enpassreadercli 0.5.1__tar.gz → 0.5.2__tar.gz

enpassreadercli-0.5.2/.VERSION

@@ -0,0 +1 @@
+0.5.2

{enpassreadercli-0.5.1/enpassreadercli → enpassreadercli-0.5.2}/HISTORY.rst

@@ -74,3 +74,12 @@ History
 ------------------
 
 * Bump dependencies.
+
+
+0.5.2 (16-10-2026)
+------------------
+
+* Require enpassreaderlib 0.4.1 which verifies the authentication tag of encrypted values and opens the database read only.
+* Report values that fail authentication instead of crashing, skipping them when enumerating and exiting with an error.
+* Report invalid key files and missing database paths with their own error messages.
+* Close the database connection when done.

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: enpassreadercli
-Version: 0.5.1
+Version: 0.5.2
 Summary: A cli to access enpass 6 encrypted databases and read, list and search values.
 Home-page: https://github.com/costastf/enpassreadercli
 Author: Costas Tyfoxylos
@@ -19,7 +19,7 @@ Requires-Python: >=3.11
 License-File: LICENSE
 License-File: AUTHORS.rst
 Requires-Dist: coloredlogs>=15.0.1; python_version >= "2.7" and python_version != "3.0" and python_version != "3.1" and python_version != "3.2" and python_version != "3.3" and python_version != "3.4"
-Requires-Dist: enpassreaderlib>=0.4.0
+Requires-Dist: enpassreaderlib>=0.4.1
 Requires-Dist: prompt-toolkit>=3.0.53; python_version >= "3.10"
 Requires-Dist: pyotp>=2.10.0; python_version >= "3.8"
 Dynamic: author
@@ -180,3 +180,12 @@ History
 ------------------
 
 * Bump dependencies.
+
+
+0.5.2 (16-10-2026)
+------------------
+
+* Require enpassreaderlib 0.4.1 which verifies the authentication tag of encrypted values and opens the database read only.
+* Report values that fail authentication instead of crashing, skipping them when enumerating and exiting with an error.
+* Report invalid key files and missing database paths with their own error messages.
+* Close the database connection when done.

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/Pipfile

@@ -28,6 +28,6 @@ toml = ">=0.10,<1.0"
 [packages]
 
 coloredlogs = ">=15.0,<16.0"
-enpassreaderlib = ">=0.4.0,<1.0"
+enpassreaderlib = ">=0.4.1,<1.0"
 prompt-toolkit = ">=3.0,<4.0"
 pyotp = ">=2.8.0,<3.0"

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/Pipfile.lock

@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "73e7adf733b348b796d9c99223e69cdc1c25e3f42f183f67aa6ff97b991a2fba"
+            "sha256": "09f21fca803fc6fcac17eef3dd72263ab34b5667252b513dfb9395092805693f"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -27,10 +27,10 @@
         },
         "enpassreaderlib": {
             "hashes": [
-                "sha256:d7bc90e057dcf19865cd4864b15312a28489832edd54a42701502c545eda293e"
+                "sha256:8db081f8ffb4588b7a3748505d63336aec3b8423401a42575c3ada4567da25b5"
             ],
             "index": "pypi",
-            "version": "==0.4.0"
+            "version": "==0.4.1"
         },
         "humanfriendly": {
             "hashes": [

enpassreadercli-0.5.2/enpassreadercli/.VERSION

@@ -0,0 +1 @@
+0.5.2

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2/enpassreadercli}/HISTORY.rst

@@ -74,3 +74,12 @@ History
 ------------------
 
 * Bump dependencies.
+
+
+0.5.2 (16-10-2026)
+------------------
+
+* Require enpassreaderlib 0.4.1 which verifies the authentication tag of encrypted values and opens the database read only.
+* Report values that fail authentication instead of crashing, skipping them when enumerating and exiting with an error.
+* Report invalid key files and missing database paths with their own error messages.
+* Close the database connection when done.

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/enpassreadercli/Pipfile

@@ -28,6 +28,6 @@ toml = ">=0.10,<1.0"
 [packages]
 
 coloredlogs = ">=15.0,<16.0"
-enpassreaderlib = ">=0.4.0,<1.0"
+enpassreaderlib = ">=0.4.1,<1.0"
 prompt-toolkit = ">=3.0,<4.0"
 pyotp = ">=2.8.0,<3.0"

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/enpassreadercli/Pipfile.lock

@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "73e7adf733b348b796d9c99223e69cdc1c25e3f42f183f67aa6ff97b991a2fba"
+            "sha256": "09f21fca803fc6fcac17eef3dd72263ab34b5667252b513dfb9395092805693f"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -27,10 +27,10 @@
         },
         "enpassreaderlib": {
             "hashes": [
-                "sha256:d7bc90e057dcf19865cd4864b15312a28489832edd54a42701502c545eda293e"
+                "sha256:8db081f8ffb4588b7a3748505d63336aec3b8423401a42575c3ada4567da25b5"
             ],
             "index": "pypi",
-            "version": "==0.4.0"
+            "version": "==0.4.1"
         },
         "humanfriendly": {
             "hashes": [

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/enpassreadercli/enpassreadercli.py

@@ -39,7 +39,9 @@ import argparse
 import coloredlogs
 import pyotp
 from enpassreaderlib import EnpassDB
-from enpassreaderlib.enpassreaderlibexceptions import EnpassDatabaseError
+from enpassreaderlib.enpassreaderlibexceptions import (EnpassDatabaseError,
+                                                       EnpassDecryptionError,
+                                                       EnpassKeyfileError)
 from prompt_toolkit import prompt
 from prompt_toolkit.completion import Completer, Completion, FuzzyCompleter
 
@@ -350,45 +352,109 @@ def get_missing_value_message(entry, field=None, totp=False):
     return f'Entry with title of "{entry.title}" does not have a password set.'
 
 
-def main():
+def open_database(args):
     """
-    Main method.
+    Opens the enpass database.
+
+    Args:
+        args: The parsed cli arguments.
+
+    Returns:
+        enpass (EnpassDB): The opened database, exits with an error if it cannot be opened.
 
-    This method holds what you want to execute when
-    the script is run on command line.
     """
-    args = get_arguments()
-    setup_logging(args.log_level, args.logger_config)
+    if not os.path.isfile(args.path):
+        LOGGER.error(f'The database file "{args.path}" does not exist.')
+        raise SystemExit(1)
     try:
-        enpass = EnpassDB(args.path, args.password, args.key_file, args.pbkdf2_rounds)
+        return EnpassDB(args.path, args.password, args.key_file, args.pbkdf2_rounds)
+    except EnpassKeyfileError:
+        LOGGER.error(f'The key file "{args.key_file}" does not hold a valid enpass key.')
+        raise SystemExit(1) from None
     except EnpassDatabaseError:
         LOGGER.error(('Could not read or decrypt the database. '
                       'Please validate that the path provided is a valid enpass database, '
                       'that the provided password and optional key file are correct and that the pbkdf2 rounds'
                       f' provided ("{args.pbkdf2_rounds}") match the configuration of your database.'))
         raise SystemExit(1) from None
+
+
+def list_values(enpass, field=None, totp=False):
+    """
+    Prints the requested value of all the entries that have it.
+
+    Entries whose value fails authentication are reported and skipped.
+
+    Args:
+        enpass: The opened database.
+        field: The label or type of the field to list, the password is listed if not provided.
+        totp: If set the current totp code is listed.
+
+    Returns:
+        exit_code (int): 0 if all values could be decrypted else 1.
+
+    """
+    exit_code = 0
+    for entry in enpass.entries:
+        try:
+            value = get_value(entry, field, totp)
+        except EnpassDecryptionError:
+            LOGGER.error(f'The value of entry with title of "{entry.title}" failed authentication, skipping.')
+            exit_code = 1
+            continue
+        if value is not None:
+            print(f'{entry.title}: {value}')
+    return exit_code
+
+
+def run(args, enpass):
+    """
+    Executes the requested action against the opened database.
+
+    Args:
+        args: The parsed cli arguments.
+        enpass: The opened database.
+
+    Returns:
+        exit_code (int): The exit code of the cli.
+
+    """
     if args.list:
-        for entry in enpass.entries:
-            value = get_value(entry, args.field, args.totp)
-            if value is not None:
-                print(f'{entry.title}: {value}')
-        raise SystemExit(0)
+        return list_values(enpass, args.field, args.totp)
     interactive = args.search or args.fuzzy
     entry_title = interactive_prompt('Title :', EnpassCompleter(enpass), args.fuzzy) if interactive else args.entry
     entry = enpass.get_entry(entry_title)
     if not entry:
         LOGGER.error(f'No entry found with title of "{entry_title}".')
-        raise SystemExit(1) from None
+        return 1
     field = args.field
     if interactive and not field and not args.totp:
         field = interactive_prompt('Field :', FieldCompleter(entry.field_labels), args.fuzzy)
         field = field if field.strip() else None
-    value = get_value(entry, field, args.totp)
+    try:
+        value = get_value(entry, field, args.totp)
+    except EnpassDecryptionError:
+        LOGGER.error(f'The value of entry with title of "{entry.title}" failed authentication and cannot be trusted.')
+        return 1
     if value is None:
         LOGGER.error(get_missing_value_message(entry, field, args.totp))
-        raise SystemExit(1) from None
+        return 1
     print(value)
-    raise SystemExit(0) from None
+    return 0
+
+
+def main():
+    """
+    Main method.
+
+    This method holds what you want to execute when
+    the script is run on command line.
+    """
+    args = get_arguments()
+    setup_logging(args.log_level, args.logger_config)
+    with open_database(args) as enpass:
+        exit_code = run(args, enpass)
+    raise SystemExit(exit_code)
 
 
 if __name__ == '__main__':

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/enpassreadercli/requirements.txt

@@ -8,6 +8,6 @@
 # Please use Pipfile to update the requirements.
 #
 coloredlogs>=15.0.1 ; python_version >= '2.7' and python_version != '3.0' and python_version != '3.1' and python_version != '3.2' and python_version != '3.3' and python_version != '3.4'
-enpassreaderlib>=0.4.0
+enpassreaderlib>=0.4.1
 prompt-toolkit>=3.0.53 ; python_version >= '3.10'
 pyotp>=2.10.0 ; python_version >= '3.8'

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/enpassreadercli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: enpassreadercli
-Version: 0.5.1
+Version: 0.5.2
 Summary: A cli to access enpass 6 encrypted databases and read, list and search values.
 Home-page: https://github.com/costastf/enpassreadercli
 Author: Costas Tyfoxylos
@@ -19,7 +19,7 @@ Requires-Python: >=3.11
 License-File: LICENSE
 License-File: AUTHORS.rst
 Requires-Dist: coloredlogs>=15.0.1; python_version >= "2.7" and python_version != "3.0" and python_version != "3.1" and python_version != "3.2" and python_version != "3.3" and python_version != "3.4"
-Requires-Dist: enpassreaderlib>=0.4.0
+Requires-Dist: enpassreaderlib>=0.4.1
 Requires-Dist: prompt-toolkit>=3.0.53; python_version >= "3.10"
 Requires-Dist: pyotp>=2.10.0; python_version >= "3.8"
 Dynamic: author
@@ -180,3 +180,12 @@ History
 ------------------
 
 * Bump dependencies.
+
+
+0.5.2 (16-10-2026)
+------------------
+
+* Require enpassreaderlib 0.4.1 which verifies the authentication tag of encrypted values and opens the database read only.
+* Report values that fail authentication instead of crashing, skipping them when enumerating and exiting with an error.
+* Report invalid key files and missing database paths with their own error messages.
+* Close the database connection when done.

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/enpassreadercli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-enpassreaderlib>=0.4.0
+enpassreaderlib>=0.4.1
 
 [:python_version >= "2.7" and python_version != "3.0" and python_version != "3.1" and python_version != "3.2" and python_version != "3.3" and python_version != "3.4"]
 coloredlogs>=15.0.1

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/requirements.txt

@@ -8,6 +8,6 @@
 # Please use Pipfile to update the requirements.
 #
 coloredlogs>=15.0.1 ; python_version >= '2.7' and python_version != '3.0' and python_version != '3.1' and python_version != '3.2' and python_version != '3.3' and python_version != '3.4'
-enpassreaderlib>=0.4.0
+enpassreaderlib>=0.4.1
 prompt-toolkit>=3.0.53 ; python_version >= '3.10'
 pyotp>=2.10.0 ; python_version >= '3.8'

{enpassreadercli-0.5.1 → enpassreadercli-0.5.2}/tests/test_enpassreadercli.py

@@ -33,6 +33,11 @@ Tests for `enpassreadercli` module.
 
 """
 
+import argparse
+import contextlib
+import io
+import os
+import tempfile
 import unittest as std_unittest
 
 from betamax.fixtures import unittest
@@ -40,7 +45,7 @@ from enpassreaderlib.enpassreaderlib import Entry
 from prompt_toolkit.document import Document
 
 from enpassreadercli.enpassreadercli import (FieldCompleter, get_arguments, get_missing_value_message, get_totp,
-                                             get_value)
+                                             get_value, list_values, open_database, run)
 
 __author__ = '''Costas Tyfoxylos <costas.tyf@gmail.com>'''
 __docformat__ = '''google'''
@@ -72,17 +77,17 @@ class TestEnpassreadercli(unittest.BetamaxTestCase):
         pass
 
 
-def build_entry(fields, totp_seed=None):
-    """Builds an entry with non sensitive fields and no password."""
+def build_entry(fields, totp_seed=None, title='Service', sensitive=False):
+    """Builds an entry with no password, sensitive fields hold their raw stored value."""
     row = {'key': bytes(44),
-           'title': 'Service',
+           'title': title,
            'uuid': '00000000-0000-0000-0000-000000000000',
            'password_value': None,
            'password_value_hash': None,
            'totp_value': totp_seed,
            'totp_value_hash': None,
            'totp_value_sensitive': 0}
-    field_rows = [{'label': label, 'type': type_, 'value': value, 'sensitive': 0}
+    field_rows = [{'label': label, 'type': type_, 'value': value, 'sensitive': int(sensitive)}
                   for label, type_, value in fields]
     return Entry(row, field_rows)
 
@@ -155,3 +160,65 @@ class TestArguments(std_unittest.TestCase):
     def test_empty_field_is_rejected(self):
         with self.assertRaises(SystemExit):
             get_arguments(['-d', 'db', '-p', 'pass', '-g', 'Service', '-F', ''])
+
+
+class FakeDatabase:
+    """Stands in for an opened EnpassDB holding the provided entries."""
+
+    def __init__(self, entries):
+        self.entries = entries
+
+    def get_entry(self, name):
+        return next((entry for entry in self.entries if entry.title.lower() == name.lower()), None)
+
+
+# A value that is not a valid gcm ciphertext and tag for the entry key so it fails authentication
+TAMPERED_VALUE = '00' * 24
+
+
+class TestTamperedValues(std_unittest.TestCase):
+
+    def setUp(self):
+        self.database = FakeDatabase([build_entry([('API key', 'text', TAMPERED_VALUE)], title='Bad', sensitive=True),
+                                      build_entry([('API key', 'text', 'key-value')], title='Good')])
+
+    def test_listing_skips_tampered_entries_and_fails(self):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output), self.assertLogs('enpassreadercli', level='ERROR'):
+            exit_code = list_values(self.database, 'api key')
+        self.assertEqual(exit_code, 1)
+        self.assertEqual(output.getvalue(), 'Good: key-value\n')
+
+    def test_single_tampered_entry_fails(self):
+        args = get_arguments(['-d', 'db', '-p', 'pass', '-g', 'Bad', '-F', 'api key'])
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output), self.assertLogs('enpassreadercli', level='ERROR'):
+            exit_code = run(args, self.database)
+        self.assertEqual(exit_code, 1)
+        self.assertEqual(output.getvalue(), '')
+
+
+class TestOpenDatabase(std_unittest.TestCase):
+
+    @staticmethod
+    def arguments(path, key_file=''):
+        return argparse.Namespace(path=path, password='pass', key_file=key_file, pbkdf2_rounds=1)
+
+    def test_missing_database_fails_without_creating_it(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = os.path.join(directory, 'missing.enpassdb')
+            with self.assertLogs('enpassreadercli', level='ERROR'), self.assertRaises(SystemExit):
+                open_database(self.arguments(path))
+            self.assertFalse(os.path.exists(path))
+
+    def test_invalid_key_file_fails(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = os.path.join(directory, 'vault.enpassdb')
+            key_file = os.path.join(directory, 'vault.enpassdbx')
+            with open(path, 'wb') as database:
+                database.write(b'not an enpass database' * 64)
+            with open(key_file, 'w', encoding='utf-8') as key:
+                key.write('<key>not hex</key>')
+            with self.assertLogs('enpassreadercli', level='ERROR') as logs, self.assertRaises(SystemExit):
+                open_database(self.arguments(path, key_file))
+            self.assertIn('key file', logs.output[0])

enpassreadercli-0.5.1/.VERSION

@@ -1 +0,0 @@
-0.5.1

enpassreadercli-0.5.1/enpassreadercli/.VERSION

@@ -1 +0,0 @@
-0.5.1