https://git.schokokeks.org/derivepassphrase.git/tree/c61d17b815f52bf49ce840c00fbaa75db8e11b96 Recent commits feed provided by GitList. The test mocks communication aspects of an SSH agent session, and thus needs a running SSH agent. Also, the xfail markers for some of the parametrization values were overly broad, and were masking failures in the test setup because of a missing running SSH agent. https://git.schokokeks.org/derivepassphrase.git/commit/c61d17b815f52bf49ce840c00fbaa75db8e11b96 software@the13thletter.info (Marco Ricci) Sun, 14 Jun 2026 07:54:14 +0200 c61d17b815f52bf49ce840c00fbaa75db8e11b96 Introduce a second coverage exclusion marker in the form of an overridable session-level fixture `skip_if_no_ctypes_windll_support`, similar to the existing `skip_if_no_af_unix_support` fixture. Also update the description of both fixtures to match their current usage. Also also fix a coverage slipup in a failsafe path of the `AgentProtocolResponseQueue` testing machinery. https://git.schokokeks.org/derivepassphrase.git/commit/6da7a92c3285a1f757cbe7530fe17caf680ad468 software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 21:28:11 +0200 6da7a92c3285a1f757cbe7530fe17caf680ad468 Rename the `Request` and `Response` classes to `AgentProtocolRequest` and `AgentProtocolResponse`, respectively, and move them into the `tests.data` package. Rename the `_RequestResponseIOQueue` class to `AgentProtocolResponseQueue`, and move it into the `tests.machinery` package. Along the way, fix the self-reference of `tests.data` and `tests.machinery` contents within the `tests.machinery` package. https://git.schokokeks.org/derivepassphrase.git/commit/3430fde355127c4e0951bfaa6f5df63bf82b5f32 software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 19:22:20 +0200 3430fde355127c4e0951bfaa6f5df63bf82b5f32 Add tests to verify that we gracefully react to an SSH agent replying twice to a "query" extension request. https://git.schokokeks.org/derivepassphrase.git/commit/2323b5742485ed8ab30c57989a399c491b7484ce software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 18:52:55 +0200 2323b5742485ed8ab30c57989a399c491b7484ce Generalize the mocked SSH agent machinery for simulating error responses slightly, so that instead of passing one-to-one request/response pairs, we pass one-to-many request/list-of-responses pairs. Responses are kept on a queue, and the machinery asserts that the queue is empty at the end of the interaction. This new flexibility is not yet required anywhere, but will be used in the next commit. https://git.schokokeks.org/derivepassphrase.git/commit/0166a2edbd9c81df63e2d9fd5c057212d4ce6b45 software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 18:52:55 +0200 0166a2edbd9c81df63e2d9fd5c057212d4ce6b45 Detect and work around `ssh-agent` (OpenSSH 10.3 only) responding twice when answering a "query" extension request: once with the expected "extension response" or "success" message, and once with an unexpected/additional empty "success" message. We detect the extra empty "success" message in a generic and protocol compliant way, and re-align request-response-pair boundaries for any future requests. From the agent's perspective, the work-around does a read-only operation and should not change any permanent agent state, whether there are extra empty "success" messages or not. As written, the work-around tests specifically for output from OpenSSH 10.3, but is otherwise agnostic to the "extension response" message contents and could be easily adapted to trigger for other content patterns. https://git.schokokeks.org/derivepassphrase.git/commit/20bcd8f960b0655700905e9f20f807de15809188 software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 18:52:55 +0200 20bcd8f960b0655700905e9f20f807de15809188 Factor out the serialization of the request message and the deserialization of the response message from `SSHAgentClient.request` into separate helper methods. `SSHAgentClient.request` now only contains the management of expected response codes, and the raising of errors if unexpected response codes are received. While this refactoring was unnecessary so far – requests and responses were always paired and aligned – the next piece of code I intend to commit requires handling unpaired responses, and will use only one of these helper methods. https://git.schokokeks.org/derivepassphrase.git/commit/ea78e13123d1ce64bf4e02c624497ae6c37a6b3f software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 16:04:08 +0200 ea78e13123d1ce64bf4e02c624497ae6c37a6b3f The `SSH_AGENT` and `SSH_AGENTC` types now inherit from `int`, because SSH agent protocol message numbers are 8-bit unsigned integers. This cuts down on a lot of (previously necessary) type conversion steps whenever mixed groups of message numbers were involved (e.g. the `SSHAgentClient.request` `response_code` argument), or when message numbers needed to be compared with each other (e.g. tests). https://git.schokokeks.org/derivepassphrase.git/commit/57e3b1ed832e865e9f9e8316f930b1beae3714f0 software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 15:56:18 +0200 57e3b1ed832e865e9f9e8316f930b1beae3714f0 For SSHAgentFailedError, include the raw response text in the error message. (Escaped, but not trimmed.) The response text is seldom textual in nature, and discarding non-printable parts of the text turns out to be much more of a hindrance than a help when debugging unexpected agent behavior. https://git.schokokeks.org/derivepassphrase.git/commit/6de63ce9751f3988ebd2255e169a4cc9d584c34f software@the13thletter.info (Marco Ricci) Sat, 13 Jun 2026 07:52:46 +0200 6de63ce9751f3988ebd2255e169a4cc9d584c34f * windows-named-pipes: Update the release checklist with PERMITTED_SSH_AGENTS and NON_REENTRANT_SSH_AGENTS https://git.schokokeks.org/derivepassphrase.git/commit/bb91119578d2d7e92ff5cb0f5954939a159871b1 software@the13thletter.info (Marco Ricci) Thu, 23 Apr 2026 19:31:54 +0200 bb91119578d2d7e92ff5cb0f5954939a159871b1