Recent commits to derivepassphrase.git (c187d73e08d40b1e1bb9d788f03901f5a9dc67b4)

Update wishlist

2026-03-23T22:04:18+01:00

</pre>

Merge topic branch 'windows-named-pipes' into master

2026-03-23T18:33:33+01:00

* windows-named-pipes: (61 commits)
  Add a changelog entry for Windows named pipe support
  Update the README for v0.6
  Fix unloading SSH keys in the test suite
  Add more tests for the SSH agent socket provider internals
  Overhaul the SSH key tutorial, also aligning it with the SSH key how-to
  Add a tutorial for using SSH keys with `derivepassphrase vault`
  Update the copyright year to 2026
  Fix a longstanding typo in the Markdown manpage examples
  Update the manpages with respect to SSH agents
  Fix minor formatting errors, linting errors, and typos
  Add tests for explicit SSH agent socket provider selection
  Error out correctly when an invalid SSH agent socket provider is specified
  Support specifying the SSH agent socket provider via CLI or configuration
  Document platform-specific coverage exclusion markers
  Work around non-reentrant SSH agent sockets/clients
  Add more coverage exclusion, with commentary
  Report SSH agent socket providers in `--version` output
  Support aliases in `--version` output (item feature lists)
  Turn the built in SSH agent socket provider names into an enum
  Fix coverage slipups in SSH agent socket provider implementations
  ...
</pre>

Add a changelog entry for Windows named pipe support

2026-03-22T22:32:22+01:00

Also mention the `--ssh-agent-socket-provider` command-line option and
the `vault.ssh-agent-socket-provider` configuration option, and mention
some caveats with the test suite on The Annoying OS.

For developers, also mention related recent changes in the test suite:
non-isolated agents and the PERMITTED_SSH_AGENTS and
NON_REENTRANT_SSH_AGENTS environment variables.
</pre>

Update the README for v0.6

2026-03-22T22:23:38+01:00

Adjust the passages concerning SSH agent support and software
dependencies to accurately reflect the state in (what will later become)
v0.6.

Also fix typos in the page footer and in a previous changelog entry that
we came across while editing the README.
</pre>

Fix unloading SSH keys in the test suite

2026-03-22T13:24:44+01:00

In the `ssh_agent_client_with_test_keys_loaded` test fixture, fix the
unloading of the SSH test keys during fixture teardown.  Previously, the
test keys were persisting in the agent due to a protocol violation in
our request -- the payload should be wrapped in an extra layer of
`SSHAgentClient.string` -- but the fixture either never unloaded keys in
the first place (for isolated agents) or it misinterpreted the resulting
error message as indicating that the key was no longer available in the
agent anyway.

To avoid making such silent errors in the future, we now always unload
keys, even for isolated agents, so that these errors have as high
a chance as possible of triggering non-silently.
</pre>

Add more tests for the SSH agent socket provider internals

2026-03-21T20:02:13+01:00

Specifically, add tests for the low-level `WindowsNamedPipeHandle`
class, and for the socket provider selection machinery built on top of
it.  These tests, happily enough, mostly stub out the operating
system-specific parts anyway, so they can be run on all operating
systems, not just The Annoying OS.

The lone `TestGracefulFailureForSSHAuthSock` class now fits into this
larger picture of testing SSH agent socket provider failures, and so is
moved to that section.

Also, an unrelated typo in the inline commentary of the heavy-duty CLI
tests was spotted while preparing this, and swiftly corrected.
</pre>

Overhaul the SSH key tutorial, also aligning it with the SSH key how-to

2026-03-14T17:33:38+01:00

On The Annoying OS, we add screenshots for the steps involving `pageant`
and `puttygen`, because we cannot present a verbatim shell transcript.
The instructions avoid giving motor instructions ("click on ...", "type
... in", etc.) as much as possible, both for consistency with the UNIX
instructions and to focus on the higher-level operations instead.  This
also avoids doing users with motor impairments or unusual input device
setups the disservice of giving them instructions they cannot follow.

We add a definition for "key rotation", and further short commentary on
key compartmentalization and locking the agent (or the key in the
agent).

We align the visual style of both this tutorial and the SSH key how-to
by using the text framing approach from the latter to frame alternate
blocks of content (e.g. operating system-specific instructions), either
explicitly or implicitly, as needed. We ensure that this style is also
used consistently in the how-to as well. Finally, we also add the
`pageant` logo to the how-to, and image credits for the logo on both
pages.
</pre>

Add a tutorial for using SSH keys with `derivepassphrase vault`

2026-03-08T22:46:41+01:00

The tutorial builds on the previous tutorial for setting up
`derivepassphrase vault` with a master passphrase, modifying the
existing configuration to use a master SSH key instead.  It covers SSH
agent installation, key generation, and reconfiguring `derivepassphrase
vault`.  Both tutorials link to each other.

The other tutorial (for setting up `derivepassphrase vault` with
a master passphrase) now also contains a short note on shell prompts as
well as operating system-specific instructions for the `pip` install
method.

For reproducibility, the new tutorial uses the standard Ed25519 SSH test
key as the master SSH key.  The test key is explicitly linked.  The
tutorial also includes a copy of the Pageant icon to help the reader
identify the correct icon in The Annoying OS's task bar.
</pre>

2026-02-08T21:25:06+01:00

Also fix one instance where the declared license identifier still was
the MIT license, making it unclear whether this file was licensed under
a different license than the rest.  (No, it was merely a typo.)
</pre>

Fix a longstanding typo in the Markdown manpage examples

2026-02-08T21:01:20+01:00

Apparently, this is a copy-and-paste error from the PDF rendering of the
manpage when it was originally converted to Markdown: while the PDF
*looked* correct, the text layer was not, and so the pasted text was
also out-of-order.
</pre>