Recent commits to derivepassphrase.git (b18d27971117d16358ddd511d69a11813464671e)

Auto-format everything due to tooling update

2026-06-15T18:20:15+02:00

</pre>

Fix minor spelling/logic errors and missing TODOs in the test suite

2026-06-14T22:46:36+02:00

</pre>

Update tooling

2026-06-14T22:46:36+02:00

`ruff` now checks for too many statements in a `try` block (PLW0717),
for non-trivial `__init__.py` files (RUF067), for explicitly comparing
floats with `__eq__` (RUF069) and for bad control flow in
a generator-based context manager (RUF075).  We document our intentional
RUF069 and RUF075 violations, we fix the other occurrences of RUF075,
and we ignore PLW0717 and RUF067 for now.
</pre>

Ensure better test suite behavior for regression-only testing

2026-06-14T22:46:36+02:00

Tweak the hypothesis settings for determinism and speed when running the
test suite solely for the purpose of regression testing [1], in the new
hypothesis profile "regression": test generation will be derandomized,
stateful step counts and example counts will be set very low.  As all of
our slow-running tests are hypothesis-based, and all of our
hypothesis-based tests are slow because of the high example count, this
change alone immediately makes "regression-only" testing feasible for us
without having to skip hypothesis-based tests.  (In fact, the hypothesis
derandomization feature appears to draw motivation from the same source
[1] as we do.)

As a counterpoint, mark test cases that are (or probably should be)
hypothesis-based, but test for completion or correctness purposes rather
than for regression purposes, with a custom marker
`correctness_focused`.

Also try to add at least one working example and one counterexample to
each hypothesis-based test, if feasible.  This buys us the flexibility
(in the future) to remove test case generation from the "regression"
profile, if desired.  The test cases would then still run the explicit
examples, and thus remain useful, instead of needing another separate
set of non-hypothesis tests to cover the same ground.

References:

 1. Nelson Elhage: [Two kinds of testing][], particularly the section
    "Test budget".
 2. Alex Kladov: [How to Test][], particularly the section "Make Tests
    Fast".

[Two kinds of testing]: https://blog.nelhage.com/post/two-kinds-of-testing/
[How to Test]: https://matklad.github.io/2021/05/31/how-to-test.html#Make-Tests-Fast
</pre>

Merge branch 'openssh-bug3967-workaround'

2026-06-14T13:20:51+02:00

* openssh-bug3967-workaround:
  Ensure the SSH agent unhappy path/misbehavior tests always run
  Fix the test setup (SSH agent "query" double-response behavior)
  Harmonize coverage exclusion markers (and fix one slipup)
  Reorganize and rename SSH agent mock objects
  Test our handling of the SSH agent "query" double-response behavior
  Allow testing for mismatched SSH agent communication
  Work around double-response for "query" extension from ssh-agent (OpenSSH 10.3)
  Split SSHAgentClient.request in two
  Turn the SSH agent protocol message numbers into ints
  For SSH agent failures, print the raw response text
</pre>

Ensure the SSH agent unhappy path/misbehavior tests always run

2026-06-14T10:05:10+02:00

The tests for various unhappy paths or misbehavior of the SSH agent now
run against the stubbed SSH agent, instead of requiring an external SSH
agent (and failing or skipping if that external agent is unavailable).
The tests need to intercept all I/O from the agent anyway, so there is
little point in requiring to connect to an external agent but then not
doing any I/O with the agent.  It just introduces another unrelated and
unnecessary failure mode (e.g., SSH_AUTH_SOCK not set up).

We put the fixture for forcing use of the stubbed SSH agent at the top
level of the `ssh_agent` module tests, because that currently seems to
be the only place where we need to force use of an internal agent over
an external one.
</pre>

Fix the test setup (SSH agent "query" double-response behavior)

2026-06-14T07:54:14+02:00

The test mocks communication aspects of an SSH agent session, and thus
needs a running SSH agent.  Also, the xfail markers for some of the
parametrization values were overly broad, and were masking failures in
the test setup because of a missing running SSH agent.
</pre>

Harmonize coverage exclusion markers (and fix one slipup)

2026-06-13T21:28:11+02:00

Introduce a second coverage exclusion marker in the form of an
overridable session-level fixture `skip_if_no_ctypes_windll_support`,
similar to the existing `skip_if_no_af_unix_support` fixture.

Also update the description of both fixtures to match their current
usage.

Also also fix a coverage slipup in a failsafe path of the
`AgentProtocolResponseQueue` testing machinery.
</pre>

Reorganize and rename SSH agent mock objects

2026-06-13T19:22:20+02:00

Rename the `Request` and `Response` classes to `AgentProtocolRequest`
and `AgentProtocolResponse`, respectively, and move them into the
`tests.data` package.  Rename the `_RequestResponseIOQueue` class to
`AgentProtocolResponseQueue`, and move it into the `tests.machinery`
package.

Along the way, fix the self-reference of `tests.data` and
`tests.machinery` contents within the `tests.machinery` package.
</pre>

Test our handling of the SSH agent "query" double-response behavior

2026-06-13T18:52:55+02:00

Add tests to verify that we gracefully react to an SSH agent replying
twice to a "query" extension request.
</pre>