derivepassphrase.git

@@ -412,7 +412,7 @@ sqlite_cache = true

 enable_error_code = ['ignore-without-code']

 [tool.pytest.ini_options]

-addopts = '--doctest-modules --dist=worksteal'

+addopts = '--doctest-modules --dist=worksteal --import-mode=importlib'

 pythonpath = ['src']

 testpaths = ['src', 'tests']

 xfail_strict = true

@@ -1,2978 +1,3 @@

 # SPDX-FileCopyrightText: 2025 Marco Ricci <software@the13thletter.info>

 #

 # SPDX-License-Identifier: Zlib

-

-from __future__ import annotations

-

-import contextlib

-import copy

-import errno

-import json

-import os

-import pathlib

-import shutil

-import socket

-import textwrap

-import types

-from typing import TYPE_CHECKING

-

-import click.testing

-import hypothesis

-import pytest

-from hypothesis import strategies

-from typing_extensions import Any, NamedTuple

-

-from derivepassphrase import _types, cli, ssh_agent, vault

-from derivepassphrase._internals import (

-    cli_helpers,

-    cli_messages,

-)

-from tests import data, machinery

-from tests.data import callables

-from tests.machinery import hypothesis as hypothesis_machinery

-from tests.machinery import pytest as pytest_machinery

-

-if TYPE_CHECKING:

-    from typing import NoReturn

-

-    from typing_extensions import Literal

-

-DUMMY_SERVICE = data.DUMMY_SERVICE

-DUMMY_PASSPHRASE = data.DUMMY_PASSPHRASE

-DUMMY_CONFIG_SETTINGS = data.DUMMY_CONFIG_SETTINGS

-DUMMY_RESULT_PASSPHRASE = data.DUMMY_RESULT_PASSPHRASE

-DUMMY_RESULT_KEY1 = data.DUMMY_RESULT_KEY1

-DUMMY_PHRASE_FROM_KEY1_RAW = data.DUMMY_PHRASE_FROM_KEY1_RAW

-DUMMY_PHRASE_FROM_KEY1 = data.DUMMY_PHRASE_FROM_KEY1

-

-DUMMY_KEY1 = data.DUMMY_KEY1

-DUMMY_KEY1_B64 = data.DUMMY_KEY1_B64

-DUMMY_KEY2 = data.DUMMY_KEY2

-DUMMY_KEY2_B64 = data.DUMMY_KEY2_B64

-DUMMY_KEY3 = data.DUMMY_KEY3

-DUMMY_KEY3_B64 = data.DUMMY_KEY3_B64

-

-TEST_CONFIGS = data.TEST_CONFIGS

-

-

-class IncompatibleConfiguration(NamedTuple):

-    other_options: list[tuple[str, ...]]

-    needs_service: bool | None

-    input: str | None

-

-

-class SingleConfiguration(NamedTuple):

-    needs_service: bool | None

-    input: str | None

-    check_success: bool

-

-

-class OptionCombination(NamedTuple):

-    options: list[str]

-    incompatible: bool

-    needs_service: bool | None

-    input: str | None

-    check_success: bool

-

-

-PASSPHRASE_GENERATION_OPTIONS: list[tuple[str, ...]] = [

-    ("--phrase",),

-    ("--key",),

-    ("--length", "20"),

-    ("--repeat", "20"),

-    ("--lower", "1"),

-    ("--upper", "1"),

-    ("--number", "1"),

-    ("--space", "1"),

-    ("--dash", "1"),

-    ("--symbol", "1"),

-]

-CONFIGURATION_OPTIONS: list[tuple[str, ...]] = [

-    ("--notes",),

-    ("--config",),

-    ("--delete",),

-    ("--delete-globals",),

-    ("--clear",),

-]

-CONFIGURATION_COMMANDS: list[tuple[str, ...]] = [

-    ("--delete",),

-    ("--delete-globals",),

-    ("--clear",),

-]

-STORAGE_OPTIONS: list[tuple[str, ...]] = [("--export", "-"), ("--import", "-")]

-INCOMPATIBLE: dict[tuple[str, ...], IncompatibleConfiguration] = {

-    ("--phrase",): IncompatibleConfiguration(

-        [("--key",), *CONFIGURATION_COMMANDS, *STORAGE_OPTIONS],

-        True,

-        DUMMY_PASSPHRASE,

-    ),

-    ("--key",): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--length", "20"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--repeat", "20"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--lower", "1"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--upper", "1"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--number", "1"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--space", "1"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--dash", "1"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--symbol", "1"): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, DUMMY_PASSPHRASE

-    ),

-    ("--notes",): IncompatibleConfiguration(

-        CONFIGURATION_COMMANDS + STORAGE_OPTIONS, True, None

-    ),

-    ("--config", "-p"): IncompatibleConfiguration(

-        [("--delete",), ("--delete-globals",), ("--clear",), *STORAGE_OPTIONS],

-        None,

-        DUMMY_PASSPHRASE,

-    ),

-    ("--delete",): IncompatibleConfiguration(

-        [("--delete-globals",), ("--clear",), *STORAGE_OPTIONS], True, None

-    ),

-    ("--delete-globals",): IncompatibleConfiguration(

-        [("--clear",), *STORAGE_OPTIONS], False, None

-    ),

-    ("--clear",): IncompatibleConfiguration(STORAGE_OPTIONS, False, None),

-    ("--export", "-"): IncompatibleConfiguration(

-        [("--import", "-")], False, None

-    ),

-    ("--import", "-"): IncompatibleConfiguration([], False, None),

-}

-SINGLES: dict[tuple[str, ...], SingleConfiguration] = {

-    ("--phrase",): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--key",): SingleConfiguration(True, None, False),

-    ("--length", "20"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--repeat", "20"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--lower", "1"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--upper", "1"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--number", "1"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--space", "1"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--dash", "1"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--symbol", "1"): SingleConfiguration(True, DUMMY_PASSPHRASE, True),

-    ("--notes",): SingleConfiguration(True, None, False),

-    ("--config", "-p"): SingleConfiguration(None, DUMMY_PASSPHRASE, False),

-    ("--delete",): SingleConfiguration(True, None, False),

-    ("--delete-globals",): SingleConfiguration(False, None, True),

-    ("--clear",): SingleConfiguration(False, None, True),

-    ("--export", "-"): SingleConfiguration(False, None, True),

-    ("--import", "-"): SingleConfiguration(False, '{"services": {}}', True),

-}

-INTERESTING_OPTION_COMBINATIONS: list[OptionCombination] = []

-config: IncompatibleConfiguration | SingleConfiguration

-for opt, config in INCOMPATIBLE.items():

-    for opt2 in config.other_options:

-        INTERESTING_OPTION_COMBINATIONS.extend([

-            OptionCombination(

-                options=list(opt + opt2),

-                incompatible=True,

-                needs_service=config.needs_service,

-                input=config.input,

-                check_success=False,

-            ),

-            OptionCombination(

-                options=list(opt2 + opt),

-                incompatible=True,

-                needs_service=config.needs_service,

-                input=config.input,

-                check_success=False,

-            ),

-        ])

-for opt, config in SINGLES.items():

-    INTERESTING_OPTION_COMBINATIONS.append(

-        OptionCombination(

-            options=list(opt),

-            incompatible=False,

-            needs_service=config.needs_service,

-            input=config.input,

-            check_success=config.check_success,

-        )

-    )

-

-

-def is_warning_line(line: str) -> bool:

-    """Return true if the line is a warning line."""

-    return " Warning: " in line or " Deprecation warning: " in line

-

-

-def is_harmless_config_import_warning(record: tuple[str, int, str]) -> bool:

-    """Return true if the warning is harmless, during config import."""

-    possible_warnings = [

-        "Replacing invalid value ",

-        "Removing ineffective setting ",

-        (

-            "Setting a global passphrase is ineffective "

-            "because a key is also set."

-        ),

-        (

-            "Setting a service passphrase is ineffective "

-            "because a key is also set:"

-        ),

-    ]

-    return any(

-        machinery.warning_emitted(w, [record]) for w in possible_warnings

-    )

-

-

-def assert_vault_config_is_indented_and_line_broken(

-    config_txt: str,

-    /,

-) -> None:

-    """Return true if the vault configuration is indented and line broken.

-

-    Indented and rewrapped vault configurations as produced by

-    `json.dump` contain the closing '}' of the '$.services' object

-    on a separate, indented line:

-

-    ~~~~

-    {

-      "services": {

-        ...

-      }  <-- this brace here

-    }

-    ~~~~

-

-    or, if there are no services, then the indented line

-

-    ~~~~

-      "services": {}

-    ~~~~

-

-    Both variations may end with a comma if there are more top-level

-    keys.

-

-    """

-    known_indented_lines = {

-        "}",

-        "},",

-        '"services": {}',

-        '"services": {},',

-    }

-    assert any([

-        line.strip() in known_indented_lines and line.startswith((" ", "\t"))

-        for line in config_txt.splitlines()

-    ])

-

-

-class Parametrize(types.SimpleNamespace):

-    """Common test parametrizations."""

-

-    CHARSET_NAME = pytest.mark.parametrize(

-        "charset_name", ["lower", "upper", "number", "space", "dash", "symbol"]

-    )

-    UNICODE_NORMALIZATION_COMMAND_LINES = pytest.mark.parametrize(

-        "command_line",

-        [

-            pytest.param(

-                ["--config", "--phrase"],

-                id="configure global passphrase",

-            ),

-            pytest.param(

-                ["--config", "--phrase", "--", "DUMMY_SERVICE"],

-                id="configure service passphrase",

-            ),

-            pytest.param(

-                ["--phrase", "--", DUMMY_SERVICE],

-                id="interactive passphrase",

-            ),

-        ],

-    )

-    CONFIG_EDITING_VIA_CONFIG_FLAG_FAILURES = pytest.mark.parametrize(

-        ["command_line", "input", "err_text"],

-        [

-            pytest.param(

-                [],

-                "",

-                "Cannot update the global settings without any given settings",

-                id="None",

-            ),

-            pytest.param(

-                ["--", "sv"],

-                "",

-                "Cannot update the service-specific settings without any given settings",

-                id="None-sv",

-            ),

-            pytest.param(

-                ["--phrase", "--", "sv"],

-                "\n",

-                "No passphrase was given",

-                id="phrase-sv",

-            ),

-            pytest.param(

-                ["--phrase", "--", "sv"],

-                "",

-                "No passphrase was given",

-                id="phrase-sv-eof",

-            ),

-            pytest.param(

-                ["--key"],

-                "\n",

-                "No SSH key was selected",

-                id="key-sv",

-            ),

-            pytest.param(

-                ["--key"],

-                "",

-                "No SSH key was selected",

-                id="key-sv-eof",

-            ),

-        ],

-    )

-    CONFIG_EDITING_VIA_CONFIG_FLAG = pytest.mark.parametrize(

-        ["command_line", "input", "result_config"],

-        [

-            pytest.param(

-                ["--phrase"],

-                "my passphrase\n",

-                {"global": {"phrase": "my passphrase"}, "services": {}},

-                id="phrase",

-            ),

-            pytest.param(

-                ["--key"],

-                "1\n",

-                {

-                    "global": {"key": DUMMY_KEY1_B64, "phrase": "abc"},

-                    "services": {},

-                },

-                id="key",

-            ),

-            pytest.param(

-                ["--phrase", "--", "sv"],

-                "my passphrase\n",

-                {

-                    "global": {"phrase": "abc"},

-                    "services": {"sv": {"phrase": "my passphrase"}},

-                },

-                id="phrase-sv",

-            ),

-            pytest.param(

-                ["--key", "--", "sv"],

-                "1\n",

-                {

-                    "global": {"phrase": "abc"},

-                    "services": {"sv": {"key": DUMMY_KEY1_B64}},

-                },

-                id="key-sv",

-            ),

-            pytest.param(

-                ["--key", "--length", "15", "--", "sv"],

-                "1\n",

-                {

-                    "global": {"phrase": "abc"},

-                    "services": {"sv": {"key": DUMMY_KEY1_B64, "length": 15}},

-                },

-                id="key-length-sv",

-            ),

-        ],

-    )

-    BASE_CONFIG_WITH_KEY_VARIATIONS = pytest.mark.parametrize(

-        "config",

-        [

-            pytest.param(

-                {

-                    "global": {"key": DUMMY_KEY1_B64},

-                    "services": {DUMMY_SERVICE: {}},

-                },

-                id="global_config",

-            ),

-            pytest.param(

-                {"services": {DUMMY_SERVICE: {"key": DUMMY_KEY2_B64}}},

-                id="service_config",

-            ),

-            pytest.param(

-                {

-                    "global": {"key": DUMMY_KEY1_B64},

-                    "services": {DUMMY_SERVICE: {"key": DUMMY_KEY2_B64}},

-                },

-                id="full_config",

-            ),

-        ],

-    )

-    CONFIG_WITH_KEY = pytest.mark.parametrize(

-        "config",

-        [

-            pytest.param(

-                {

-                    "global": {"key": DUMMY_KEY1_B64},

-                    "services": {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS},

-                },

-                id="global",

-            ),

-            pytest.param(

-                {

-                    "global": {"phrase": DUMMY_PASSPHRASE.rstrip("\n")},

-                    "services": {

-                        DUMMY_SERVICE: {

-                            "key": DUMMY_KEY1_B64,

-                            **DUMMY_CONFIG_SETTINGS,

-                        }

-                    },

-                },

-                id="service",

-            ),

-        ],

-    )

-    VALID_TEST_CONFIGS = pytest.mark.parametrize(

-        "config",

-        [conf.config for conf in TEST_CONFIGS if conf.is_valid()],

-    )

-    KEY_OVERRIDING_IN_CONFIG = pytest.mark.parametrize(

-        ["config", "command_line"],

-        [

-            pytest.param(

-                {

-                    "global": {"key": DUMMY_KEY1_B64},

-                    "services": {},

-                },

-                ["--config", "-p"],

-                id="global",

-            ),

-            pytest.param(

-                {

-                    "services": {

-                        DUMMY_SERVICE: {

-                            "key": DUMMY_KEY1_B64,

-                            **DUMMY_CONFIG_SETTINGS,

-                        },

-                    },

-                },

-                ["--config", "-p", "--", DUMMY_SERVICE],

-                id="service",

-            ),

-            pytest.param(

-                {

-                    "global": {"key": DUMMY_KEY1_B64},

-                    "services": {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy()},

-                },

-                ["--config", "-p", "--", DUMMY_SERVICE],

-                id="service-over-global",

-            ),

-        ],

-    )

-    NOOP_EDIT_FUNCS = pytest.mark.parametrize(

-        ["edit_func_name", "modern_editor_interface"],

-        [

-            pytest.param("empty", True, id="empty"),

-            pytest.param("space", False, id="space-legacy"),

-            pytest.param("space", True, id="space-modern"),

-        ],

-    )

-    EXPORT_FORMAT_OPTIONS = pytest.mark.parametrize(

-        "export_options",

-        [

-            [],

-            ["--export-as=sh"],

-        ],

-    )

-    KEY_INDEX = pytest.mark.parametrize(

-        "key_index", [1, 2, 3], ids=lambda i: f"index{i}"

-    )

-    UNICODE_NORMALIZATION_ERROR_INPUTS = pytest.mark.parametrize(

-        ["main_config", "command_line", "input", "error_message"],

-        [

-            pytest.param(

-                textwrap.dedent(r"""

-                [vault]

-                default-unicode-normalization-form = 'XXX'

-                """),

-                ["--import", "-"],

-                json.dumps({

-                    "services": {

-                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

-                        "with_normalization": {"phrase": "D\u00fcsseldorf"},

-                    },

-                }),

-                (

-                    "Invalid value 'XXX' for config key "

-                    "vault.default-unicode-normalization-form"

-                ),

-                id="global",

-            ),

-            pytest.param(

-                textwrap.dedent(r"""

-                [vault.unicode-normalization-form]

-                with_normalization = 'XXX'

-                """),

-                ["--import", "-"],

-                json.dumps({

-                    "services": {

-                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

-                        "with_normalization": {"phrase": "D\u00fcsseldorf"},

-                    },

-                }),

-                (

-                    "Invalid value 'XXX' for config key "

-                    "vault.with_normalization.unicode-normalization-form"

-                ),

-                id="service",

-            ),

-        ],

-    )

-    UNICODE_NORMALIZATION_WARNING_INPUTS = pytest.mark.parametrize(

-        ["main_config", "command_line", "input", "warning_message"],

-        [

-            pytest.param(

-                "",

-                ["--import", "-"],

-                json.dumps({

-                    "global": {"phrase": "Du\u0308sseldorf"},

-                    "services": {},

-                }),

-                "The $.global passphrase is not NFC-normalized",

-                id="global-NFC",

-            ),

-            pytest.param(

-                "",

-                ["--import", "-"],

-                json.dumps({

-                    "services": {

-                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

-                        "weird entry name": {"phrase": "Du\u0308sseldorf"},

-                    }

-                }),

-                (

-                    'The $.services["weird entry name"] passphrase '

-                    "is not NFC-normalized"

-                ),

-                id="service-weird-name-NFC",

-            ),

-            pytest.param(

-                "",

-                ["--config", "-p", "--", DUMMY_SERVICE],

-                "Du\u0308sseldorf",

-                (

-                    f"The $.services.{DUMMY_SERVICE} passphrase "

-                    f"is not NFC-normalized"

-                ),

-                id="config-NFC",

-            ),

-            pytest.param(

-                "",

-                ["-p", "--", DUMMY_SERVICE],

-                "Du\u0308sseldorf",

-                "The interactive input passphrase is not NFC-normalized",

-                id="direct-input-NFC",

-            ),

-            pytest.param(

-                textwrap.dedent(r"""

-                [vault]

-                default-unicode-normalization-form = 'NFD'

-                """),

-                ["--import", "-"],

-                json.dumps({

-                    "global": {

-                        "phrase": "D\u00fcsseldorf",

-                    },

-                    "services": {},

-                }),

-                "The $.global passphrase is not NFD-normalized",

-                id="global-NFD",

-            ),

-            pytest.param(

-                textwrap.dedent(r"""

-                [vault]

-                default-unicode-normalization-form = 'NFD'

-                """),

-                ["--import", "-"],

-                json.dumps({

-                    "services": {

-                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

-                        "weird entry name": {"phrase": "D\u00fcsseldorf"},

-                    },

-                }),

-                (

-                    'The $.services["weird entry name"] passphrase '

-                    "is not NFD-normalized"

-                ),

-                id="service-weird-name-NFD",

-            ),

-            pytest.param(

-                textwrap.dedent(r"""

-                [vault.unicode-normalization-form]

-                'weird entry name 2' = 'NFKD'

-                """),

-                ["--import", "-"],

-                json.dumps({

-                    "services": {

-                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

-                        "weird entry name 1": {"phrase": "D\u00fcsseldorf"},

-                        "weird entry name 2": {"phrase": "D\u00fcsseldorf"},

-                    },

-                }),

-                (

-                    'The $.services["weird entry name 2"] passphrase '

-                    "is not NFKD-normalized"

-                ),

-                id="service-weird-name-2-NFKD",

-            ),

-        ],

-    )

-    MODERN_EDITOR_INTERFACE = pytest.mark.parametrize(

-        "modern_editor_interface", [False, True], ids=["legacy", "modern"]

-    )

-    NOTES_PLACEMENT = pytest.mark.parametrize(

-        ["notes_placement", "placement_args"],

-        [

-            pytest.param("after", ["--print-notes-after"], id="after"),

-            pytest.param("before", ["--print-notes-before"], id="before"),

-        ],

-    )

-    VAULT_CHARSET_OPTION = pytest.mark.parametrize(

-        "option",

-        [

-            "--lower",

-            "--upper",

-            "--number",

-            "--space",

-            "--dash",

-            "--symbol",

-            "--repeat",

-            "--length",

-        ],

-    )

-    OPTION_COMBINATIONS_INCOMPATIBLE = pytest.mark.parametrize(

-        ["options", "service"],

-        [

-            pytest.param(o.options, o.needs_service, id=" ".join(o.options))

-            for o in INTERESTING_OPTION_COMBINATIONS

-            if o.incompatible

-        ],

-    )

-    OPTION_COMBINATIONS_SERVICE_NEEDED = pytest.mark.parametrize(

-        ["options", "service", "input", "check_success"],

-        [

-            pytest.param(

-                o.options,

-                o.needs_service,

-                o.input,

-                o.check_success,

-                id=" ".join(o.options),

-            )

-            for o in INTERESTING_OPTION_COMBINATIONS

-            if not o.incompatible

-        ],

-    )

-    TRY_RACE_FREE_IMPLEMENTATION = pytest.mark.parametrize(

-        "try_race_free_implementation", [True, False]

-    )

-

-

-class TestCLI:

-    """Tests for the `derivepassphrase vault` command-line interface."""

-

-    def test_200_help_output(

-        self,

-    ) -> None:

-        """The `--help` option emits help text."""

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                )

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["--help"],

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(

-            empty_stderr=True, output="Passphrase generation:\n"

-        ), "expected clean exit, and option groups in help text"

-        assert result.clean_exit(

-            empty_stderr=True, output="Use $VISUAL or $EDITOR to configure"

-        ), "expected clean exit, and option group epilog in help text"

-

-    # TODO(the-13th-letter): Remove this test once

-    # TestAllCLI.test_202_version_option_output no longer xfails.

-    def test_200a_version_output(

-        self,

-    ) -> None:

-        """The `--version` option emits version information."""

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                )

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["--version"],

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(empty_stderr=True, output=cli.PROG_NAME), (

-            "expected clean exit, and program name in version text"

-        )

-        assert result.clean_exit(empty_stderr=True, output=cli.VERSION), (

-            "expected clean exit, and version in help text"

-        )

-

-    @Parametrize.CHARSET_NAME

-    def test_201_disable_character_set(

-        self,

-        charset_name: str,

-    ) -> None:

-        """Named character classes can be disabled on the command-line."""

-        option = f"--{charset_name}"

-        charset = vault.Vault.CHARSETS[charset_name].decode("ascii")

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                )

-            )

-            monkeypatch.setattr(

-                cli_helpers,

-                "prompt_for_passphrase",

-                callables.auto_prompt,

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                [option, "0", "-p", "--", DUMMY_SERVICE],

-                input=DUMMY_PASSPHRASE,

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(empty_stderr=True), "expected clean exit:"

-        for c in charset:

-            assert c not in result.stdout, (

-                f"derived password contains forbidden character {c!r}"

-            )

-

-    def test_202_disable_repetition(

-        self,

-    ) -> None:

-        """Character repetition can be disabled on the command-line."""

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                )

-            )

-            monkeypatch.setattr(

-                cli_helpers,

-                "prompt_for_passphrase",

-                callables.auto_prompt,

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["--repeat", "0", "-p", "--", DUMMY_SERVICE],

-                input=DUMMY_PASSPHRASE,

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(empty_stderr=True), (

-            "expected clean exit and empty stderr"

-        )

-        passphrase = result.stdout.rstrip("\r\n")

-        for i in range(len(passphrase) - 1):

-            assert passphrase[i : i + 1] != passphrase[i + 1 : i + 2], (

-                f"derived password contains repeated character "

-                f"at position {i}: {result.stdout!r}"

-            )

-

-    @Parametrize.CONFIG_WITH_KEY

-    def test_204a_key_from_config(

-        self,

-        running_ssh_agent: data.RunningSSHAgentInfo,

-        config: _types.VaultConfig,

-    ) -> None:

-        """A stored configured SSH key will be used."""

-        del running_ssh_agent

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_vault_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                    vault_config=config,

-                )

-            )

-            monkeypatch.setattr(

-                vault.Vault,

-                "phrase_from_key",

-                callables.phrase_from_key,

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["--", DUMMY_SERVICE],

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(empty_stderr=True), (

-            "expected clean exit and empty stderr"

-        )

-        assert result.stdout

-        assert (

-            result.stdout.rstrip("\n").encode("UTF-8")

-            != DUMMY_RESULT_PASSPHRASE

-        ), "known false output: phrase-based instead of key-based"

-        assert (

-            result.stdout.rstrip("\n").encode("UTF-8") == DUMMY_RESULT_KEY1

-        ), "expected known output"

-

-    def test_204b_key_from_command_line(

-        self,

-        running_ssh_agent: data.RunningSSHAgentInfo,

-    ) -> None:

-        """An SSH key requested on the command-line will be used."""

-        del running_ssh_agent

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_vault_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                    vault_config={

-                        "services": {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS}

-                    },

-                )

-            )

-            monkeypatch.setattr(

-                cli_helpers,

-                "get_suitable_ssh_keys",

-                callables.suitable_ssh_keys,

-            )

-            monkeypatch.setattr(

-                vault.Vault,

-                "phrase_from_key",

-                callables.phrase_from_key,

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["-k", "--", DUMMY_SERVICE],

-                input="1\n",

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(), "expected clean exit"

-        assert result.stdout, "expected program output"

-        last_line = result.stdout.splitlines(True)[-1]

-        assert (

-            last_line.rstrip("\n").encode("UTF-8") != DUMMY_RESULT_PASSPHRASE

-        ), "known false output: phrase-based instead of key-based"

-        assert last_line.rstrip("\n").encode("UTF-8") == DUMMY_RESULT_KEY1, (

-            "expected known output"

-        )

-

-    @Parametrize.BASE_CONFIG_WITH_KEY_VARIATIONS

-    @Parametrize.KEY_INDEX

-    def test_204c_key_override_on_command_line(

-        self,

-        running_ssh_agent: data.RunningSSHAgentInfo,

-        config: dict[str, Any],

-        key_index: int,

-    ) -> None:

-        """A command-line SSH key will override the configured key."""

-        del running_ssh_agent

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_vault_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                    vault_config=config,

-                )

-            )

-            monkeypatch.setattr(

-                ssh_agent.SSHAgentClient,

-                "list_keys",

-                callables.list_keys,

-            )

-            monkeypatch.setattr(

-                ssh_agent.SSHAgentClient, "sign", callables.sign

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["-k", "--", DUMMY_SERVICE],

-                input=f"{key_index}\n",

-            )

-        assert result.clean_exit(), "expected clean exit"

-        assert result.stdout, "expected program output"

-        assert result.stderr, "expected stderr"

-        assert "Error:" not in result.stderr, (

-            "expected no error messages on stderr"

-        )

-

-    def test_205_service_phrase_if_key_in_global_config(

-        self,

-        running_ssh_agent: data.RunningSSHAgentInfo,

-    ) -> None:

-        """A command-line passphrase will override the configured key."""

-        del running_ssh_agent

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_vault_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                    vault_config={

-                        "global": {"key": DUMMY_KEY1_B64},

-                        "services": {

-                            DUMMY_SERVICE: {

-                                "phrase": DUMMY_PASSPHRASE.rstrip("\n"),

-                                **DUMMY_CONFIG_SETTINGS,

-                            }

-                        },

-                    },

-                )

-            )

-            monkeypatch.setattr(

-                ssh_agent.SSHAgentClient,

-                "list_keys",

-                callables.list_keys,

-            )

-            monkeypatch.setattr(

-                ssh_agent.SSHAgentClient, "sign", callables.sign

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["--", DUMMY_SERVICE],

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(), "expected clean exit"

-        assert result.stdout, "expected program output"

-        last_line = result.stdout.splitlines(True)[-1]

-        assert (

-            last_line.rstrip("\n").encode("UTF-8") != DUMMY_RESULT_PASSPHRASE

-        ), "known false output: phrase-based instead of key-based"

-        assert last_line.rstrip("\n").encode("UTF-8") == DUMMY_RESULT_KEY1, (

-            "expected known output"

-        )

-

-    @Parametrize.KEY_OVERRIDING_IN_CONFIG

-    def test_206_setting_phrase_thus_overriding_key_in_config(

-        self,

-        running_ssh_agent: data.RunningSSHAgentInfo,

-        caplog: pytest.LogCaptureFixture,

-        config: _types.VaultConfig,

-        command_line: list[str],

-    ) -> None:

-        """Configuring a passphrase atop an SSH key works, but warns."""

-        del running_ssh_agent

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_vault_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                    vault_config=config,

-                )

-            )

-            monkeypatch.setattr(

-                ssh_agent.SSHAgentClient,

-                "list_keys",

-                callables.list_keys,

-            )

-            monkeypatch.setattr(

-                ssh_agent.SSHAgentClient, "sign", callables.sign

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                command_line,

-                input=DUMMY_PASSPHRASE,

-                catch_exceptions=False,

-            )

-        assert result.clean_exit(), "expected clean exit"

-        assert not result.stdout.strip(), "expected no program output"

-        assert result.stderr, "expected known error output"

-        err_lines = result.stderr.splitlines(False)

-        assert err_lines[0].startswith("Passphrase:")

-        assert machinery.warning_emitted(

-            "Setting a service passphrase is ineffective ",

-            caplog.record_tuples,

-        ) or machinery.warning_emitted(

-            "Setting a global passphrase is ineffective ",

-            caplog.record_tuples,

-        ), "expected known warning message"

-        assert all(map(is_warning_line, result.stderr.splitlines(True)))

-        assert all(

-            map(is_harmless_config_import_warning, caplog.record_tuples)

-        ), "unexpected error output"

-

-    @hypothesis.given(

-        notes=strategies.text(

-            strategies.characters(

-                min_codepoint=32,

-                max_codepoint=126,

-                include_characters="\n",

-            ),

-            max_size=256,

-        ),

-    )

-    def test_207_service_with_notes_actually_prints_notes(

-        self,

-        notes: str,

-    ) -> None:

-        """Service notes are printed, if they exist."""

-        hypothesis.assume("Error:" not in notes)

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_vault_config(

-                    monkeypatch=monkeypatch,

-                    runner=runner,

-                    vault_config={

-                        "global": {

-                            "phrase": DUMMY_PASSPHRASE,

-                        },

-                        "services": {

-                            DUMMY_SERVICE: {

-                                "notes": notes,

-                                **DUMMY_CONFIG_SETTINGS,

-                            },

-                        },

-                    },

-                )

-            )

-            result = runner.invoke(

-                cli.derivepassphrase_vault,

-                ["--", DUMMY_SERVICE],

-            )

-        assert result.clean_exit(), "expected clean exit"

-        assert result.stdout, "expected program output"

-        assert result.stdout.strip() == DUMMY_RESULT_PASSPHRASE.decode(

-            "ascii"

-        ), "expected known program output"

-        assert result.stderr or not notes.strip(), "expected stderr"

-        assert "Error:" not in result.stderr, (

-            "expected no error messages on stderr"

-        )

-        assert result.stderr.strip() == notes.strip(), (

-            "expected known stderr contents"

-        )

-

-    @Parametrize.VAULT_CHARSET_OPTION

-    def test_210_invalid_argument_range(

-        self,

-        option: str,

-    ) -> None:

-        """Requesting invalidly many characters from a class fails."""

-        runner = machinery.CliRunner(mix_stderr=False)

-        # TODO(the-13th-letter): Rewrite using parenthesized

-        # with-statements.

-        # https://the13thletter.info/derivepassphrase/latest/pycompatibility/#after-eol-py3.9

-        with contextlib.ExitStack() as stack:

-            monkeypatch = stack.enter_context(pytest.MonkeyPatch.context())

-            stack.enter_context(

-                pytest_machinery.isolated_config(

-                    monkeypatch=monkeypatch,