What is on `next`, reviewed.
- go-bip39 is gone from `go.mod` and `go.sum`: keyfunc now requires `sneak/secret` at `ef0ae90`, the commit that gives `secret` its own copy (sneak/secret#130). No derived key, mnemonic or test vector changes.
To know before merging:
- `secret`'s module is now `sneak.berlin/go/secret` (sneak/secret#43), so keyfunc's requirement, its two imports of `secret`'s `bip85` package and one README sentence use that path. The Go module proxy serves that path, so `go install` keeps working.
Model: opus-5-5
Reviewed-on: #72
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
go-bip39's repository no longer exists, so keyfunc now carries the
part of v1.1.0 it uses, with the upstream LICENSE beside it, and
imports it from internal/bip39. Upstream's tests and test vectors for
the kept code come along unchanged; where they called a removed
function, crypto/rand stands in for NewEntropy and EntropyFromMnemonic
for MnemonicToByteArray.
Changes beyond the trimming are what the linter asked for: the
package-level variables moved into the functions that use them, three
error strings were lower-cased, and the unknown-word error now wraps
ErrInvalidMnemonic.
go.mod no longer requires go-bip39. go mod tidy keeps its two go.sum
lines, because a test in sneak/secret's bip85 package imports it, and
drops six lines that only go-bip39's own requirements needed.
Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
The module path becomes sneak.berlin/go/keyfunc, as the repo policy sets for Go modules: go.mod, every import and the -X path in the Makefile. The old path gets no alias. The README gives a go install line for the new path, which resolves with @latest only once main carries the move, and its TODO list now names the open 1.0 issues.
Model: opus-5-5
Every direct dependency moves to its current release, golang.org/x/crypto first: keyfunc ssh to serves keys through its ssh/agent package, which has had security fixes since the pinned 2025-05 version. go.mod and go.sum only; no code changed and the SSH, age and child mnemonic test vectors pass unedited, so no derived key moves.
Model: opus-4-8 (implementation); fable-5-1 (summary)
keyfunc age derives an age identity at the generic path the way secret's agehd does, prints the recipient or the identity, and encrypts to or decrypts with it, the derived recipient always among encrypt's recipients. Two review rounds; the second passed with no findings, the clamping step now pinned by a fixed identity test.
Model: opus-5 (implementation and review); fable-5-1 (landing)
The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.
Model: opus-5 (implementation and review); fable-5-1 (landing)
clawbot