vcrypto 4.2.1__tar.gz → 4.3.1__tar.gz

{vcrypto-4.2.1 → vcrypto-4.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: vcrypto
-Version: 4.2.1
+Version: 4.3.1
 Summary: Utility to easily store passwords/secrets
 Author-email: Arnau Villoro <arnau@villoro.com>
 Maintainer-email: Arnau Villoro <arnau@villoro.com>
@@ -21,9 +21,7 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 Requires-Dist: cryptography>=44.0.1
 Requires-Dist: loguru>=0.7.3
-Requires-Dist: pytest>=8.3.4
 Requires-Dist: pyyaml>=6.0.2
-Requires-Dist: ruff>=0.9.7
 
 # **vcrypto - Secure Secrets Management in Python**
 vcrypto is a simple and effective utility for securely storing passwords and secrets in Python. It leverages **Fernet encryption** from the [cryptography](https://cryptography.io/en/latest/) module instead of reinventing the wheel.
@@ -99,10 +97,16 @@ The `init_vcrypto` function allows customization:
 
 **Example:**
 ```python
-init_vcrypto(secrets_file="config/secrets.yaml", filename_master_password="config/master.secret")
+init_vcrypto(secrets_file="config/secrets.yaml", filename_master_password="config/master.password")
 ```
 This setup stores **both** the `master.password` and `secrets.yaml` in the `config/` folder.
 
+> [!CAUTION]
+> The master password file must **never** be committed. The bundled `.gitignore`
+> only excludes `*.password`, so if you choose a custom name make sure it is
+> covered by your `.gitignore`. Committing the master password alongside the
+> encrypted `secrets.yaml` defeats the entire scheme.
+
 ---
 
 ## **🛠️ Development**

{vcrypto-4.2.1 → vcrypto-4.3.1}/README.md

@@ -72,10 +72,16 @@ The `init_vcrypto` function allows customization:
 
 **Example:**
 ```python
-init_vcrypto(secrets_file="config/secrets.yaml", filename_master_password="config/master.secret")
+init_vcrypto(secrets_file="config/secrets.yaml", filename_master_password="config/master.password")
 ```
 This setup stores **both** the `master.password` and `secrets.yaml` in the `config/` folder.
 
+> [!CAUTION]
+> The master password file must **never** be committed. The bundled `.gitignore`
+> only excludes `*.password`, so if you choose a custom name make sure it is
+> covered by your `.gitignore`. Committing the master password alongside the
+> encrypted `secrets.yaml` defeats the entire scheme.
+
 ---
 
 ## **🛠️ Development**

{vcrypto-4.2.1 → vcrypto-4.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vcrypto"
-version = "4.2.1"
+version = "4.3.1"
 description = "Utility to easily store passwords/secrets"
 authors = [{ name = "Arnau Villoro", email = "arnau@villoro.com" }]
 maintainers = [{ name = "Arnau Villoro", email = "arnau@villoro.com" }]
@@ -26,7 +26,11 @@ classifiers = [
 dependencies = [
     "cryptography>=44.0.1",
     "loguru>=0.7.3",
-    "pytest>=8.3.4",
     "pyyaml>=6.0.2",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8.3.4",
     "ruff>=0.9.7",
 ]

{vcrypto-4.2.1 → vcrypto-4.3.1}/tests/test_encryption.py

@@ -1,12 +1,34 @@
+from pathlib import Path
+
+import pytest
+
 from vcrypto.encryption import create_password
 from vcrypto.encryption import decrypt
 from vcrypto.encryption import encrypt
 
+TEMP_PASSWORD_FILE = "temp.password"
+
+
+@pytest.fixture(autouse=True)
+def cleanup_files():
+    """Ensures test files are removed after each test."""
+    yield
+    Path(TEMP_PASSWORD_FILE).unlink(missing_ok=True)
+
 
 def test_store_secret():
     """Test password creation with storing"""
 
-    assert create_password(filename="temp.password") is not None
+    assert create_password(filename=TEMP_PASSWORD_FILE) is not None
+
+
+def test_create_password_does_not_overwrite():
+    """Refuse to overwrite an existing master password file."""
+
+    create_password(filename=TEMP_PASSWORD_FILE)
+
+    with pytest.raises(FileExistsError, match="Refusing to overwrite"):
+        create_password(filename=TEMP_PASSWORD_FILE)
 
 
 def test_encrypt():

{vcrypto-4.2.1 → vcrypto-4.3.1}/vcrypto/encryption.py

@@ -1,3 +1,5 @@
+import os
+from pathlib import Path
 from typing import Optional
 from typing import Union
 
@@ -5,7 +7,28 @@ from cryptography.fernet import Fernet
 from loguru import logger
 
 
-def create_password(filename="test.password", store_secret: bool = True) -> bytes:
+def write_private_file(filename: str, data: Union[str, bytes]) -> None:
+    """
+    Writes data to a file readable/writable only by the owner.
+
+    Uses ``os.open`` with mode ``0o600`` so the restrictive permissions are set
+    when the file is created, avoiding a window where it is world-readable. On
+    POSIX this yields owner-only access; on Windows the mode is largely ignored
+    (access is governed by ACLs) but the call remains harmless.
+
+    Args:
+        filename: Destination path.
+        data: Content to write (str or bytes).
+    """
+
+    binary = isinstance(data, bytes)
+    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+    fd = os.open(filename, flags, 0o600)
+    with os.fdopen(fd, "wb" if binary else "w") as file:
+        file.write(data)
+
+
+def create_password(filename="master.password", store_secret: bool = True) -> bytes:
     """
     Creates a new password and stores it in a text file.
     This approach is preferred over allowing users to create their own passwords:
@@ -17,6 +40,11 @@ def create_password(filename="test.password", store_secret: bool = True) -> byte
 
     Returns:
         Generated master password as bytes.
+
+    Raises:
+        FileExistsError: If the destination file already exists. Overwriting the
+            master password would make every secret encrypted with the previous
+            key permanently undecryptable, so this must be done deliberately.
     """
 
     # Create a new key
@@ -27,10 +55,16 @@ def create_password(filename="test.password", store_secret: bool = True) -> byte
     if not store_secret:
         return key
 
+    if Path(filename).exists():
+        raise FileExistsError(
+            f"Refusing to overwrite the existing master password at {filename!r}. "
+            "Delete it manually first if you really intend to generate a new key "
+            "(every secret encrypted with the old key will become undecryptable)."
+        )
+
     logger.info(f"Storing key to {filename=}. Remember to gitignore this file!")
 
-    with open(filename, "w") as file:
-        file.write(key.decode())
+    write_private_file(filename, key.decode())
 
     return key
 

{vcrypto-4.2.1 → vcrypto-4.3.1}/vcrypto/secrets_manager.py

@@ -1,5 +1,6 @@
 import json
 import os
+import tempfile
 from pathlib import Path
 
 import yaml
@@ -31,7 +32,10 @@ def get_password(filename=FILE_MASTER_DEFAULT, environ_var_name=None):
         ValueError: If no password is found.
     """
     if environ_var_name and (password := os.getenv(environ_var_name)):
-        return password.encode()
+        # Strip to mirror the file branch below; a Fernet key never contains
+        # surrounding whitespace, so a stray newline would only cause a
+        # confusing decryption failure.
+        return password.strip().encode()
 
     path = Path(filename)
     if path.exists():
@@ -65,13 +69,28 @@ def store_dictionary(data: dict, filename: str):
     """
     Stores a dictionary in a JSON or YAML file.
 
+    The file is written atomically (to a temporary file in the same directory,
+    then renamed) so an interrupted write cannot truncate or corrupt the
+    existing secrets file.
+
     Args:
         data (dict): Dictionary to store.
         filename (str): Destination file.
     """
     path = Path(filename)
     content = json.dumps(data, indent=2) if _is_json(path) else yaml.dump(data)
-    path.write_text(content, encoding="utf-8")
+
+    # Write to a temp file in the same directory, then atomically replace the
+    # target. os.replace is atomic on the same filesystem on POSIX and Windows.
+    fd, tmp_name = tempfile.mkstemp(dir=path.parent or ".", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            stream.write(content)
+        os.replace(tmp_name, path)
+    except BaseException:
+        if os.path.exists(tmp_name):
+            os.unlink(tmp_name)
+        raise
 
 
 def read_dictionary(filename: str, fail_if_missing=True) -> dict:

{vcrypto-4.2.1 → vcrypto-4.3.1}/vcrypto/vcrypto.py

@@ -95,5 +95,5 @@ def export_secret(uri, secret_name, binary=False):
     secret = get_secret(secret_name, encoding="utf8" if not binary else None)
 
     logger.info(f"Writing {secret_name=} to {uri=}")
-    with open(uri, "wb" if binary else "w") as stream:
-        stream.write(secret)
+    # The exported file holds the decrypted secret, so restrict it to the owner.
+    encryption.write_private_file(uri, secret)

{vcrypto-4.2.1 → vcrypto-4.3.1}/vcrypto.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: vcrypto
-Version: 4.2.1
+Version: 4.3.1
 Summary: Utility to easily store passwords/secrets
 Author-email: Arnau Villoro <arnau@villoro.com>
 Maintainer-email: Arnau Villoro <arnau@villoro.com>
@@ -21,9 +21,7 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 Requires-Dist: cryptography>=44.0.1
 Requires-Dist: loguru>=0.7.3
-Requires-Dist: pytest>=8.3.4
 Requires-Dist: pyyaml>=6.0.2
-Requires-Dist: ruff>=0.9.7
 
 # **vcrypto - Secure Secrets Management in Python**
 vcrypto is a simple and effective utility for securely storing passwords and secrets in Python. It leverages **Fernet encryption** from the [cryptography](https://cryptography.io/en/latest/) module instead of reinventing the wheel.
@@ -99,10 +97,16 @@ The `init_vcrypto` function allows customization:
 
 **Example:**
 ```python
-init_vcrypto(secrets_file="config/secrets.yaml", filename_master_password="config/master.secret")
+init_vcrypto(secrets_file="config/secrets.yaml", filename_master_password="config/master.password")
 ```
 This setup stores **both** the `master.password` and `secrets.yaml` in the `config/` folder.
 
+> [!CAUTION]
+> The master password file must **never** be committed. The bundled `.gitignore`
+> only excludes `*.password`, so if you choose a custom name make sure it is
+> covered by your `.gitignore`. Committing the master password alongside the
+> encrypted `secrets.yaml` defeats the entire scheme.
+
 ---
 
 ## **🛠️ Development**

{vcrypto-4.2.1 → vcrypto-4.3.1}/vcrypto.egg-info/requires.txt

@@ -1,5 +1,3 @@
 cryptography>=44.0.1
 loguru>=0.7.3
-pytest>=8.3.4
 pyyaml>=6.0.2
-ruff>=0.9.7