Recent commits to derivepassphrase.git (9a57adad751024ff6d3c98ef2050b26a73f0e30f)

Suggest more future work (subcommands, documentation)

2024-10-18T13:26:04+02:00

Includes the "master password" or "spectre" derivation scheme and some
tool functionality I've originally implemented as wrapper scripts around
`vault` (load SSH key, decrypt notes, generate TOTPs from config in
notes, and auto-run/wait for runit services). Also includes the two
how-tos (supported/unsupported special characters, passphrase rotation)
from the basic setup (passphrase) tutorial, FAQs for the misnamed
`--repeat` option and the SSH agent on Windows, and new helper
subcommands for making the previous two how-tos less painful.

On that note, this TODO list no longer deals solely with future
documentation, and so needs to be retitled and to recategorize its
contents.
</pre>

Use proper HTML for variables in the basic setup (passphrase) tutorial

2024-10-16T17:33:28+02:00

</pre>

Fix missing Python version classifier

2024-10-16T00:43:03+02:00

</pre>

Implement feedback on the basic setup (passphrase) tutorial

2024-10-16T00:29:21+02:00

Fix typos and outdated command output.  Add a (hidden by default) short
explanation, mnemonic and examples for the `--repeat` option, which
actually denotes maximum consecutive occurrence, not additional allowed
repetitions.
</pre>

Release 0.3.0

2024-10-15T13:46:21+02:00

</pre>

Merge topic branch 'vault-config-amending' into master

2024-10-15T13:16:27+02:00

* t/vault-config-amending:
  Add changelog entry summarizing new warnings emitted
  Add changelog entry for the new amending/merging config import behavior
  Warn the user upon supplying an empty service name
  Add a stateful hypothesis test for config importing and merging
  Fix missing consideration of key and phrase both being specified
  Fix clean up of falsy "length" and "repeat" settings
  Correctly model vault global and service settings
  Move vault service config generation to top-level tests module
  Align behavior with vault concerning config imports

GitHub: Closes #16.
</pre>

Add changelog entry summarizing new warnings emitted

2024-10-15T13:15:38+02:00

</pre>

Add changelog entry for the new amending/merging config import behavior

2024-10-15T13:07:09+02:00

</pre>

Warn the user upon supplying an empty service name

2024-10-15T12:47:49+02:00

The `derivepassphrase` command-line largely, and vault(1) completely,
treats an empty service name the same as if no service name had been
supplied, switching over to global operation instead of service-specific
operation (or erroring out in case a service must be given).  For
`derivepassphrase`, this is mostly a user interface issue – the
underlying machinery supports empty service names –, but kept for
compatibility with vault(1).  However, this is very easy to diagnose,
and the user would benefit from seeing a warning about a seemingly
omitted service name.  So do that, and issue a warning upon encountering
an empty service name on the command-line or in an imported
configuration.  (The warning message changes slightly in each case.)

Also, add explicit tests for these two scenarios that trigger the
warning.
</pre>

Add a stateful hypothesis test for config importing and merging

2024-10-15T11:22:02+02:00

The state machine underlying this stateful hypothesis test constructs
random vault settings objects and random service names, then merges
these together into full configurations and imports those.
Alternatively, it sets or purges single-service or global settings.
The machine then checks after each step that the nominal, current
configuration matches the actual configuration stored by
`derivepassphrase`.  The program runs with a temporary settings
directory for the duration of the state machine run.

Unlike how a fully general state machine for this task would probably
run, *this* state machine does not filter its steps based on the list of
services currently stored in the configuration, but rather on the full
list of known service names.  (Evaluating a hypothesis search strategy
based on the current contents of an instance variable appears to be
a very non-straight-foward ordeal, if not outright impossible.)  As
a consequence, the "purge" action may actually be a no-op, and the "set"
action may actually be a "create" action.  While this *could* be
implemented with `hypothesis.assume`, presumably this would have such
a low success probability that it triggers health check errors.
</pre>