detssh 0.7.0__tar.gz → 0.8.0__tar.gz

{detssh-0.7.0 → detssh-0.8.0}/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-10-25
+
+### Changed
+
+- Options, questions and their checks now come from one declaration per
+  setting, built on `isik[cli]` (a new dependency). `--help`, every flag,
+  every question and every derived key are unchanged.
+- In interactive mode, `--overwrite-files` with "Only add the public key" is
+  now refused, as it already was with `--authorize`. Before, it was quietly
+  ignored.
+
 ## [0.7.0] - 2026-10-05
 
 ### Added

detssh-0.8.0/PKG-INFO

@@ -0,0 +1,40 @@
+Metadata-Version: 2.5
+Name: detssh
+Version: 0.8.0
+Summary: Deterministic Ed25519 SSH key generation from a seed passphrase, via configurable KDF and salt-hash backends.
+Project-URL: Homepage, https://github.com/isik-kaplan/detssh
+Project-URL: Repository, https://github.com/isik-kaplan/detssh
+Author-email: Işık Kaplan <isik.kaplan@outlook.com>
+License: MIT
+License-File: LICENSE
+Keywords: argon2,bcrypt,cryptography,ed25519,kdf,pbkdf2,scrypt,ssh
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.11
+Requires-Dist: argon2-cffi>=21.3
+Requires-Dist: bcrypt>=5.0.0
+Requires-Dist: click>=8.1
+Requires-Dist: cryptography>=41.0
+Requires-Dist: isik[cli]>=0.34.0
+Requires-Dist: questionary>=2.1.1
+Description-Content-Type: text/markdown
+
+# detssh
+
+Deterministic Ed25519 SSH keys from a passphrase: same passphrase, same key,
+on any machine. Nothing to back up.
+
+```
+uv tool install detssh
+detssh
+```
+
+`detssh` asks for everything it needs.
+
+I name labels `<owner>:<site>:<machine>`, e.g. `isik:home:laptop` or
+`client:cloud:web1`
+([more](https://github.com/isik-kaplan/detssh/blob/master/docs/labels.md)).
+
+See the [docs](https://github.com/isik-kaplan/detssh/tree/master/docs) for
+flags and everything else.

detssh-0.8.0/README.md

@@ -0,0 +1,18 @@
+# detssh
+
+Deterministic Ed25519 SSH keys from a passphrase: same passphrase, same key,
+on any machine. Nothing to back up.
+
+```
+uv tool install detssh
+detssh
+```
+
+`detssh` asks for everything it needs.
+
+I name labels `<owner>:<site>:<machine>`, e.g. `isik:home:laptop` or
+`client:cloud:web1`
+([more](https://github.com/isik-kaplan/detssh/blob/master/docs/labels.md)).
+
+See the [docs](https://github.com/isik-kaplan/detssh/tree/master/docs) for
+flags and everything else.

{detssh-0.7.0 → detssh-0.8.0}/detssh/__init__.py

@@ -3,7 +3,7 @@ from detssh.backends.salt import ALGOS as SALT_ALGOS
 from detssh.keygen import default_output_path, keypair_from_seed, public_key_path, write_keypair
 
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"
 __all__ = [
     "KDF_BACKENDS",
     "SALT_ALGOS",

detssh-0.8.0/detssh/backends/base.py

@@ -0,0 +1,122 @@
+from pathlib import Path
+
+import click
+from isik.common.settings import Settings
+
+from detssh.keygen import (
+    authorize_public_key,
+    keypair_from_seed,
+    public_key_line,
+    public_key_path,
+    ssh_dir,
+    write_keypair,
+)
+
+
+def _display_path(path):
+    try:
+        return f"~/{Path(path).relative_to(Path.home())}"
+    except (TypeError, ValueError):
+        return str(path)
+
+
+class NoSettings(Settings):
+    """The settings of a backend that has none to give."""
+
+
+def note_if_exists(default):
+    """Before asking for an output path: say so when the offered default would overwrite a key."""
+    if default is not None and (Path(default).exists() or public_key_path(default).exists()):
+        click.echo(f"Note: {_display_path(default)} already exists - enter a different path to avoid this.")
+
+
+def confirm_overwrite(output, overwrite_files):
+    if overwrite_files:
+        return
+    output = Path(output)
+    if (output.exists() or public_key_path(output).exists()) and not click.confirm(
+        f"{output} already exists. Overwrite?"
+    ):
+        raise click.Abort()
+
+
+def confirm_create_parent_dirs(output, create_parent_dirs, interactive):
+    """Decide whether to create the output path's missing parent directories.
+
+    Returns the (possibly updated) flag for write_keypair_and_recap to act on. Flag
+    mode requires --create-parent-dirs up front and fails fast otherwise, so a typo
+    surfaces before key derivation rather than as a raw OSError after it. Interactive
+    mode prompts for the same decision instead, defaulting to yes under ~/.ssh and to
+    no (with a warning) elsewhere - matching what --create-parent-dirs would have done.
+    """
+    parent = Path(output).parent
+    if parent.exists() or parent == ssh_dir():
+        return create_parent_dirs
+
+    outside = not parent.is_relative_to(ssh_dir())
+
+    if not interactive:
+        if not create_parent_dirs:
+            raise click.UsageError(f"{_display_path(parent)} doesn't exist. Pass --create-parent-dirs to create it.")
+        return True
+
+    if not create_parent_dirs and not outside:
+        question, default = f"{_display_path(parent)} doesn't exist. Create it?", True
+    elif outside:
+        click.echo(f"Warning: {_display_path(parent)} is outside ~/.ssh.")
+        question, default = "Create it anyway?", False
+    else:
+        return True
+
+    if not click.confirm(question, default=default):
+        raise click.Abort()
+    return True
+
+
+def write_keypair_and_recap(seed_bytes, output, comment, recap, key_passphrase="", create_parent_dirs=False):
+    private_key, public_key = keypair_from_seed(seed_bytes)
+    try:
+        priv_path, pub_path = write_keypair(
+            private_key,
+            public_key,
+            output,
+            comment=comment,
+            key_passphrase=key_passphrase,
+            create_parent_dirs=create_parent_dirs,
+        )
+    except OSError as e:
+        raise click.ClickException(f"couldn't write {output}: {e.strerror or e}") from e
+    except ValueError as e:
+        raise click.UsageError(str(e)) from e
+
+    click.echo(f"Wrote private key: {priv_path}{' (encrypted)' if key_passphrase else ''}")
+    click.echo(f"Wrote public key:  {pub_path}")
+
+    echo_recap(recap)
+
+    return priv_path, pub_path
+
+
+def authorize_and_recap(seed_bytes, authorized_keys, comment, recap, create_parent_dirs=False):
+    _, public_key = keypair_from_seed(seed_bytes)
+    try:
+        added = authorize_public_key(
+            public_key, authorized_keys, comment=comment, create_parent_dirs=create_parent_dirs
+        )
+    except OSError as e:
+        raise click.ClickException(f"couldn't write {authorized_keys}: {e.strerror or e}") from e
+
+    if added:
+        click.echo(f"Added public key to {authorized_keys}:")
+    else:
+        click.echo(f"Public key already in {authorized_keys}, left it unchanged:")
+    click.echo(f"  {public_key_line(public_key, comment).decode('utf-8').rstrip()}")
+
+    echo_recap(recap)
+
+
+def echo_recap(recap):
+    click.echo()
+    click.echo("To recreate this exact key, remember your passphrase (keep it secret) plus:")
+    for name, value in (*recap, ("algorithm", "ed25519")):
+        click.echo(f"  {name:<18} {value}")

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/kdf/_argon2.py

@@ -1,24 +1,20 @@
 from argon2.exceptions import Argon2Error
 from argon2.low_level import hash_secret_raw
+from isik.common.settings import Setting, Settings
 
-from detssh.backends.base import Field
 from detssh.backends.kdf.base import KDFBackend, KDFError, SaltConstraints
 
 
+class Argon2Settings(Settings):
+    iterations = Setting(int, "Argon2 iterations", default=10, soft_max=100)
+    memory = Setting(int, "Argon2 memory, in MiB", default=1024, soft_max=2048)
+    parallelism = Setting(int, "Argon2 parallelism", default=4, soft_max=16)
+
+
 class Argon2Base(KDFBackend):
     salt_constraints = SaltConstraints(min_size=8)
     type = None
-
-    fields = {
-        "iterations": Field("Argon2 iterations", kind="int", soft_max=100),
-        "memory": Field("Argon2 memory, in MiB", kind="int", soft_max=2048),
-        "parallelism": Field("Argon2 parallelism", kind="int", soft_max=16),
-    }
-    defaults = {
-        "iterations": 10,
-        "memory": 1024,
-        "parallelism": 4,
-    }
+    settings = Argon2Settings
 
     @classmethod
     def run(cls, resolved, salt):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/kdf/base.py

@@ -1,3 +1,6 @@
+from detssh.backends.base import NoSettings
+
+
 class SaltConstraints:
     def __init__(self, min_size=None, max_size=None, exact_size=None):
         self.min_size = min_size
@@ -24,8 +27,7 @@ class KDFError(Exception):
 class KDFBackend:
     name = None
     salt_constraints = None
-    fields = {}
-    defaults = {}
+    settings = NoSettings
 
     @classmethod
     def run(cls, resolved, salt):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/kdf/bcrypt_pbkdf.py

@@ -1,19 +1,17 @@
 import bcrypt
+from isik.common.settings import Setting, Settings
 
-from detssh.backends.base import Field
 from detssh.backends.kdf.base import KDFBackend, KDFError, SaltConstraints
 
 
+class BcryptPbkdfSettings(Settings):
+    rounds = Setting(int, "bcrypt_pbkdf rounds", default=16, soft_max=2000)
+
+
 class BcryptPbkdf(KDFBackend):
     name = "bcrypt_pbkdf"
     salt_constraints = SaltConstraints(min_size=1)
-
-    fields = {
-        "rounds": Field("bcrypt_pbkdf rounds", kind="int", soft_max=2000),
-    }
-    defaults = {
-        "rounds": 16,
-    }
+    settings = BcryptPbkdfSettings
 
     @classmethod
     def run(cls, resolved, salt):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/kdf/pbkdf2.py

@@ -1,19 +1,18 @@
 import hashlib
 
-from detssh.backends.base import Field
+from isik.common.settings import Setting, Settings
+
 from detssh.backends.kdf.base import NO_SALT_CONSTRAINTS, KDFBackend, KDFError
 
 
+class Pbkdf2Settings(Settings):
+    iterations = Setting(int, "PBKDF2 iterations", default=600_000, soft_max=50_000_000)
+
+
 class Pbkdf2(KDFBackend):
     name = "pbkdf2"
     salt_constraints = NO_SALT_CONSTRAINTS
-
-    fields = {
-        "iterations": Field("PBKDF2 iterations", kind="int", soft_max=50_000_000),
-    }
-    defaults = {
-        "iterations": 600_000,
-    }
+    settings = Pbkdf2Settings
 
     @classmethod
     def run(cls, resolved, salt):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/kdf/scrypt.py

@@ -1,23 +1,20 @@
 import hashlib
 
-from detssh.backends.base import Field
+from isik.common.settings import Setting, Settings
+
 from detssh.backends.kdf.base import NO_SALT_CONSTRAINTS, KDFBackend, KDFError
 
 
+class ScryptSettings(Settings):
+    cost = Setting(int, "scrypt cost (N, power of two)", default=2**14, soft_max=2**18)
+    block_size = Setting(int, "scrypt block size (r)", default=8, soft_max=16)
+    parallelism = Setting(int, "scrypt parallelism (p)", default=1, soft_max=8)
+
+
 class Scrypt(KDFBackend):
     name = "scrypt"
     salt_constraints = NO_SALT_CONSTRAINTS
-
-    fields = {
-        "cost": Field("scrypt cost (N, power of two)", kind="int", soft_max=2**18),
-        "block_size": Field("scrypt block size (r)", kind="int", soft_max=16),
-        "parallelism": Field("scrypt parallelism (p)", kind="int", soft_max=8),
-    }
-    defaults = {
-        "cost": 2**14,
-        "block_size": 8,
-        "parallelism": 1,
-    }
+    settings = ScryptSettings
 
     @classmethod
     def run(cls, resolved, salt):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/salt/base.py

@@ -1,3 +1,6 @@
+from detssh.backends.base import NoSettings
+
+
 class SaltError(Exception):
     pass
 
@@ -7,8 +10,7 @@ class SaltAlgo:
     digest_size = None
     min_digest_size = None
     max_digest_size = None
-    fields = {}
-    defaults = {}
+    settings = NoSettings
 
     @classmethod
     def is_variable(cls):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/salt/blake2b.py

@@ -1,22 +1,23 @@
 import hashlib
 
-from detssh.backends.base import Field
+from isik.common.settings import Setting, Settings
+
 from detssh.backends.salt.base import SaltAlgo, SaltError
 
 
+MIN_DIGEST_SIZE = 1
+MAX_DIGEST_SIZE = 64
+
+
+class Blake2bSettings(Settings):
+    salt_digest_size = Setting(int, "Salt digest size, in bytes", default=16, min=MIN_DIGEST_SIZE, max=MAX_DIGEST_SIZE)
+
+
 class Blake2b(SaltAlgo):
     name = "blake2b"
-    min_digest_size = 1
-    max_digest_size = 64
-
-    fields = {
-        "salt_digest_size": Field(
-            "Salt digest size, in bytes", kind="int", min_value=min_digest_size, max_value=max_digest_size
-        ),
-    }
-    defaults = {
-        "salt_digest_size": 16,
-    }
+    min_digest_size = MIN_DIGEST_SIZE
+    max_digest_size = MAX_DIGEST_SIZE
+    settings = Blake2bSettings
 
     @classmethod
     def digest(cls, label, resolved):

{detssh-0.7.0 → detssh-0.8.0}/detssh/backends/salt/blake2s.py

@@ -1,22 +1,23 @@
 import hashlib
 
-from detssh.backends.base import Field
+from isik.common.settings import Setting, Settings
+
 from detssh.backends.salt.base import SaltAlgo, SaltError
 
 
+MIN_DIGEST_SIZE = 1
+MAX_DIGEST_SIZE = 32
+
+
+class Blake2sSettings(Settings):
+    salt_digest_size = Setting(int, "Salt digest size, in bytes", default=16, min=MIN_DIGEST_SIZE, max=MAX_DIGEST_SIZE)
+
+
 class Blake2s(SaltAlgo):
     name = "blake2s"
-    min_digest_size = 1
-    max_digest_size = 32
-
-    fields = {
-        "salt_digest_size": Field(
-            "Salt digest size, in bytes", kind="int", min_value=min_digest_size, max_value=max_digest_size
-        ),
-    }
-    defaults = {
-        "salt_digest_size": 16,
-    }
+    min_digest_size = MIN_DIGEST_SIZE
+    max_digest_size = MAX_DIGEST_SIZE
+    settings = Blake2sSettings
 
     @classmethod
     def digest(cls, label, resolved):