Recent commits to derivepassphrase.git (6da7a92c3285a1f757cbe7530fe17caf680ad468)

Harmonize coverage exclusion markers (and fix one slipup)

2026-06-13T21:28:11+02:00

Introduce a second coverage exclusion marker in the form of an
overridable session-level fixture `skip_if_no_ctypes_windll_support`,
similar to the existing `skip_if_no_af_unix_support` fixture.

Also update the description of both fixtures to match their current
usage.

Also also fix a coverage slipup in a failsafe path of the
`AgentProtocolResponseQueue` testing machinery.
</pre>

Reorganize and rename SSH agent mock objects

2026-06-13T19:22:20+02:00

Rename the `Request` and `Response` classes to `AgentProtocolRequest`
and `AgentProtocolResponse`, respectively, and move them into the
`tests.data` package.  Rename the `_RequestResponseIOQueue` class to
`AgentProtocolResponseQueue`, and move it into the `tests.machinery`
package.

Along the way, fix the self-reference of `tests.data` and
`tests.machinery` contents within the `tests.machinery` package.
</pre>

Test our handling of the SSH agent "query" double-response behavior

2026-06-13T18:52:55+02:00

Add tests to verify that we gracefully react to an SSH agent replying
twice to a "query" extension request.
</pre>

Allow testing for mismatched SSH agent communication

2026-06-13T18:52:55+02:00

Generalize the mocked SSH agent machinery for simulating error responses
slightly, so that instead of passing one-to-one request/response pairs,
we pass one-to-many request/list-of-responses pairs.  Responses are kept
on a queue, and the machinery asserts that the queue is empty at the end
of the interaction.

This new flexibility is not yet required anywhere, but will be used in
the next commit.
</pre>

Work around double-response for "query" extension from ssh-agent (OpenSSH 10.3)

2026-06-13T18:52:55+02:00

Detect and work around `ssh-agent` (OpenSSH 10.3 only) responding twice
when answering a "query" extension request: once with the expected
"extension response" or "success" message, and once with an
unexpected/additional empty "success" message.  We detect the extra
empty "success" message in a generic and protocol compliant way, and
re-align request-response-pair boundaries for any future requests.  From
the agent's perspective, the work-around does a read-only operation and
should not change any permanent agent state, whether there are extra
empty "success" messages or not.

As written, the work-around tests specifically for output from OpenSSH
10.3, but is otherwise agnostic to the "extension response" message
contents and could be easily adapted to trigger for other content
patterns.
</pre>

Split SSHAgentClient.request in two

2026-06-13T16:04:08+02:00

Factor out the serialization of the request message and the
deserialization of the response message from `SSHAgentClient.request`
into separate helper methods.  `SSHAgentClient.request` now only
contains the management of expected response codes, and the raising of
errors if unexpected response codes are received.

While this refactoring was unnecessary so far – requests and responses
were always paired and aligned – the next piece of code I intend to
commit requires handling unpaired responses, and will use only one of
these helper methods.
</pre>

Turn the SSH agent protocol message numbers into ints

2026-06-13T15:56:18+02:00

The `SSH_AGENT` and `SSH_AGENTC` types now inherit from `int`, because
SSH agent protocol message numbers are 8-bit unsigned integers.  This
cuts down on a lot of (previously necessary) type conversion steps
whenever mixed groups of message numbers were involved (e.g. the
`SSHAgentClient.request` `response_code` argument), or when message
numbers needed to be compared with each other (e.g. tests).
</pre>

For SSH agent failures, print the raw response text

2026-06-13T07:52:46+02:00

For SSHAgentFailedError, include the raw response text in the error
message.  (Escaped, but not trimmed.)  The response text is seldom
textual in nature, and discarding non-printable parts of the text turns
out to be much more of a hindrance than a help when debugging unexpected
agent behavior.
</pre>

Merge topic branch 'windows-named-pipes' into master

2026-04-23T19:31:54+02:00

* windows-named-pipes:
  Update the release checklist with PERMITTED_SSH_AGENTS and NON_REENTRANT_SSH_AGENTS
</pre>

Merge topic branch 'documentation-todos' into master

2026-04-06T08:47:01+02:00

* documentation-todos:
  Document the choice between multiple master SSH keys/passphrases or not
  Document how to deal with regular passphrase rotation/rollover
  Document how to deal with "unsupported" special characters in derivepassphrase vault
  Document the tradeoffs between a master passphrase and a master SSH key
  Clean up future documentation ideas
</pre>