duplicity 3.0.8.dev2__tar.gz → 3.0.8.dev3__tar.gz

{duplicity-3.0.8.dev2/duplicity.egg-info → duplicity-3.0.8.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: duplicity
-Version: 3.0.8.dev2
+Version: 3.0.8.dev3
 Summary: Encrypted backup using rsync algorithm
 Author-email: Kenneth Loafman <kenneth@loafman.com>
 Maintainer: Edgar Soldin, Thomas Laubrock

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3}/duplicity/__init__.py

@@ -21,7 +21,7 @@
 
 import gettext
 
-__version__: str = "3.0.8.dev2"
+__version__: str = "3.0.8.dev3"
 __reldate__: str = "January 14, 2026"
 
 gettext.install("duplicity", names=["ngettext"])

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3}/duplicity/dup_main.py

@@ -132,46 +132,47 @@ def get_passphrase(n, action, for_signing=False):
         log.Notice(_("Reuse configured SIGN_PASSPHRASE as PASSPHRASE"))
         return os.environ["SIGN_PASSPHRASE"]
 
+    # Next, verify we need to ask the user
+
+    # Assumptions:
+    #   - encrypt-key has no passphrase
+    #   - sign-key requires passphrase
+    #   - gpg-agent supplies all, no user interaction
+
     # no passphrase if --no-encryption or --use-agent
     if not config.encryption or config.use_agent:
         return ""
 
-    # no passphrase if --passphrase* in --gpg-options
-    if "--passphrase" in config.gpg_options:
+    # these commands don't need a password
+    elif action in [
+        "collection-status",
+        "list-current-files",
+        "remove-all-but-n-full",
+        "remove-all-inc-of-but-n-full",
+        "remove-older-than",
+    ]:
         return ""
 
-    # Check if encryption passphrase is needed
-    asymmetric = False
-    need_passphrase = False
-    profile = config.gpg_profile
-    encrypt_keys = profile.recipients + profile.hidden_recipients
-    if profile.sign_key:
-        encrypt_keys.append(profile.sign_key)
-    if encrypt_keys and config.check_remote:
-        asymmetric = True
-        for key in encrypt_keys:
-            if util.key_needs_passphrase(config.gpg_binary, key):
-                log.Notice(f"Key {key} needs passphrase.")
-                need_passphrase = True
-                break
-        else:
-            log.Notice("No encryption keys need passphrase.")
-    else:
-        need_passphrase = True
-        log.Notice("No encryption keys configured.")
-
-    skips = copy.copy(skips_sync_archive)
-    skips.remove("full")
-    if (action == "full" and asymmetric) or config.restart or action in skips:
-        log.Notice(f"Skipping passphrase request for action {action}")
+    # for a full, inc, verify, we don't need a password if
+    # there is no sign_key and there are recipients
+    elif (
+        action in ("full", "inc", "verify")
+        and (config.gpg_profile.recipients or config.gpg_profile.hidden_recipients)
+        and (not config.gpg_profile.sign_key or (not config.restart and not for_signing))
+    ):
         return ""
 
-    elif asymmetric and not need_passphrase:
-        log.Notice(_("Skipping because no encryption key passphrase is needed."))
+    elif (
+        (config.gpg_profile.recipients or config.gpg_profile.hidden_recipients)
+        and config.metadata_sync_mode == "partial"
+        and action in ["full"]
+    ):
+        log.Info(_("Skipping passphrase input for full backup with encryption keys."))
         return ""
 
+    # Finally, ask the user for the passphrase
     else:
-        log.Notice(_("No environment variables are set, asking user."))
+        log.Info(_("PASSPHRASE variable not set, asking user."))
         use_cache = True
         while True:
             # ask the user to enter a new passphrase to avoid an infinite loop

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3}/duplicity/util.py

@@ -205,95 +205,6 @@ def release_lockfile():
             pass
 
 
-def key_needs_passphrase(gpgbin, key, logfile=None):
-    """
-    Determine whether a GnuPG key requires a passphrase.
-
-    This helper invokes the specified GnuPG frontend in a non‑destructive
-    way to discover if the secret key is protected by a passphrase. It uses
-    `pexpect` to spawn the command and watch for prompts or agent errors,
-    never changing the key material itself.
-
-    How it works
-    - Runs: ``<gpgbin> --pinentry-mode cancel --dry-run --change-passphrase <key>``
-      with a C UTF‑8 locale to ensure predictable output.
-    - Interprets the interaction:
-        - If the process reaches EOF without a passphrase prompt, the key is
-          considered not to need a passphrase.
-        - If a passphrase prompt appears (matches ``passphrase.*:``), the key
-          is considered to need a passphrase.
-        - If ``gpg-agent`` fails to start or ignores an inquiry, we log an
-          error and return ``None`` to signal an indeterminate result.
-
-    Parameters
-    - gpgbin: str
-        The GnuPG command to execute, e.g. ``"gpg"`` or ``"gpgsm"``.
-    - key: str
-        The key identifier understood by the given binary. Examples:
-        - For ``gpg`` (OpenPGP): a key ID or fingerprint, e.g. ``"56538CCF"``.
-        - For ``gpgsm`` (S/MIME): a certificate keyref, e.g.
-          ``"\\&165F2FB4F58D..."``.
-    - logfile: a file-like object or ``None``
-        If provided, raw pexpect I/O is mirrored to this stream for debugging
-        (e.g. ``sys.stdout``). Defaults to ``None``.
-
-    Returns
-    - ``True``  if the key requires a passphrase.
-    - ``False`` if the key does not require a passphrase.
-    - ``None``  if the status cannot be determined due to a runtime error
-      (e.g., agent failed to start or pexpect raised an exception).
-
-    Notes
-    - The check is read‑only: ``--dry-run`` and ``--pinentry-mode cancel`` are
-      used to avoid modifying the key or prompting the user.
-    - Environment variables ``LANG`` and ``LC_ALL`` are forced to ``C.utf8``
-      to make output matching stable across locales.
-    - For end‑to‑end manual verification with the repository’s test keyring,
-      see ``testing/manual/needspass.py``.
-    """
-
-    environ = {**os.environ, "LANG": "C.utf8", "LC_ALL": "C.utf8"}
-    cmd = f"{gpgbin} --pinentry-mode cancel --dry-run --change-passphrase {key} "
-
-    log.Debug(f"{cmd=}")
-
-    try:
-        child = pexpect.spawn(cmd, encoding="utf-8", env=environ)
-        child.logfile = logfile
-    except pexpect.ExceptionPexpect as e:
-        log.Error(f"An unexpected error occurred: {e}")
-        return None
-
-    try:
-        got = child.expect(
-            [
-                pexpect.EOF,
-                "passphrase.*:",
-                "failed to start gpg-agent",
-                "ignoring gpg-agent inquiry",
-            ]
-        )
-    except pexpect.ExceptionPexpect as e:
-        log.Error(f"Exception while checking if passphrase needed for: {key}:\n{e}")
-        return None
-
-    child.close()
-    log.Debug(f"{child.exitstatus=}, {child.signalstatus=}, {got=}, {child.after=}")
-
-    if got == 0:
-        log.Debug(f"Key {key} does not need passphrase")
-        return False
-    elif got == 1:
-        log.Debug(f"Key {key} needs passphrase")
-        return True
-    elif got == 2:
-        log.Error(f"gpg-agent failed to start.")
-        return None
-    elif got == 3:
-        log.Error(f"gpg-agent failed inquiry ignored.")
-        return None
-
-
 def copyfileobj(infp, outfp, byte_count=-1):
     """
     Copy byte_count bytes from infp to outfp, or all if byte_count < 0

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3/duplicity.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: duplicity
-Version: 3.0.8.dev2
+Version: 3.0.8.dev3
 Summary: Encrypted backup using rsync algorithm
 Author-email: Kenneth Loafman <kenneth@loafman.com>
 Maintainer: Edgar Soldin, Thomas Laubrock

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3}/man/duplicity.1

@@ -1,4 +1,4 @@
-.TH DUPLICITY 1 "January 14, 2026" "Version 3.0.8.dev2" "User Manuals" \"  -*- nroff -*-
+.TH DUPLICITY 1 "January 14, 2026" "Version 3.0.8.dev3" "User Manuals" \"  -*- nroff -*-
 .\" disable justification (adjust text to left margin only)
 .\" command line examples stay readable through that
 .ad l

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "duplicity"
-version = "3.0.8.dev2"
+version = "3.0.8.dev3"
 dynamic = ["dependencies"]
 description = "Encrypted backup using rsync algorithm"
 authors = [
@@ -126,9 +126,6 @@ addopts = [
     "-p no:randomly",
     "-p no:xdist",
 ]
-markers = [
-    "slow: test runs >= 10 secs",
-]
 testpaths = [
     "testing/test_code.py",
     "testing/unit",

{duplicity-3.0.8.dev2 → duplicity-3.0.8.dev3}/setup.py

@@ -42,7 +42,7 @@ elif not ((3, 9) <= sys.version_info[:2] <= (3, 14)):
     print("Sorry, duplicity requires version 3.9 thru 3.14 of Python.", file=sys.stderr)
     sys.exit(1)
 
-Version: str = "3.0.8.dev2"
+Version: str = "3.0.8.dev3"
 
 # READTHEDOCS uses setup.py sdist but can't handle extensions
 ext_modules = list()