Recent commits to derivepassphrase.git (5d1c2297ead22c7dd0ef5e78c994aa674680f6be)

Fix some test coverage slipups

2026-07-05T16:21:55+02:00

</pre>

Define `use_stub_agent`/`use_stub_agent_with_address` in conftest

2026-07-05T11:13:19+02:00

This avoids redefining the same fixture in multiple test modules.
</pre>

Add a heavy-duty test for Sequin internals

2026-07-04T23:22:58+02:00

Add a heavy-duty hypothesis test (rule-based state machine) that
compares the state of our Sequin class against an as-literal-as-possible
port of the original JavaScript sequin module, included inline in the
test class.

(The heavy-duty marker and the state machine machinery are probably
overkill for this application, given that there is only one rule, and
that the test runs very fast.  Nevertheless, phrasing this as a state
machine makes the workings of the test very explicit: what are the state
transitions, what are the invariants, etc.)
</pre>

Implement missing agent system support via tests.data.SystemSupportAction

2026-07-04T21:10:03+02:00

Implement the "missing system support for the SSH agent communication
channel" setup code via the now centralized
`tests.data.SystemSupportAction` enum, instead of duplicating the setup
steps everywhere.  This means adding the correct `SystemSupportAction`
value to the `MISSING_AGENT_SUPPORT` parametrization set.

In particular, since this parametrization set is already used in two
different test modules, put it into
`tests.machinery.pytest.Parametrize`.
</pre>

Move some setup "action" classes into tests.data

2026-07-04T21:08:08+02:00

Move the ListKeysAction, SignAction, SocketAddressAction and
SystemSupportAction classes into tests.data.

We intend to reuse the SystemSupportAction class for a new purpose next.
</pre>

Turn some parametrized unit tests into nominal property-based tests

2026-07-03T22:21:41+02:00

Introduce a converter function for `pytest.mark.parametrize` calls to
`hypothesis.example` calls.  Further use this converter function to turn
some parametrized unit tests into nominal property-based hypothesis
tests.  We use the same call signature as `pytest.mark.parametrize` for
our converter function so that transition to hypothesis-managed test
functions is very easy to write (just change the decorator name).  We
also stick to the obvious cases only—things that should be
property-based tests but are currently parametrized tests, likely
because we haven't yet made the effort or don't yet know how to write
suitable hypothesis strategies.

(Our implementation explicitly avoids a caveat with the hypothesis
strategy `st.nothing`.  Background at
https://github.com/HypothesisWorks/hypothesis/issues/4774 .  Because we
rely on certain machinery from hypothesis, we adjust our minimum
hypothesis version.  Since we're here, we also adjust the pytest
version, reflecting our actual use.)

We also add TODOs for non-trivial future work, such as consolidating
work across modules or adding new testing machinery.
</pre>

Rewrite the vault CLI tests for config management to use the stub agent

2026-07-03T21:53:17+02:00

All interaction with a "real" agent is stubbed out anyway, and there is
no reason to run this test against multiple agents or conversely to skip
it if the system cannot spawn/interface an agent at all.
</pre>

Fix tiny mistakes across the test suite

2026-07-03T21:50:35+02:00

Typos, unwise variable names, and redundancies in the test logic or
arguments.
</pre>

Update tooling (mypy/pyrefly, mkdocstrings overrides)

2026-06-24T18:35:06+02:00

Add a pyrefly configuration, which newer versions of hatch and VS Code
prefer over mypy.  Fix violations that pyrefly complains about, but mypy
doesn't, e.g., `del (list_of_variables)`.  Remove unnecessary casts --
pyrefly warns on those, but mypy doesn't -- and document those necessary
casts explicitly, even if they are a tool deficiency (usually mypy).
Conversely, add conversions or tighter type bounds where necessary,
usually when interacting with third-party libraries that use too lax
typing because mypy doesn't complain (cryptography, click).  To be fair,
I have caused my fair share of those as well.

Finally, fix the "devsetup" mkdocs configuration that should have been
showing private members in the API documentation (if document), but
wasn't.
</pre>

Run the vault utility `key_to_phrase` tests against the stub SSH agent

2026-06-22T15:03:49+02:00

The `key_to_phrase` vault utitilies test set checks the various error
conditions that can occur when obtaining an equivalent vault master
passphrase from a master SSH key.  The test has 10 parametrization
instances, and used to run against the
`ssh_agent_client_with_test_keys_loaded` fixture, which currently has
8 parametrization instances, making for a total of 80 tests attempted.
However, the tests either focus on construction failures or they inject
fake agent responses into the client, so in all 80 cases, there is no
actual I/O occurring with the agent.  For the 5 external agents (the
first 50 cases), this is wasteful, and for the 3 internal agents (the
remaining 30 cases), the results are identical among them.  So cut this
down to testing against 1 of the internal agents (the stubbed SSH agent
with address support), for a total of 10 test cases, none of which
involve external I/O.

As a bonus, because the remaining internal agent is guaranteed
reentrant, we can do away with the parametrization instance distinction
between construction failures and other failures, and with the special
handling of potentially non-reentrant agents.

To make this work, because some tests simulate broken support for
system-specific SSH agent socket providers, our setup code needs to
force the use of the respective provider.  As a result, only the
`UNSET_PROVIDERS`, `UNSET_AF_UNIX_AND_ENSURE_USE`,
`UNSET_NATIVE_AND_ENSURE_USE` and `UNSET_WINDLL_AND_ENSURE_USE`
constants from our `SystemSupportAction` enum are still in use, the
`UNSET_AF_UNIX`, `UNSET_NATIVE` and `UNSET_WINDLL` constants are not.
We retire those constants, and remove the "skip the test if that
provider is not currently in use" machinery associated with those
constants.  The remaining "ensure use" machinery is short enough that it
can then be inlined at the call sites.
</pre>