,6 +477,7 @@ def decrypt_bucket_item(

     """

     bucket_item = memoryview(bucket_item).toreadonly().cast('c')

+    master_keys = master_keys.toreadonly()

     logger.debug(

         _msg.TranslatedString(

             _msg.DebugMsgTemplate.DECRYPT_BUCKET_ITEM_KEY_INFO,

@@ -532,6 +536,7 @@ def decrypt_bucket_file(

         removal.

     """

+    master_keys = master_keys.toreadonly()

     with open(

         os.path.join(os.fsdecode(root_dir), filename), 'rb'

     ) as bucket_file:

@@ -559,9 +559,10 @@ class TestAgentInteraction:

         with monkeypatch.context() as monkeypatch2:

             client = ssh_agent.SSHAgentClient()

             monkeypatch2.setattr(client, 'request', request)

-            SSHKeyCommentPair = _types.SSHKeyCommentPair  # noqa: N806

+            Pair = _types.SSHKeyCommentPair  # noqa: N806

+            com = b'no comment'

             loaded_keys = [

-                SSHKeyCommentPair(v.public_key_data, b'no comment')

+                Pair(v.public_key_data, com).toreadonly()

                 for v in tests.SUPPORTED_KEYS.values()

             ]

             monkeypatch2.setattr(client, 'list_keys', lambda: loaded_keys)