detssh 0.1.0__tar.gz → 0.6.0__tar.gz

detssh-0.6.0/.github/workflows/tests.yml

@@ -0,0 +1,68 @@
+name: Tests
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13', '3.14']
+        os-version: [ubuntu-22.04]
+
+    runs-on: ${{ matrix.os-version }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Run tests (100% coverage required)
+        run: uv run pytest -q
+
+      - name: Run ruff
+        run: uv run ruff check .
+
+      - name: Check formatting
+        run: uv run ruff format --check .
+
+  mutation:
+    needs: test
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Run mutation testing (no unlisted survivors allowed)
+        run: |
+          uv run mutmut run || true
+          uv run mutmut results
+          survivors=$(uv run mutmut results | grep 'survived$' | awk '{print $1}' | sed 's/:$//' | sort)
+          known=$(grep -v '^#' tests/mutmut_known_equivalents.txt | grep -v '^$' | sort)
+          new_survivors=$(comm -23 <(echo "$survivors") <(echo "$known"))
+          if [ -n "$new_survivors" ]; then
+            echo "New surviving mutant(s) not in tests/mutmut_known_equivalents.txt:"
+            echo "$new_survivors"
+            exit 1
+          fi
+          echo "No new survivors."

{detssh-0.1.0 → detssh-0.6.0}/.gitignore

@@ -4,7 +4,10 @@ __pycache__/
 .pytest_cache/
 .ruff_cache/
 .hypothesis/
+.coverage
 .idea/
 *.egg-info/
 dist/
 build/
+mutants/
+.mutmut-cache

detssh-0.6.0/CHANGELOG.md

@@ -0,0 +1,126 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.6.0] - 2026-09-19
+
+### Added
+
+- Mutation testing via `mutmut`, gating CI: it rewrites the source one small
+  change at a time and reruns the suite, catching cases where 100% line
+  coverage still let a real behavior change through untested. Started at
+  300+ surviving mutants (from a from-scratch first run); closed all but
+  40, each confirmed genuinely equivalent - the mutated code is provably
+  indistinguishable from the original for every input (e.g. `"utf-8"` vs
+  `"UTF-8"` as a codec name, which Python's codec lookup can't tell apart)
+  - and documented one by one in `tests/mutmut_known_equivalents.txt`,
+  which CI diffs new runs against.
+- `ruff format --check` now runs in CI alongside `ruff check`.
+
+No application behavior changed in this release - every one of the ~260
+mutants closed was a test that was missing or checking too loosely (an
+exact-message assertion where only a substring was checked before, an edge
+case like a trailing `--kdf` flag with nothing after it, a permission check
+on a directory that already existed rather than one the call under test
+actually creates). The code they exercise was already correct.
+
+## [0.5.0] - 2026-09-19
+
+### Added
+
+- Interactive mode now offers to create a missing output-path parent
+  directory itself, instead of requiring `--create-parent-dirs` up front.
+  It defaults to yes for a path under `~/.ssh` and to no (with a warning)
+  for one outside it - the same rule `--create-parent-dirs` already used.
+
+### Changed
+
+- Flag mode now fails fast with a clear error when the output path's
+  parent is missing and `--create-parent-dirs` wasn't passed, instead of
+  running key derivation first and then failing on a raw `OSError`.
+
+### Fixed
+
+- `--kdf`/`--salt-algo` backend detection (used to decide which options to
+  show before click's real parsing runs) could misread a flag's own value
+  as a second occurrence of the flag when the value happened to equal the
+  flag string itself (e.g. `--kdf --kdf`).
+
+## [0.4.0] - 2026-09-09
+
+### Added
+
+- The interactive run now offers to register the key it just wrote, so
+  generating a key and getting `ssh <label>` to use it is one command
+  instead of two. The label doubles as the `Host` name; declining leaves
+  the key exactly as written.
+- `--register <user>@<host>` and `--register-port` do the same in flag mode.
+  `--register` needs `--label`, since the label names the `Host` block. Both
+  are validated before key derivation starts, so a typo doesn't cost you a
+  minute of argon2 first.
+
+### Changed
+
+- `detssh ssh register --port` now rejects non-numeric and out-of-range
+  ports up front instead of writing them into the generated `Host` block.
+- Registered `IdentityFile` paths are stored absolute. A relative `--key`
+  used to be recorded as given, which `ssh` would then resolve against
+  whatever directory it happened to be run from.
+
+## [0.3.0] - 2026-08-23
+
+### Added
+
+- `detssh ssh register <label> <user>@<host> --key <path>`: records the
+  label in `~/.config/detssh/config`, generates a `Host` block for it, and
+  wires it into `~/.ssh/config` via a single `Include` line - so plain
+  `ssh <label>` connects with the right key afterward, no `-i` or
+  hand-written config needed. Also `detssh ssh list` and
+  `detssh ssh forget <label>` (never deletes the key file itself).
+- `--create-parent-dirs`: create the output path's missing parent
+  directories, including outside `~/.ssh` (with one interactive
+  confirmation first in that case). Previously only `~/.ssh` itself was
+  ever auto-created.
+- The interactive output-path prompt now notes when the default location is
+  already occupied, before you type anything.
+
+## [0.2.0] - 2026-08-04
+
+### Added
+
+- `--key-passphrase` option, with a matching interactive prompt (skippable
+  by leaving it blank), to encrypt the private key file at rest - like
+  `ssh-keygen -N`. Independent of the seed passphrase: it never touches key
+  derivation, so it doesn't change the key produced for a given seed, only
+  how the file sits on disk.
+- 100% line+branch test coverage, enforced both locally and in CI via
+  `pytest-cov` - `uv run pytest` fails under 100%, no separate command to
+  remember.
+
+## [0.1.0] - 2026-07-19
+
+### Added
+
+- Deterministic Ed25519 SSH key generation from a seed passphrase: same
+  passphrase and parameters produce the same keypair on any machine.
+- KDF backends: `argon2id` (default), `argon2i`, `argon2d`, `scrypt`,
+  `pbkdf2`, `bcrypt_pbkdf`.
+- Salt hash algorithm backends: `blake2b` (default), `blake2s`, `sha256`,
+  `sha384`, `sha512`, `sha3_256`, `sha3_384`, `sha3_512`.
+- Interactive mode (prompts for everything, passphrase hidden and confirmed)
+  and non-interactive flag mode, selected automatically by whether any flag
+  is passed.
+- `ssh-keygen`-style default output path (`~/.ssh/id_ed25519` /
+  `.pub`), created with the same file/directory permissions (600/700) and
+  the same overwrite confirmation.
+- Soft safety limits on cost knobs (iterations, memory, cost, rounds, ...)
+  that catch typos before they cost minutes of derivation time - summarized
+  in one confirmation in interactive mode, or bypassable with
+  `--force-allow-soft-constraints` in flag mode.
+- Per-backend `--help` showing the valid options and ranges for a given
+  `--kdf`/`--salt-algo` combination.

detssh-0.6.0/PKG-INFO

@@ -0,0 +1,154 @@
+Metadata-Version: 2.5
+Name: detssh
+Version: 0.6.0
+Summary: Deterministic Ed25519 SSH key generation from a seed passphrase, via configurable KDF and salt-hash backends.
+Project-URL: Homepage, https://github.com/isik-kaplan/detssh
+Project-URL: Repository, https://github.com/isik-kaplan/detssh
+Author-email: Işık Kaplan <isik.kaplan@outlook.com>
+License: MIT
+License-File: LICENSE
+Keywords: argon2,bcrypt,cryptography,ed25519,kdf,pbkdf2,scrypt,ssh
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.11
+Requires-Dist: argon2-cffi>=21.3
+Requires-Dist: bcrypt>=5.0.0
+Requires-Dist: click>=8.1
+Requires-Dist: cryptography>=41.0
+Requires-Dist: questionary>=2.1.1
+Description-Content-Type: text/markdown
+
+# detssh
+
+Deterministic Ed25519 SSH key generation from a seed passphrase. Same
+passphrase + same parameters → same keypair, every time, on any machine -
+nothing to back up but what's in your head.
+
+```
+detssh
+```
+Prompts for everything (passphrase hidden + confirmed) and writes to the
+same place `ssh-keygen` would: `~/.ssh/id_ed25519` / `~/.ssh/id_ed25519.pub`
+(mode 600/700, `~/.ssh` created if missing). Pass `--output` to write
+somewhere else instead.
+
+Non-interactively:
+```
+detssh --kdf argon2id --salt-algo blake2b --seed "..." --label github --overwrite-files
+```
+Any flag switches to non-interactive mode: missing optional fields fall back
+to their defaults, `--seed` is the only required one. Passing `--seed` on the
+command line puts it in your shell history and process list (`ps aux`) - fine
+for local scripting, but prefer the interactive prompt when that matters.
+
+By default the private key file is written unencrypted, like `ssh-keygen -N
+""`. Pass `--key-passphrase` (or leave it blank at the interactive prompt to
+skip) to encrypt it at rest instead - anyone who gets the file will still
+need that passphrase to use it. This is unrelated to the seed passphrase: it
+never touches key derivation, so it doesn't need to be remembered to
+*recreate* the key, only to unlock the file you already have. Same caveat as
+`--seed` applies if passed as a flag.
+
+## Using the key with `ssh`
+
+`ssh` only auto-offers keys with default filenames (`id_rsa`, `id_ed25519`, ...)
+sitting directly in `~/.ssh/` - a key written under `--output` or a per-label
+subdirectory needs either `-i <path>`, a hand-written `Host` block in
+`~/.ssh/config`, or `ssh-add`ing it to your agent.
+
+The interactive run offers to do this for you at the end, right after it
+writes the key:
+```
+Register this key so `ssh isik:personal:contabo` connects with it? [Y/n]: y
+Destination (user@host): root@contabo.com
+Non-default ssh port:
+
+Registered isik:personal:contabo -> root@contabo.com
+Run: ssh isik:personal:contabo
+```
+The label you derived the key with doubles as the `Host` name, so there's
+nothing extra to type. In flag mode, `--register root@contabo.com` (plus
+`--register-port` when it isn't 22) does the same thing, and needs `--label`
+for that reason. Declining changes nothing about the key that was written.
+
+For a key you already have, `detssh ssh register` reaches the same end state:
+```
+detssh ssh register isik:personal:contabo root@contabo.com --key ~/.ssh/isik:personal:contabo/id_ed25519
+```
+Either route records the label in `~/.config/detssh/config`, generates a `Host` block
+for it in a detssh-managed file, and adds a single `Include` line to
+`~/.ssh/config` (once, at the top) that pulls it in. After that,
+`ssh isik:personal:contabo` just works - through real `ssh`, nothing routed
+through detssh at connect time.
+
+```
+detssh ssh list              # show registered labels
+detssh ssh forget <label>    # remove a label (never deletes the key file)
+```
+
+## Backends
+
+- `--kdf`: `argon2id` (default), `argon2i`, `argon2d`, `scrypt`, `pbkdf2`, `bcrypt_pbkdf`
+- `--salt-algo`: `blake2b` (default), `blake2s`, `sha256`, `sha384`, `sha512`, `sha3_256`, `sha3_384`, `sha3_512`
+
+Each combination has its own options (cost knobs, salt digest size, etc.),
+with their valid ranges shown in both `--help` and the interactive prompts.
+See them with:
+```
+detssh --kdf <kdf> --salt-algo <salt-algo> --help
+```
+
+We recommend sticking with the defaults (`argon2id`, memory-hard with a high
+cost) unless you have a specific reason not to - they make brute-forcing your
+passphrase significantly more expensive than faster KDFs like `pbkdf2`.
+
+Cost knobs (iterations, memory, cost, rounds, ...) also carry a soft safety
+limit meant to catch typos before they cost you minutes of derivation time.
+In interactive mode, going over one doesn't interrupt you - everything you
+exceeded is summarized in one confirmation at the very end. In flag mode, it
+fails immediately unless you pass `--force-allow-soft-constraints`.
+
+## Determinism guarantee
+
+Same explicit parameters → same key, across any release sharing the same
+major version - only a major version bump may change key derivation. That
+guarantee starts at 1.0; we're still on 0.x, so it doesn't apply yet (see
+`tests/golden/README.md`).
+
+## Development
+
+```
+uv sync
+uv run pytest
+uv run ruff check .
+uv run ruff format --check .
+```
+
+`pytest` runs with coverage on by default (`[tool.pytest.ini_options]` in
+`pyproject.toml`) and fails under 100% line+branch coverage - same gate
+locally and in CI, nothing extra to remember to pass.
+
+100% coverage means every line runs under test, not that every behavior
+change gets caught - a test can execute a line without asserting anything
+meaningful about it. [`mutmut`](https://mutmut.readthedocs.io/) checks the
+second thing: it rewrites the source one small change at a time (flips a
+comparison, drops an argument, tweaks a string) and reruns the tests against
+each mutant, one at a time. A mutant that still passes ("survived") is a
+change the suite wouldn't notice.
+
+```
+uv run mutmut run       # takes a few minutes; ctrl-c-safe, resumes where it left off
+uv run mutmut results   # list survivors by name
+uv run mutmut show <name>   # see what a specific mutant changed
+```
+
+A survivor is either a real test gap (add an assertion that would fail
+against the mutant) or a genuinely equivalent mutant - the mutated code is
+provably indistinguishable from the original for every input (e.g.
+`"utf-8"` vs `"UTF-8"` as a codec name: Python's codec lookup is
+case-insensitive, so no test could tell them apart). CI
+(`.github/workflows/tests.yml`, job `mutation`) fails on any survivor not
+listed in `tests/mutmut_known_equivalents.txt`, which names each one and
+says why - add a confirmed-equivalent mutant there (never to silence a
+failure without doing that check) rather than chasing an unwinnable test.

detssh-0.6.0/README.md

@@ -0,0 +1,133 @@
+# detssh
+
+Deterministic Ed25519 SSH key generation from a seed passphrase. Same
+passphrase + same parameters → same keypair, every time, on any machine -
+nothing to back up but what's in your head.
+
+```
+detssh
+```
+Prompts for everything (passphrase hidden + confirmed) and writes to the
+same place `ssh-keygen` would: `~/.ssh/id_ed25519` / `~/.ssh/id_ed25519.pub`
+(mode 600/700, `~/.ssh` created if missing). Pass `--output` to write
+somewhere else instead.
+
+Non-interactively:
+```
+detssh --kdf argon2id --salt-algo blake2b --seed "..." --label github --overwrite-files
+```
+Any flag switches to non-interactive mode: missing optional fields fall back
+to their defaults, `--seed` is the only required one. Passing `--seed` on the
+command line puts it in your shell history and process list (`ps aux`) - fine
+for local scripting, but prefer the interactive prompt when that matters.
+
+By default the private key file is written unencrypted, like `ssh-keygen -N
+""`. Pass `--key-passphrase` (or leave it blank at the interactive prompt to
+skip) to encrypt it at rest instead - anyone who gets the file will still
+need that passphrase to use it. This is unrelated to the seed passphrase: it
+never touches key derivation, so it doesn't need to be remembered to
+*recreate* the key, only to unlock the file you already have. Same caveat as
+`--seed` applies if passed as a flag.
+
+## Using the key with `ssh`
+
+`ssh` only auto-offers keys with default filenames (`id_rsa`, `id_ed25519`, ...)
+sitting directly in `~/.ssh/` - a key written under `--output` or a per-label
+subdirectory needs either `-i <path>`, a hand-written `Host` block in
+`~/.ssh/config`, or `ssh-add`ing it to your agent.
+
+The interactive run offers to do this for you at the end, right after it
+writes the key:
+```
+Register this key so `ssh isik:personal:contabo` connects with it? [Y/n]: y
+Destination (user@host): root@contabo.com
+Non-default ssh port:
+
+Registered isik:personal:contabo -> root@contabo.com
+Run: ssh isik:personal:contabo
+```
+The label you derived the key with doubles as the `Host` name, so there's
+nothing extra to type. In flag mode, `--register root@contabo.com` (plus
+`--register-port` when it isn't 22) does the same thing, and needs `--label`
+for that reason. Declining changes nothing about the key that was written.
+
+For a key you already have, `detssh ssh register` reaches the same end state:
+```
+detssh ssh register isik:personal:contabo root@contabo.com --key ~/.ssh/isik:personal:contabo/id_ed25519
+```
+Either route records the label in `~/.config/detssh/config`, generates a `Host` block
+for it in a detssh-managed file, and adds a single `Include` line to
+`~/.ssh/config` (once, at the top) that pulls it in. After that,
+`ssh isik:personal:contabo` just works - through real `ssh`, nothing routed
+through detssh at connect time.
+
+```
+detssh ssh list              # show registered labels
+detssh ssh forget <label>    # remove a label (never deletes the key file)
+```
+
+## Backends
+
+- `--kdf`: `argon2id` (default), `argon2i`, `argon2d`, `scrypt`, `pbkdf2`, `bcrypt_pbkdf`
+- `--salt-algo`: `blake2b` (default), `blake2s`, `sha256`, `sha384`, `sha512`, `sha3_256`, `sha3_384`, `sha3_512`
+
+Each combination has its own options (cost knobs, salt digest size, etc.),
+with their valid ranges shown in both `--help` and the interactive prompts.
+See them with:
+```
+detssh --kdf <kdf> --salt-algo <salt-algo> --help
+```
+
+We recommend sticking with the defaults (`argon2id`, memory-hard with a high
+cost) unless you have a specific reason not to - they make brute-forcing your
+passphrase significantly more expensive than faster KDFs like `pbkdf2`.
+
+Cost knobs (iterations, memory, cost, rounds, ...) also carry a soft safety
+limit meant to catch typos before they cost you minutes of derivation time.
+In interactive mode, going over one doesn't interrupt you - everything you
+exceeded is summarized in one confirmation at the very end. In flag mode, it
+fails immediately unless you pass `--force-allow-soft-constraints`.
+
+## Determinism guarantee
+
+Same explicit parameters → same key, across any release sharing the same
+major version - only a major version bump may change key derivation. That
+guarantee starts at 1.0; we're still on 0.x, so it doesn't apply yet (see
+`tests/golden/README.md`).
+
+## Development
+
+```
+uv sync
+uv run pytest
+uv run ruff check .
+uv run ruff format --check .
+```
+
+`pytest` runs with coverage on by default (`[tool.pytest.ini_options]` in
+`pyproject.toml`) and fails under 100% line+branch coverage - same gate
+locally and in CI, nothing extra to remember to pass.
+
+100% coverage means every line runs under test, not that every behavior
+change gets caught - a test can execute a line without asserting anything
+meaningful about it. [`mutmut`](https://mutmut.readthedocs.io/) checks the
+second thing: it rewrites the source one small change at a time (flips a
+comparison, drops an argument, tweaks a string) and reruns the tests against
+each mutant, one at a time. A mutant that still passes ("survived") is a
+change the suite wouldn't notice.
+
+```
+uv run mutmut run       # takes a few minutes; ctrl-c-safe, resumes where it left off
+uv run mutmut results   # list survivors by name
+uv run mutmut show <name>   # see what a specific mutant changed
+```
+
+A survivor is either a real test gap (add an assertion that would fail
+against the mutant) or a genuinely equivalent mutant - the mutated code is
+provably indistinguishable from the original for every input (e.g.
+`"utf-8"` vs `"UTF-8"` as a codec name: Python's codec lookup is
+case-insensitive, so no test could tell them apart). CI
+(`.github/workflows/tests.yml`, job `mutation`) fails on any survivor not
+listed in `tests/mutmut_known_equivalents.txt`, which names each one and
+says why - add a confirmed-equivalent mutant there (never to silence a
+failure without doing that check) rather than chasing an unwinnable test.

{detssh-0.1.0 → detssh-0.6.0}/detssh/__init__.py

@@ -3,7 +3,7 @@ from detssh.backends.salt import ALGOS as SALT_ALGOS
 from detssh.keygen import default_output_path, keypair_from_seed, public_key_path, write_keypair
 
 
-__version__ = "0.1.0"
+__version__ = "0.6.0"
 __all__ = [
     "KDF_BACKENDS",
     "SALT_ALGOS",

{detssh-0.1.0 → detssh-0.6.0}/detssh/backends/base.py

@@ -3,7 +3,7 @@ from pathlib import Path
 import click
 import questionary
 
-from detssh.keygen import keypair_from_seed, public_key_path, write_keypair
+from detssh.keygen import keypair_from_seed, public_key_path, ssh_dir, write_keypair
 
 
 def _display_path(path):
@@ -55,11 +55,15 @@ class Field:
     def ask(self, default):
         message = self.message + self.hint()
         if self.kind == "secret":
-            return click.prompt(message, hide_input=True, confirmation_prompt=True)
+            if self.required:
+                return click.prompt(message, hide_input=True, confirmation_prompt=True)
+            return click.prompt(message, hide_input=True, confirmation_prompt=True, default="", show_default=False)
         if self.kind == "int":
             return click.prompt(message, default=default, type=int)
         if self.kind == "path":
             if default is not None:
+                if Path(default).exists() or public_key_path(default).exists():
+                    click.echo(f"Note: {_display_path(default)} already exists - enter a different path to avoid this.")
                 message = f"{message} [{_display_path(default)}]"
             return click.prompt(
                 message, default=default, type=click.Path(dir_okay=False, path_type=Path), show_default=False
@@ -159,19 +163,61 @@ def confirm_overwrite(output, overwrite_files):
         raise click.Abort()
 
 
-def write_keypair_and_recap(seed_bytes, output, comment, recap):
+def confirm_create_parent_dirs(output, create_parent_dirs, interactive):
+    """Decide whether to create the output path's missing parent directories.
+
+    Returns the (possibly updated) flag for write_keypair_and_recap to act on. Flag
+    mode requires --create-parent-dirs up front and fails fast otherwise, so a typo
+    surfaces before key derivation rather than as a raw OSError after it. Interactive
+    mode prompts for the same decision instead, defaulting to yes under ~/.ssh and to
+    no (with a warning) elsewhere - matching what --create-parent-dirs would have done.
+    """
+    parent = Path(output).parent
+    if parent.exists() or parent == ssh_dir():
+        return create_parent_dirs
+
+    outside = not parent.is_relative_to(ssh_dir())
+
+    if not interactive:
+        if not create_parent_dirs:
+            raise click.UsageError(f"{_display_path(parent)} doesn't exist. Pass --create-parent-dirs to create it.")
+        return True
+
+    if not create_parent_dirs and not outside:
+        question, default = f"{_display_path(parent)} doesn't exist. Create it?", True
+    elif outside:
+        click.echo(f"Warning: {_display_path(parent)} is outside ~/.ssh.")
+        question, default = "Create it anyway?", False
+    else:
+        return True
+
+    if not click.confirm(question, default=default):
+        raise click.Abort()
+    return True
+
+
+def write_keypair_and_recap(seed_bytes, output, comment, recap, key_passphrase="", create_parent_dirs=False):
     private_key, public_key = keypair_from_seed(seed_bytes)
     try:
-        priv_path, pub_path = write_keypair(private_key, public_key, output, comment=comment)
+        priv_path, pub_path = write_keypair(
+            private_key,
+            public_key,
+            output,
+            comment=comment,
+            key_passphrase=key_passphrase,
+            create_parent_dirs=create_parent_dirs,
+        )
     except OSError as e:
         raise click.ClickException(f"couldn't write {output}: {e.strerror or e}") from e
     except ValueError as e:
         raise click.UsageError(str(e)) from e
 
-    click.echo(f"Wrote private key: {priv_path}")
+    click.echo(f"Wrote private key: {priv_path}{' (encrypted)' if key_passphrase else ''}")
     click.echo(f"Wrote public key:  {pub_path}")
 
     click.echo()
     click.echo("To recreate this exact key, remember your passphrase (keep it secret) plus:")
     for name, value in (*recap, ("algorithm", "ed25519")):
         click.echo(f"  {name:<18} {value}")
+
+    return priv_path, pub_path

{detssh-0.1.0 → detssh-0.6.0}/detssh/backends/kdf/__init__.py

@@ -15,8 +15,13 @@ BACKENDS = {
     "bcrypt_pbkdf": BcryptPbkdf,
 }
 
-for _name, _backend in BACKENDS.items():
-    if _backend.name != _name:
-        raise TypeError(f"{_backend.__name__}.name must equal its registry key {_name!r}")
-    if _backend.salt_constraints is None:
-        raise TypeError(f"{_backend.__name__} must set salt_constraints (use NO_SALT_CONSTRAINTS if none apply)")
+
+def validate_backends(backends):
+    for name, backend in backends.items():
+        if backend.name != name:
+            raise TypeError(f"{backend.__name__}.name must equal its registry key {name!r}")
+        if backend.salt_constraints is None:
+            raise TypeError(f"{backend.__name__} must set salt_constraints (use NO_SALT_CONSTRAINTS if none apply)")
+
+
+validate_backends(BACKENDS)

{detssh-0.1.0 → detssh-0.6.0}/detssh/backends/salt/__init__.py

@@ -19,8 +19,13 @@ ALGOS = {
     "sha3_512": Sha3512,
 }
 
-for _name, _algo in ALGOS.items():
-    if _algo.name != _name:
-        raise TypeError(f"{_algo.__name__}.name must equal its registry key {_name!r}")
-    if _algo.digest_size is None and (_algo.min_digest_size is None or _algo.max_digest_size is None):
-        raise TypeError(f"{_algo.__name__} must set digest_size, or min/max_digest_size if variable")
+
+def validate_algos(algos):
+    for name, algo in algos.items():
+        if algo.name != name:
+            raise TypeError(f"{algo.__name__}.name must equal its registry key {name!r}")
+        if algo.digest_size is None and (algo.min_digest_size is None or algo.max_digest_size is None):
+            raise TypeError(f"{algo.__name__} must set digest_size, or min/max_digest_size if variable")
+
+
+validate_algos(ALGOS)