The age commands: pub, priv, encrypt and decrypt (closes #3)

The application number is 657169, so the path is
m/83696968'/657169'/<n>'. The 32 derived bytes are clamped the way
X25519 requires and go through bech32 into an age identity, which is
the only route age offers from raw bytes to a key; these are the steps
sneak/secret takes in its agehd package.

The derived recipient is always first in the recipient list, so the
mnemonic that encrypted a file can always read it back. Decrypting
recognises the text form by the line it starts with, so it needs no
flag. A file named with -o is created readable only by its owner,
since a decrypted one is as secret as what went into it.

Model: opus-5

README.md

@@ -88,49 +88,17 @@ Prints the unencrypted private key in OpenSSH format (the
 and nothing else, so it can be redirected into a file. The key's comment is the
 same as for `pub`.
 
-### `keyfunc ssh install <[user@]host> [-- sftp options...]`
+### `keyfunc ssh install <[user@]host> [-- ssh options...]`
 
-Adds the `pub` line to `~/.ssh/authorized_keys` on the host. No command is run
-on the host: the file is fetched, changed here, and written back with the
-system `sftp` client in batch mode.
+Runs the system `ssh` to the host and, on the host:
 
-The first connection fetches `~/.ssh/authorized_keys`. The file reads as empty
-only when `sftp` reported that file as not being there — the one line naming
-that path. The same wording anywhere else in the session does not count: `ssh`
-writes `No such file or directory` about an `-i` it cannot find, on a session
-that then authenticates through the agent. When `sftp` failed for any other
-reason — the file is there and cannot be read, the connection did not come up —
-the tool prints what `sftp` said and exits with status 1 without writing
-anything, rather than put a file back holding the new key alone. What `sftp`
-cannot tell apart is a missing file and one in a directory it cannot enter, so a
-`~/.ssh` whose mode shuts the user out reads as a host with no file; the second
-connection sets that mode to `0700` and writes, as on a host that has none. If
-an identical line is already in the file, the tool prints
-`already present` and connects no further. Otherwise the line is added (after a
-newline, if the file did not end with one) and a second connection:
+- creates `~/.ssh` with mode `0700` if it is missing;
+- creates `~/.ssh/authorized_keys` with mode `0600` if it is missing;
+- appends the `pub` line only if an identical line is not already there.
 
-- creates `~/.ssh` and sets it to mode `0700`;
-- uploads the new file as `~/.ssh/authorized_keys.keyfunc-<random>` and sets it
-  to mode `0600`;
-- renames that file over `~/.ssh/authorized_keys`.
-
-The tool then prints `added`. So a run that adds a line connects twice. The
-rename is the step that either happens or does not: the file on the host is
-never half-written. `sftp` does it in one step against servers that offer
-OpenSSH's POSIX rename extension, as OpenSSH's own server does; a server
-without it may refuse to rename onto a file that is already there.
-
-If a step fails, the tool prints what `sftp` said, removes nothing, and exits
-with status 1. It names the uploaded file only when the step that failed was
-the upload or one after it, which is where a file of that name can be on the
-host; a failure before the upload names none. Everything `sftp`
-writes goes to standard error, so the tool's own standard output is only
-`added` or `already present`.
-
-Anything after `--` is passed to `sftp` unchanged, which is where the port goes
-(`-P 2222`, not `-p`). How the connection authenticates is up to the user's
-normal `ssh` setup, except that batch mode does not prompt: a key or an agent
-has to do it, not a typed password.
+It then prints `added` or `already present`. How this `ssh` connection
+authenticates is up to the user's normal `ssh` setup (existing keys, agent,
+password). Anything after `--` is passed to `ssh` unchanged.
 
 ### `keyfunc ssh to <host> [ssh arguments...]`
 

internal/agekey/agekey_test.go

@@ -11,18 +11,13 @@ import (
 )
 
 // The recipients the example mnemonic produces at the first two
-// indexes, and the secret key behind the first of them. They are what
-// makes the derivation reproducible: if the recipients change, every
-// file anyone encrypted becomes unreadable, and if the secret key
-// changes, the key is no longer the one other tools derive from the
-// same mnemonic.
+// indexes. They are what makes the derivation reproducible: if these
+// change, every file anyone encrypted becomes unreadable.
 const (
 	recipientZero = "age1xwdy9y6ckyfsgjc8k02e9uhsf3fmjy0ufysew" +
 		"lj68kmx5n67e3nsg2mftq"
 	recipientOne = "age1pmm92sxaf5mazjwvjph7dx2zq9r5p8l3rarfg" +
 		"qm7hmakqhvgyy4q5p3w7j"
-	identityZero = "AGE-SECRET-KEY-19QKK2P38598XLXMQFFU3P7J9PLDD" +
-		"7527T70JDHGDJ7AMNF3XT44S00JFU5"
 )
 
 // example returns the mnemonic every BIP-39 document uses to show its
@@ -45,10 +40,12 @@ func TestTheSameMnemonicAlwaysGivesTheSameKey(t *testing.T) {
 	require.Equal(t, recipientOne, forIndex(t, 1).Recipient())
 }
 
-func TestTheSameMnemonicAlwaysGivesTheSameSecretKey(t *testing.T) {
+func TestTheIdentityIsWrittenTheWayAgeWritesOne(t *testing.T) {
 	t.Parallel()
 
-	require.Equal(t, identityZero, forIndex(t, 0).Identity())
+	require.True(t,
+		strings.HasPrefix(forIndex(t, 0).Identity(), "AGE-SECRET-KEY-1"),
+	)
 }
 
 func TestWhatWasEncryptedComesBack(t *testing.T) {

internal/childmnemonic/childmnemonic.go

@@ -1,63 +0,0 @@
-// Package childmnemonic derives a mnemonic from another mnemonic.
-package childmnemonic
-
-import (
-	"errors"
-	"fmt"
-
-	"git.eeqj.de/sneak/keyfunc/internal/derive"
-	"git.eeqj.de/sneak/secret/pkg/bip85"
-	"github.com/btcsuite/btcd/btcutil/hdkeychain"
-	bip39 "github.com/tyler-smith/go-bip39"
-)
-
-// english is the number BIP-85 gives the English word list.
-const english = 0
-
-// The lengths a child mnemonic may have. BIP-85 also allows 15 and 21
-// words; these three are the ones this tool offers.
-const (
-	twelve     = 12
-	eighteen   = 18
-	twentyFour = 24
-)
-
-// DefaultWords is how long a child mnemonic is when the user does not
-// say.
-const DefaultWords = twelve
-
-// ErrWordCount is returned for a length this tool does not offer.
-var ErrWordCount = errors.New("a child mnemonic has 12, 18 or 24 words")
-
-// Derive returns the English child mnemonic of that many words at that
-// key index, taken from the master key with BIP-85's own mnemonic
-// application, number 39. The words come straight from the BIP-85
-// entropy, cut to the length the word count needs, rather than from
-// the generator the other key types read their bytes from.
-func Derive(
-	master *hdkeychain.ExtendedKey,
-	words, index uint32,
-) (string, error) {
-	switch words {
-	case twelve, eighteen, twentyFour:
-	default:
-		return "", fmt.Errorf("%w, not %d", ErrWordCount, words)
-	}
-
-	err := derive.CheckIndex(index)
-	if err != nil {
-		return "", err
-	}
-
-	entropy, err := bip85.DeriveBIP39Entropy(master, english, words, index)
-	if err != nil {
-		return "", fmt.Errorf("deriving entropy: %w", err)
-	}
-
-	child, err := bip39.NewMnemonic(entropy)
-	if err != nil {
-		return "", fmt.Errorf("turning the entropy into words: %w", err)
-	}
-
-	return child, nil
-}

internal/childmnemonic/childmnemonic_test.go

@@ -1,117 +0,0 @@
-package childmnemonic_test
-
-import (
-	"strings"
-	"testing"
-
-	"git.eeqj.de/sneak/keyfunc/internal/childmnemonic"
-	"git.eeqj.de/sneak/keyfunc/internal/derive"
-	"github.com/btcsuite/btcd/btcutil/hdkeychain"
-	"github.com/stretchr/testify/require"
-	bip39 "github.com/tyler-smith/go-bip39"
-)
-
-// The lengths the tool offers, and one it does not.
-const (
-	twelve     = 12
-	eighteen   = 18
-	twentyFour = 24
-	fifteen    = 15
-)
-
-// specificationKey is the master key the BIP-85 specification gives
-// every one of its test vectors for.
-const specificationKey = "xprv9s21ZrQH143K2LBWUUQRFXhucrQqBpKdRRxNVq2zBq" +
-	"sx8HVqFk2uYo8kmbaLLHRdqtQpUm98uKfu3vca1LqdGhUtyoFnCNkfmXRyPXLjbKb"
-
-// The three English child mnemonics at key index 0 that the BIP-85
-// specification gives for that master key.
-const (
-	twelveWords = "girl mad pet galaxy egg matter matrix prison refuse " +
-		"sense ordinary nose"
-
-	eighteenWords = "near account window bike charge season chef number " +
-		"sketch tomorrow excuse sniff circle vital hockey outdoor " +
-		"supply token"
-
-	twentyFourWords = "puppy ocean match cereal symbol another shed " +
-		"magic wrap hammer bulb intact gadget divorce twin tonight " +
-		"reason outdoor destroy simple truth cigar social volcano"
-)
-
-// example returns the mnemonic every BIP-39 document uses to show its
-// test vectors: eleven abandons and about.
-func example() string {
-	return strings.Repeat("abandon ", 11) + "about"
-}
-
-func TestTheSpecificationTestVectors(t *testing.T) {
-	t.Parallel()
-
-	require.Equal(t, twelveWords, fromSpecificationKey(t, twelve))
-	require.Equal(t, eighteenWords, fromSpecificationKey(t, eighteen))
-	require.Equal(t, twentyFourWords, fromSpecificationKey(t, twentyFour))
-}
-
-func TestTheLongestChildMnemonicPassesItsOwnChecksum(t *testing.T) {
-	t.Parallel()
-
-	child := fromSpecificationKey(t, twentyFour)
-
-	require.Len(t, strings.Fields(child), twentyFour)
-	require.True(t, bip39.IsMnemonicValid(child))
-}
-
-func TestEachKeyIndexGivesItsOwnChildMnemonic(t *testing.T) {
-	t.Parallel()
-
-	master, err := derive.Master(example())
-	require.NoError(t, err)
-
-	first, err := childmnemonic.Derive(master, twelve, 0)
-	require.NoError(t, err)
-	require.True(t, bip39.IsMnemonicValid(first))
-
-	second, err := childmnemonic.Derive(master, twelve, 1)
-	require.NoError(t, err)
-	require.True(t, bip39.IsMnemonicValid(second))
-
-	require.NotEqual(t, first, second)
-}
-
-func TestALengthTheToolDoesNotOfferIsRefused(t *testing.T) {
-	t.Parallel()
-
-	master, err := hdkeychain.NewKeyFromString(specificationKey)
-	require.NoError(t, err)
-
-	_, err = childmnemonic.Derive(master, fifteen, 0)
-	require.ErrorIs(t, err, childmnemonic.ErrWordCount)
-}
-
-func TestAnIndexWithNoHardenedChildIsRefused(t *testing.T) {
-	t.Parallel()
-
-	master, err := hdkeychain.NewKeyFromString(specificationKey)
-	require.NoError(t, err)
-
-	_, err = childmnemonic.Derive(master, twelve, derive.MaxIndex+1)
-	require.ErrorIs(t, err, derive.ErrIndexTooLarge)
-
-	_, err = childmnemonic.Derive(master, twelve, derive.MaxIndex)
-	require.NoError(t, err)
-}
-
-// fromSpecificationKey derives the child mnemonic of that length at key
-// index 0 from the master key the specification gives.
-func fromSpecificationKey(t *testing.T, words uint32) string {
-	t.Helper()
-
-	master, err := hdkeychain.NewKeyFromString(specificationKey)
-	require.NoError(t, err)
-
-	child, err := childmnemonic.Derive(master, words, 0)
-	require.NoError(t, err)
-
-	return child
-}

internal/cli/age/age.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path/filepath"
 
 	"git.eeqj.de/sneak/keyfunc/internal/agekey"
 	"git.eeqj.de/sneak/keyfunc/internal/cli/options"
@@ -14,6 +13,10 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// ownerOnly is the mode a file the tool creates gets, since a
+// decrypted file is as secret as what went into it.
+const ownerOnly = 0o600
+
 // Command returns the age command and everything under it.
 func Command() *cobra.Command {
 	group := &cobra.Command{
@@ -129,7 +132,7 @@ func runDecrypt(cmd *cobra.Command, args []string) error {
 }
 
 // through opens the input and the output the arguments ask for, hands
-// them to the work, and finishes the output afterwards either way.
+// them to the work, and closes an output file afterwards either way.
 func through(
 	cmd *cobra.Command, args []string,
 	work func(io.Writer, io.Reader) error,
@@ -141,14 +144,19 @@ func through(
 
 	defer closeSrc()
 
-	dst, done, err := output(cmd)
+	dst, closeDst, err := output(cmd)
 	if err != nil {
 		return err
 	}
 
 	err = work(dst, src)
+	if err != nil {
+		_ = closeDst()
 
-	return done(err)
+		return err
+	}
+
+	return closeDst()
 }
 
 // input returns what to read from: the named file, or the command's
@@ -167,61 +175,28 @@ func input(cmd *cobra.Command, args []string) (io.Reader, func(), error) {
 	return file, func() { _ = file.Close() }, nil
 }
 
-// output returns what to write to: a new file beside the one --output
-// names, or the command's own output when it names none. The second
-// result finishes the write, and is given whatever the work returned:
-// the new file takes the named file's place only when the work
-// succeeded, so a file that is already there survives a run that
-// failed.
-func output(cmd *cobra.Command) (io.Writer, func(error) error, error) {
+// output returns what to write to: the file --output names, or the
+// command's own output. The second result closes a file that was
+// opened, so a failure to finish writing is not lost.
+func output(cmd *cobra.Command) (io.Writer, func() error, error) {
 	name, err := cmd.Flags().GetString("output")
 	if err != nil {
 		return nil, nil, fmt.Errorf("reading the output file: %w", err)
 	}
 
 	if name == "" {
-		return cmd.OutOrStdout(), func(failed error) error {
-			return failed
-		}, nil
+		return cmd.OutOrStdout(), func() error { return nil }, nil
 	}
 
-	// The file is made in the same directory so that putting it in
-	// place is a rename and never a copy, and it is readable only by
-	// its owner, which is the mode it keeps once renamed.
-	file, err := os.CreateTemp(filepath.Dir(name), filepath.Base(name)+".")
+	//nolint:gosec // writing the file the user named is the point
+	file, err := os.OpenFile(
+		name, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, ownerOnly,
+	)
 	if err != nil {
-		return nil, nil, fmt.Errorf("creating a file beside %s: %w", name, err)
+		return nil, nil, fmt.Errorf("creating %s: %w", name, err)
 	}
 
-	return file, func(failed error) error {
-		return finish(file, name, failed)
-	}, nil
-}
-
-// finish closes the new file and puts it in the named file's place, or
-// throws it away when the work failed. It returns the error the caller
-// should report.
-func finish(file *os.File, name string, failed error) error {
-	closeErr := file.Close()
-
-	if failed != nil || closeErr != nil {
-		_ = os.Remove(file.Name())
-
-		if failed != nil {
-			return failed
-		}
-
-		return fmt.Errorf("finishing %s: %w", name, closeErr)
-	}
-
-	err := os.Rename(file.Name(), name)
-	if err != nil {
-		_ = os.Remove(file.Name())
-
-		return fmt.Errorf("putting %s in place: %w", name, err)
-	}
-
-	return nil
+	return file, file.Close, nil
 }
 
 // addOutput gives a command its output file flag.

internal/cli/age_test.go

@@ -72,24 +72,6 @@ func TestAFileForAnotherKeyIsRefused(t *testing.T) {
 	require.ErrorIs(t, err, agekey.ErrNotRecipient)
 }
 
-func TestARefusedDecryptionLeavesTheOutputFileAlone(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	plain := written(t, "notes.txt", "the secret\n")
-	sealed := filepath.Join(t.TempDir(), "notes.age")
-	existing := written(t, "notes.out", "what was already there\n")
-
-	run(t, "age", "encrypt", "-n", "7", "-o", sealed, plain)
-
-	_, err := execute(t, "age", "decrypt", "-o", existing, sealed)
-	require.ErrorIs(t, err, agekey.ErrNotRecipient)
-
-	//nolint:gosec // the test made this path itself
-	kept, err := os.ReadFile(existing)
-	require.NoError(t, err)
-	require.Equal(t, "what was already there\n", string(kept))
-}
-
 // written puts the contents in a file of that name in a directory of
 // this test's own and returns the path to it.
 func written(t *testing.T, name, contents string) string {

internal/cli/cli.go

@@ -2,12 +2,10 @@
 package cli
 
 import (
-	"errors"
 	"fmt"
 	"os"
 
 	"git.eeqj.de/sneak/keyfunc/internal/cli/age"
-	"git.eeqj.de/sneak/keyfunc/internal/cli/mnemonic"
 	"git.eeqj.de/sneak/keyfunc/internal/cli/options"
 	"git.eeqj.de/sneak/keyfunc/internal/cli/ssh"
 	"github.com/spf13/cobra"
@@ -32,28 +30,20 @@ func Root() *cobra.Command {
 	}
 
 	options.Add(root)
-	root.AddCommand(ssh.Command(), age.Command(), mnemonic.Command())
+	root.AddCommand(ssh.Command(), age.Command())
 
 	return root
 }
 
 // Main runs the tool and returns the status the process should exit
-// with. An error ends the tool with status 1, except when it carries a
-// status of its own, which "ssh to" uses to hand on the status ssh
-// ended with. ssh has already said whatever it had to say in that
-// case, so nothing more is printed.
+// with.
 func Main() int {
 	err := Root().Execute()
-	if err == nil {
-		return 0
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "keyfunc: "+err.Error())
+
+		return 1
 	}
 
-	var passed ssh.StatusError
-	if errors.As(err, &passed) {
-		return passed.Status
-	}
-
-	fmt.Fprintln(os.Stderr, "keyfunc: "+err.Error())
-
-	return 1
+	return 0
 }

internal/cli/cli_test.go

@@ -5,12 +5,10 @@ import (
 	"strings"
 	"testing"
 
-	"git.eeqj.de/sneak/keyfunc/internal/childmnemonic"
 	"git.eeqj.de/sneak/keyfunc/internal/cli"
 	"git.eeqj.de/sneak/keyfunc/internal/derive"
 	"git.eeqj.de/sneak/keyfunc/internal/mnemonic"
 	"github.com/stretchr/testify/require"
-	bip39 "github.com/tyler-smith/go-bip39"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -22,12 +20,6 @@ const (
 		"0I4FKs+eVUulTPHfk9VtXw1tMF"
 )
 
-// The two child mnemonic lengths the tests ask for.
-const (
-	twelve     = 12
-	twentyFour = 24
-)
-
 // example returns the mnemonic the README gives its test vectors for:
 // eleven abandons and about.
 func example() string {
@@ -89,28 +81,6 @@ func TestTheMnemonicCommandIsUsed(t *testing.T) {
 	require.Equal(t, vectorZero+" keyfunc/ssh/0", line)
 }
 
-func TestAChildMnemonicIsPrinted(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	short := strings.Fields(run(t, "mnemonic"))
-	require.Len(t, short, twelve)
-	require.True(t, bip39.IsMnemonicValid(strings.Join(short, " ")))
-
-	long := strings.Fields(run(t, "mnemonic", "--words", "24"))
-	require.Len(t, long, twentyFour)
-
-	next := strings.Fields(run(t, "mnemonic", "-n", "1"))
-	require.NotEqual(t, short, next)
-}
-
-func TestALengthTheToolDoesNotOfferIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	out, err := execute(t, "mnemonic", "--words", "15")
-	require.ErrorIs(t, err, childmnemonic.ErrWordCount)
-	require.Empty(t, out)
-}
-
 // run executes the tool with the given arguments and returns what it
 // wrote to standard output.
 func run(t *testing.T, args ...string) string {

internal/cli/mnemonic/mnemonic.go

@@ -1,65 +0,0 @@
-// Package mnemonic is the command that prints a child mnemonic.
-package mnemonic
-
-import (
-	"fmt"
-
-	"git.eeqj.de/sneak/keyfunc/internal/childmnemonic"
-	"git.eeqj.de/sneak/keyfunc/internal/cli/options"
-	"git.eeqj.de/sneak/keyfunc/internal/derive"
-	"github.com/spf13/cobra"
-)
-
-// Command returns the mnemonic command.
-func Command() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "mnemonic",
-		Short: "print a child mnemonic derived from the main one",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			child, err := derived(cmd)
-			if err != nil {
-				return err
-			}
-
-			_, err = fmt.Fprintln(cmd.OutOrStdout(), child)
-			if err != nil {
-				return fmt.Errorf("writing the mnemonic: %w", err)
-			}
-
-			return nil
-		},
-	}
-
-	cmd.Flags().Uint32(
-		"words", childmnemonic.DefaultWords,
-		"how long the child mnemonic is: 12, 18 or 24 words",
-	)
-
-	return cmd
-}
-
-// derived returns the child mnemonic this run asks for.
-func derived(cmd *cobra.Command) (string, error) {
-	index, err := options.Index(cmd)
-	if err != nil {
-		return "", err
-	}
-
-	words, err := cmd.Flags().GetUint32("words")
-	if err != nil {
-		return "", fmt.Errorf("reading the word count: %w", err)
-	}
-
-	parent, err := options.Mnemonic(cmd)
-	if err != nil {
-		return "", err
-	}
-
-	master, err := derive.Master(parent)
-	if err != nil {
-		return "", err
-	}
-
-	return childmnemonic.Derive(master, words, index)
-}

internal/cli/ssh/install.go

@@ -1,270 +0,0 @@
-package ssh
-
-import (
-	"bytes"
-	"crypto/rand"
-	"encoding/hex"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"slices"
-	"strings"
-
-	"github.com/spf13/cobra"
-)
-
-// Where the key goes on the host and what the file it arrives in is
-// called before it is renamed into place. The random end of that name
-// keeps two runs at once from writing to the same file.
-const (
-	directory     = ".ssh"
-	authorized    = ".ssh/authorized_keys"
-	sidecarPrefix = ".ssh/authorized_keys.keyfunc-"
-	sidecarBytes  = 8
-)
-
-// The modes the host is left with, as sftp's chmod spells them, and
-// the mode of the copy made here on the way.
-const (
-	directoryMode = "700"
-	fileMode      = "600"
-	localMode     = 0o600
-)
-
-// install returns the command that adds the public key to a host.
-func install() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "install <[user@]host> [-- sftp options...]",
-		Short: "add the public key to a host's authorized_keys",
-		Long: "Downloads the host's authorized_keys with the system " +
-			"sftp, adds the public key to it here unless the same " +
-			"line is already there, and uploads the result as a file " +
-			"beside it which is then renamed over it. Nothing is run " +
-			"on the host. Anything after -- is given to sftp " +
-			"unchanged, which is where the port goes (-P).",
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			key, comment, err := derived(cmd)
-			if err != nil {
-				return err
-			}
-
-			line, err := key.Line(comment)
-			if err != nil {
-				return err
-			}
-
-			return add(cmd, args[0], args[1:], line)
-		},
-	}
-
-	addComment(cmd)
-
-	return cmd
-}
-
-// add puts the key line in the host's authorized_keys. The file is
-// fetched in one sftp session and written back in another, so a run
-// that adds a line connects twice; a run that finds the line already
-// there connects once and stops.
-func add(cmd *cobra.Command, host string, options []string, line string) error {
-	work, err := os.MkdirTemp("", "keyfunc-install-")
-	if err != nil {
-		return fmt.Errorf("making a temporary directory: %w", err)
-	}
-
-	defer func() { _ = os.RemoveAll(work) }()
-
-	content, err := fetch(cmd, host, options,
-		filepath.Join(work, "authorized_keys"),
-	)
-	if err != nil {
-		return err
-	}
-
-	merged, added := merge(content, line)
-	if !added {
-		return write(cmd, "already present\n")
-	}
-
-	return upload(cmd, host, options, work, merged)
-}
-
-// upload writes the new file to the host and renames it over
-// authorized_keys, which is the step that either happens or does not.
-// Nothing is removed when a step fails: the file left behind is named
-// so that it can be looked at and cleared away by hand.
-func upload(
-	cmd *cobra.Command, host string, options []string,
-	work, merged string,
-) error {
-	local := filepath.Join(work, "authorized_keys.merged")
-
-	err := os.WriteFile(local, []byte(merged), localMode)
-	if err != nil {
-		return fmt.Errorf("writing the new file: %w", err)
-	}
-
-	sidecar, err := sidecarName()
-	if err != nil {
-		return err
-	}
-
-	// The mkdir may fail: the directory is usually there already.
-	said, err := session(cmd, host, options, []string{
-		"-mkdir " + directory,
-		"chmod " + directoryMode + " " + directory,
-		"put " + quoted(local) + " " + sidecar,
-		"chmod " + fileMode + " " + sidecar,
-		"rename " + sidecar + " " + authorized,
-	})
-	if err != nil {
-		// sftp echoes each command as it runs it and stops at the
-		// first that fails, so the name is in what it said only once
-		// the put was reached, which is where a file of that name
-		// can be on the host. Before that there is none to name.
-		if strings.Contains(said, sidecar) {
-			return fmt.Errorf(
-				"%w; %s may be left on the host", err, sidecar,
-			)
-		}
-
-		return err
-	}
-
-	return write(cmd, "added\n")
-}
-
-// session runs one sftp session with the user's own options and the
-// batch of commands, which sftp reads from its standard input and
-// stops at the first of which that fails, unless it begins with a
-// dash. sftp echoes the commands as it runs them, so everything it
-// says goes to the error output and the tool's own output stays the
-// one word it prints. What it said is also given back: a session that
-// failed says there what went wrong, and the status alone does not.
-func session(
-	cmd *cobra.Command, host string, options []string, batch []string,
-) (string, error) {
-	argv := slices.Concat(
-		[]string{"-b", "-"}, options, []string{host},
-	)
-
-	var said bytes.Buffer
-
-	//nolint:gosec // the options are the user's own, meant for sftp
-	command := exec.CommandContext(cmd.Context(), "sftp", argv...)
-	command.Stdin = strings.NewReader(strings.Join(batch, "\n") + "\n")
-	command.Stdout = &said
-	command.Stderr = &said
-
-	err := command.Run()
-
-	_, _ = cmd.ErrOrStderr().Write(said.Bytes())
-
-	if err != nil {
-		return said.String(), fmt.Errorf("running sftp: %w", err)
-	}
-
-	return said.String(), nil
-}
-
-// merge returns the file with the key line on the end, and whether it
-// had to be added. A file whose last line has no newline at its end
-// gets one first, so that the two lines do not run into each other.
-func merge(content, line string) (string, bool) {
-	if slices.Contains(strings.Split(content, "\n"), line) {
-		return content, false
-	}
-
-	if content != "" && !strings.HasSuffix(content, "\n") {
-		content += "\n"
-	}
-
-	return content + line + "\n", true
-}
-
-// fetch brings the host's authorized_keys into the given path and
-// returns what is in it. A host that has no such file reads as empty,
-// but only when that is what sftp said about it: a file that is there
-// and cannot be read fails the run, because writing back over it
-// would leave the host with the new key and nothing else.
-func fetch(
-	cmd *cobra.Command, host string, options []string, into string,
-) (string, error) {
-	said, err := session(cmd, host, options, []string{
-		"get " + authorized + " " + quoted(into),
-	})
-	if err != nil {
-		if absent(said) {
-			return "", nil
-		}
-
-		return "", err
-	}
-
-	//nolint:gosec // the path is a temporary file of the tool's own
-	content, err := os.ReadFile(into)
-	if err != nil {
-		return "", fmt.Errorf("reading the fetched file: %w", err)
-	}
-
-	return string(content), nil
-}
-
-// absent says whether sftp reported the file that was asked for as
-// not being there, which is the one failure of the fetch that is read
-// as an empty authorized_keys. The reading is taken only from the
-// line in which sftp reports on that file, because ssh writes "no
-// such file" into the same output for reasons of its own — a missing
-// -i identity file draws that warning on a session that then
-// authenticates through the agent — and a real read failure on such a
-// session must not pass for an empty file.
-func absent(said string) bool {
-	for line := range strings.Lines(said) {
-		named, is := reportedNotFound(strings.TrimSpace(line))
-		if is && (named == authorized ||
-			strings.HasSuffix(named, "/"+authorized)) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// reportedNotFound returns the path an sftp line reports as not being
-// there, and whether the line is such a report. The client writes one
-// wording for a remote file it cannot find, naming the path the
-// server expanded, which is the absolute one.
-func reportedNotFound(line string) (string, bool) {
-	const (
-		before = `File "`
-		after  = `" not found.`
-	)
-
-	if !strings.HasPrefix(line, before) ||
-		!strings.HasSuffix(line, after) {
-		return "", false
-	}
-
-	return strings.TrimSuffix(strings.TrimPrefix(line, before), after), true
-}
-
-// sidecarName returns the name the new file is uploaded under.
-func sidecarName() (string, error) {
-	random := make([]byte, sidecarBytes)
-
-	_, err := rand.Read(random)
-	if err != nil {
-		return "", fmt.Errorf("making a name for the new file: %w", err)
-	}
-
-	return sidecarPrefix + hex.EncodeToString(random), nil
-}
-
-// quoted puts the double quotes around a path that sftp needs when the
-// path has a space in it. Only paths of the tool's own making are
-// given to it, and they hold no quote of their own.
-func quoted(path string) string {
-	return `"` + path + `"`
-}

internal/cli/ssh/install_test.go

@@ -1,78 +0,0 @@
-//nolint:testpackage // absent is what these wordings are read by
-package ssh
-
-import "testing"
-
-// What a session says besides its report on the file that was asked
-// for: sftp echoes the command it is running, and ssh warns about an
-// identity file it cannot find in the words of a missing file even
-// though the session goes on to authenticate.
-const (
-	echoed = `sftp> get .ssh/authorized_keys "/tmp/keyfunc/authorized_keys"
-`
-	warning = `Warning: Identity file /gone not accessible: ` +
-		"No such file or directory.\n"
-)
-
-// TestAbsenceIsReadOnlyFromWhatSFTPSaidAboutAuthorizedKeys holds the
-// wordings the OpenSSH client was seen to use against a real server:
-// a file it cannot find is reported one way, naming the path the
-// server expanded, and everything else it says is a failure.
-func TestAbsenceIsReadOnlyFromWhatSFTPSaidAboutAuthorizedKeys(t *testing.T) {
-	t.Parallel()
-
-	sessions := map[string]struct {
-		said string
-		want bool
-	}{
-		"the file is not there": {
-			said: echoed +
-				`File "/home/someone/.ssh/authorized_keys" not found.` + "\n",
-			want: true,
-		},
-		"the file is not there, named as it was asked for": {
-			said: echoed + `File ".ssh/authorized_keys" not found.` + "\n",
-			want: true,
-		},
-		"the file is not there and an identity file is not either": {
-			said: warning + echoed +
-				`File "/home/someone/.ssh/authorized_keys" not found.` + "\n",
-			want: true,
-		},
-		"the file is there and cannot be read": {
-			said: echoed +
-				`remote open "/home/someone/.ssh/authorized_keys": ` +
-				"Permission denied\n",
-			want: false,
-		},
-		"only an identity file is not there": {
-			said: warning + echoed +
-				`remote open "/home/someone/.ssh/authorized_keys": ` +
-				"Permission denied\n",
-			want: false,
-		},
-		"some other file is not there": {
-			said: echoed + `File "/home/someone/.ssh/known_hosts" not found.` +
-				"\n",
-			want: false,
-		},
-		"the connection did not come up": {
-			said: "ssh: connect to host example.com port 22: " +
-				"Connection refused\nConnection closed\n",
-			want: false,
-		},
-	}
-
-	for name, session := range sessions {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if absent(session.said) != session.want {
-				t.Errorf(
-					"read as absent: %t, wanted %t, from:\n%s",
-					!session.want, session.want, session.said,
-				)
-			}
-		})
-	}
-}

internal/cli/ssh/ssh.go

@@ -17,7 +17,7 @@ func Command() *cobra.Command {
 		Short: "derive ed25519 SSH keys",
 	}
 
-	group.AddCommand(public(), private(), install(), to())
+	group.AddCommand(public(), private())
 
 	return group
 }

internal/cli/ssh/to.go

@@ -1,95 +0,0 @@
-package ssh
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"slices"
-
-	"github.com/spf13/cobra"
-)
-
-// StatusError says the tool should end with the status ssh ended with.
-// Only "ssh to" gives one back; every other error ends the tool with
-// status 1.
-type StatusError struct {
-	Status int
-}
-
-// Error says which status ssh ended with.
-func (e StatusError) Error() string {
-	return fmt.Sprintf("ssh exited with status %d", e.Status)
-}
-
-// to returns the command that runs ssh with the derived key held by an
-// agent of the tool's own.
-func to() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "to <host> [ssh arguments...]",
-		Short: "run ssh with the derived key served from its own agent",
-		Long: "Serves the derived key from an SSH agent that runs " +
-			"inside the tool and points the system ssh at it. The host " +
-			"and everything after it are given to ssh unchanged, the " +
-			"tool ends with the status ssh ended with, and the key is " +
-			"never written to disk.",
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			key, comment, err := derived(cmd)
-			if err != nil {
-				return err
-			}
-
-			served, err := key.Serve(cmd.Context(), comment)
-			if err != nil {
-				return err
-			}
-
-			defer served.Stop()
-
-			argv := slices.Concat([]string{
-				"-o", "IdentityAgent=" + served.Socket(),
-			}, args)
-
-			return connect(cmd.Context(), argv)
-		},
-	}
-
-	// Everything from the host onwards belongs to ssh, so flag
-	// reading stops at the first argument that is not a flag.
-	cmd.Flags().SetInterspersed(false)
-
-	addComment(cmd)
-
-	return cmd
-}
-
-// connect runs ssh on the terminal the tool was given and turns the
-// status it ended with into the status the tool ends with.
-func connect(ctx context.Context, argv []string) error {
-	//nolint:gosec // the arguments are the user's own, meant for ssh
-	command := exec.CommandContext(ctx, "ssh", argv...)
-	command.Stdin = os.Stdin
-	command.Stdout = os.Stdout
-	command.Stderr = os.Stderr
-
-	err := command.Run()
-	if err == nil {
-		return nil
-	}
-
-	var ended *exec.ExitError
-	if errors.As(err, &ended) {
-		status := ended.ExitCode()
-		if status < 0 {
-			// A signal ended ssh, and a signal has no status of its
-			// own to pass on.
-			status = 1
-		}
-
-		return StatusError{Status: status}
-	}
-
-	return fmt.Errorf("running ssh: %w", err)
-}

internal/cli/ssh_test.go

@@ -1,510 +0,0 @@
-package cli_test
-
-import (
-	"bytes"
-	"os"
-	"path/filepath"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-
-	"git.eeqj.de/sneak/keyfunc/internal/cli"
-	"git.eeqj.de/sneak/keyfunc/internal/cli/ssh"
-	"git.eeqj.de/sneak/keyfunc/internal/mnemonic"
-	"github.com/stretchr/testify/require"
-)
-
-// The modes the host is supposed to end up with, and the mode the
-// stand-ins need so that they can be run at all.
-const (
-	directoryMode = 0o700
-	fileMode      = 0o600
-	standInMode   = 0o755
-)
-
-// failingStatus is the status the stand-in ssh ends with when a test
-// wants to see a status handed on, and failedStatus is the status the
-// tool itself ends with when something went wrong.
-const (
-	failingStatus = 7
-	failedStatus  = 1
-)
-
-// notADirectory is what a test puts where the .ssh directory belongs
-// to make a step of the write session fail.
-const notADirectory = "a file where the directory belongs\n"
-
-// missingIdentity is a path with no file at it, handed to sftp after
-// the dashes so that ssh warns about it in the words of a missing
-// file.
-const missingIdentity = "/nonexistent/keyfunc-test-identity"
-
-// The host, and where on it the key ends up.
-const (
-	host      = "someone@example.com"
-	keptUnder = ".ssh"
-	keptIn    = "authorized_keys"
-)
-
-// The tool's own name, as it stands in the arguments a test hands to
-// Main, the ssh subcommand both commands the tests here drive live
-// under, and the one of those two these tests name most.
-const (
-	tool       = "keyfunc"
-	subcommand = "ssh"
-	installing = "install"
-)
-
-// The key line the example mnemonic gives at index 0, as it stands in
-// an authorized_keys file.
-const keyLine = vectorZero + " keyfunc/ssh/0\n"
-
-// installer is a stand-in for the system sftp for the install
-// command. It writes down the arguments and every command of the
-// batch it is given, echoes each command as sftp does, and carries
-// the commands out against a directory standing in for the host's
-// home directory, so that what keyfunc sends can be watched doing its
-// work. A command that begins with a dash may fail; any other failure
-// ends the session, as it does in sftp's own batch mode.
-//
-// The two ways a get can fail are worded as the OpenSSH client words
-// them, both naming the path the server expanded: a file that is not
-// there, which is the one failure the tool reads as an empty file, and
-// a file that is there and cannot be read, which is not. An -i naming
-// a file that is not here draws the warning ssh writes for it, which
-// carries the wording of a missing file into a session that goes on to
-// authenticate.
-const installer = `
-previous=
-for argument in "$@"; do
-	printf '%s\n' "$argument" >> "$KEYFUNC_TEST_ARGUMENTS"
-	if [ "$previous" = -i ] && [ ! -e "$argument" ]; then
-		printf 'Warning: Identity file %s not accessible: %s.\n' \
-			"$argument" "No such file or directory" >&2
-	fi
-	previous=$argument
-done
-home="$KEYFUNC_TEST_HOME"
-while IFS= read -r line; do
-	printf 'sftp> %s\n' "$line"
-	printf '%s\n' "$line" >> "$KEYFUNC_TEST_BATCH"
-	allowed=no
-	case "$line" in
-	-*)
-		line=${line#-}
-		allowed=yes
-		;;
-	esac
-	eval "set -- $line"
-	worked=yes
-	case "$1" in
-	get)
-		if [ ! -e "$home/$2" ]; then
-			worked=no
-			printf 'File "%s" not found.\n' "$home/$2" >&2
-		elif ! cp "$home/$2" "$3" 2>/dev/null; then
-			worked=no
-			printf 'remote open "%s": Permission denied\n' "$home/$2" >&2
-		fi
-		;;
-	put) cp "$2" "$home/$3" 2>/dev/null || worked=no ;;
-	mkdir) mkdir "$home/$2" 2>/dev/null || worked=no ;;
-	chmod) chmod "$2" "$home/$3" 2>/dev/null || worked=no ;;
-	rename) mv "$home/$2" "$home/$3" 2>/dev/null || worked=no ;;
-	esac
-	if [ "$worked" = no ] && [ "$allowed" = no ]; then
-		printf 'sftp: %s failed\n' "$1" >&2
-		exit 1
-	fi
-done
-`
-
-// caller is a stand-in for the system ssh for the to command. It
-// writes down the arguments it was given, notes the agent socket if
-// there really is one at the path it was handed, and ends with the
-// status the test asked for.
-const caller = `
-for argument in "$@"; do
-	printf '%s\n' "$argument" >> "$KEYFUNC_TEST_ARGUMENTS"
-done
-socket=${2#IdentityAgent=}
-if [ -S "$socket" ]; then
-	printf '%s\n' "$socket" > "$KEYFUNC_TEST_SOCKET"
-fi
-exit "$KEYFUNC_TEST_STATUS"
-`
-
-// pretended is where a stand-in writes down what it was asked to do.
-type pretended struct {
-	// home stands in for the home directory on the host.
-	home string
-	// arguments holds the arguments of every session, one per line.
-	arguments string
-	// batch holds the commands of every session, one per line.
-	batch string
-}
-
-func TestTheKeyIsAddedToAHostThatHasNoFileYet(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-
-	require.Equal(t, "added\n", install(t, host))
-
-	directory, err := os.Stat(filepath.Join(pretend.home, keptUnder))
-	require.NoError(t, err)
-	require.Equal(t,
-		os.FileMode(directoryMode), directory.Mode().Perm(),
-	)
-
-	path := filepath.Join(pretend.home, keptUnder, keptIn)
-
-	file, err := os.Stat(path)
-	require.NoError(t, err)
-	require.Equal(t, os.FileMode(fileMode), file.Mode().Perm())
-
-	require.Equal(t, keyLine, read(t, path))
-}
-
-func TestAKeyThatIsAlreadyThereIsLeftAlone(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-	path := seed(t, pretend, "somebody else\n"+keyLine)
-
-	require.Equal(t, "already present\n", install(t, host))
-	require.Equal(t, "somebody else\n"+keyLine, read(t, path))
-
-	// The fetch and nothing after it: the tool did not connect again.
-	require.Len(t, recorded(t, pretend.batch), 1)
-}
-
-func TestAnEmptyFileGetsTheKeyAndNoBlankLineBeforeIt(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-	path := seed(t, pretend, "")
-
-	require.Equal(t, "added\n", install(t, host))
-	require.Equal(t, keyLine, read(t, path))
-}
-
-func TestTheKeyDoesNotRunIntoALineWithNoNewlineAtItsEnd(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-	already := "ssh-ed25519 AAAAsomebodyelse somebody@else"
-	path := seed(t, pretend, already)
-
-	require.Equal(t, "added\n", install(t, host))
-	require.Equal(t, already+"\n"+keyLine, read(t, path))
-}
-
-func TestTheFileIsUploadedBesideTheOldOneAndThenRenamedOverIt(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-
-	require.Equal(t, "added\n", install(t, host))
-
-	sent := recorded(t, pretend.batch)
-	require.Len(t, sent, 6)
-
-	// The name of the uploaded file is random, so it is read off the
-	// put and then looked for in the two commands that follow.
-	beside := strings.Fields(sent[3])[2]
-	require.True(t,
-		strings.HasPrefix(beside, ".ssh/authorized_keys.keyfunc-"),
-	)
-
-	require.True(t, strings.HasPrefix(sent[0], "get .ssh/authorized_keys "))
-	require.Equal(t, "-mkdir .ssh", sent[1])
-	require.Equal(t, "chmod 700 .ssh", sent[2])
-	require.Equal(t, "put", strings.Fields(sent[3])[0])
-	require.Equal(t, "chmod 600 "+beside, sent[4])
-	require.Equal(t, "rename "+beside+" .ssh/authorized_keys", sent[5])
-}
-
-func TestAFileThatCannotBeReadIsNotWrittenOver(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-	unreadable := unfetchable(t, pretend)
-
-	printed, said, err := attempt(t, host)
-	require.Error(t, err)
-	require.Empty(t, printed)
-	require.Contains(t, said, "Permission denied")
-
-	// The fetch and nothing after it, and what was on the host is
-	// still what is on the host.
-	require.Len(t, recorded(t, pretend.batch), 1)
-	require.DirExists(t, unreadable)
-}
-
-func TestAWarningAboutAnotherFileIsNotTakenForTheOneAskedFor(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-	unreadable := unfetchable(t, pretend)
-
-	// ssh warns about an -i it cannot find in the words of a missing
-	// file, on a session that then authenticates perfectly well. That
-	// warning is not sftp reporting on authorized_keys, so the fetch
-	// failure is still a failure.
-	printed, said, err := attempt(t, host, "--", "-i", missingIdentity)
-	require.Error(t, err)
-	require.Empty(t, printed)
-	require.Contains(t, said, "No such file or directory")
-	require.Contains(t, said, "Permission denied")
-
-	require.Len(t, recorded(t, pretend.batch), 1)
-	require.DirExists(t, unreadable)
-
-	// The same run again, this way for the status it ends with.
-	given := os.Args
-
-	t.Cleanup(func() { os.Args = given })
-
-	os.Args = []string{
-		tool, subcommand, installing, host, "--", "-i", missingIdentity,
-	}
-
-	require.Equal(t, failedStatus, cli.Main())
-}
-
-func TestAFailedStepNamesTheUploadedFileAndChangesNothing(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-
-	// A file where the .ssh directory belongs: nothing is there to
-	// fetch, and then the put has nowhere to put anything, so the
-	// write session ends at the put.
-	inTheWay := filepath.Join(pretend.home, keptUnder)
-	require.NoError(t,
-		os.WriteFile(inTheWay, []byte(notADirectory), fileMode),
-	)
-
-	printed, said, err := attempt(t, host)
-	require.Error(t, err)
-	require.Empty(t, printed)
-	require.Contains(t, said, "put failed")
-
-	// The put is the last command the session got to, and the file it
-	// was uploading is the one the message names.
-	sent := recorded(t, pretend.batch)
-	require.Len(t, sent, 4)
-	require.Equal(t, "put", strings.Fields(sent[3])[0])
-	require.Contains(t, err.Error(), strings.Fields(sent[3])[2])
-
-	require.Equal(t, notADirectory, read(t, inTheWay))
-
-	// The same run again, this way for the status it ends with.
-	given := os.Args
-
-	t.Cleanup(func() { os.Args = given })
-
-	os.Args = []string{tool, subcommand, installing, host}
-
-	require.Equal(t, failedStatus, cli.Main())
-}
-
-func TestTheKeyLineIsNotSentAsACommand(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-
-	install(t, host)
-
-	require.NotContains(t, read(t, pretend.arguments), "ssh-ed25519")
-	require.NotContains(t, read(t, pretend.batch), "ssh-ed25519")
-}
-
-func TestWhatComesAfterTheDashesIsGivenToSFTP(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretend := pretendHost(t)
-
-	install(t, host, "--", "-P", "2222")
-
-	// The same arguments twice over: adding a line takes two
-	// connections, one to fetch the file and one to write it back.
-	session := []string{"-b", "-", "-P", "2222", host}
-	require.Equal(t,
-		slices.Concat(session, session),
-		recorded(t, pretend.arguments),
-	)
-}
-
-func TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	arguments, noted := pretendCall(t)
-
-	_, err := execute(t, subcommand, "to", host, "uptime")
-
-	var passed ssh.StatusError
-
-	require.ErrorAs(t, err, &passed)
-	require.Equal(t, failingStatus, passed.Status)
-
-	given := recorded(t, arguments)
-	require.Equal(t, "-o", given[0])
-	require.Equal(t, []string{host, "uptime"}, given[2:])
-
-	// The stand-in wrote the path down only because there really was
-	// a socket there while it ran.
-	socket := strings.TrimSpace(read(t, noted))
-	require.Equal(t, "IdentityAgent="+socket, given[1])
-	require.NoDirExists(t, filepath.Dir(socket))
-}
-
-func TestTheToolEndsWithTheStatusSSHEndedWith(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	pretendCall(t)
-
-	given := os.Args
-
-	t.Cleanup(func() { os.Args = given })
-
-	os.Args = []string{tool, subcommand, "to", host, "uptime"}
-
-	require.Equal(t, failingStatus, cli.Main())
-}
-
-// pretendHost puts the install stand-in on the path and gives back the
-// places it writes to.
-func pretendHost(t *testing.T) pretended {
-	t.Helper()
-
-	pretend := pretended{
-		home:      t.TempDir(),
-		arguments: filepath.Join(t.TempDir(), "arguments"),
-		batch:     filepath.Join(t.TempDir(), "batch"),
-	}
-
-	t.Setenv("KEYFUNC_TEST_HOME", pretend.home)
-	t.Setenv("KEYFUNC_TEST_ARGUMENTS", pretend.arguments)
-	t.Setenv("KEYFUNC_TEST_BATCH", pretend.batch)
-	standIn(t, "sftp", installer)
-
-	return pretend
-}
-
-// install runs the install command, requires it to have worked, and
-// gives back what the tool itself printed.
-func install(t *testing.T, args ...string) string {
-	t.Helper()
-
-	printed, _, err := attempt(t, args...)
-	require.NoError(t, err)
-
-	return printed
-}
-
-// attempt runs the install command with the tool's own output kept
-// apart from what the stand-in said, since the stand-in echoes its
-// batch as sftp does. It gives back what the tool printed, what the
-// stand-in said, and how the run ended.
-func attempt(t *testing.T, args ...string) (string, string, error) {
-	t.Helper()
-
-	var printed, said bytes.Buffer
-
-	root := cli.Root()
-	root.SetOut(&printed)
-	root.SetErr(&said)
-	root.SetArgs(slices.Concat([]string{subcommand, installing}, args))
-
-	err := root.ExecuteContext(t.Context())
-
-	return printed.String(), said.String(), err
-}
-
-// seed puts an authorized_keys file on the stand-in host before the
-// tool runs and gives back its path.
-func seed(t *testing.T, pretend pretended, content string) string {
-	t.Helper()
-
-	directory := filepath.Join(pretend.home, keptUnder)
-	require.NoError(t, os.Mkdir(directory, directoryMode))
-
-	path := filepath.Join(directory, keptIn)
-	require.NoError(t, os.WriteFile(path, []byte(content), fileMode))
-
-	return path
-}
-
-// unfetchable puts a directory where authorized_keys belongs on the
-// stand-in host, which the stand-in can see but cannot fetch: that is
-// how a file that is there and cannot be read looks from here. It
-// gives back the path.
-func unfetchable(t *testing.T, pretend pretended) string {
-	t.Helper()
-
-	require.NoError(t,
-		os.Mkdir(filepath.Join(pretend.home, keptUnder), directoryMode),
-	)
-
-	path := filepath.Join(pretend.home, keptUnder, keptIn)
-	require.NoError(t, os.Mkdir(path, directoryMode))
-
-	return path
-}
-
-// pretendCall puts the to stand-in on the path and gives back the file
-// the arguments are written down in and the file the agent socket is
-// noted in.
-func pretendCall(t *testing.T) (string, string) {
-	t.Helper()
-
-	arguments := filepath.Join(t.TempDir(), "arguments")
-	noted := filepath.Join(t.TempDir(), "socket")
-
-	t.Setenv("KEYFUNC_TEST_ARGUMENTS", arguments)
-	t.Setenv("KEYFUNC_TEST_SOCKET", noted)
-	t.Setenv("KEYFUNC_TEST_STATUS", strconv.Itoa(failingStatus))
-	standIn(t, "ssh", caller)
-
-	return arguments, noted
-}
-
-// standIn writes a stand-in for one of the system programs and puts it
-// first on the path, so that the tool finds it instead of the real
-// one.
-func standIn(t *testing.T, name, body string) {
-	t.Helper()
-
-	directory := t.TempDir()
-
-	err := os.WriteFile(
-		filepath.Join(directory, name),
-		[]byte("#!/bin/sh\n"+body), standInMode,
-	)
-	require.NoError(t, err)
-
-	t.Setenv("PATH",
-		directory+string(os.PathListSeparator)+os.Getenv("PATH"),
-	)
-}
-
-// read returns what is in a file.
-func read(t *testing.T, path string) string {
-	t.Helper()
-
-	//nolint:gosec // the path is a temporary file of the test's own
-	content, err := os.ReadFile(path)
-	require.NoError(t, err)
-
-	return string(content)
-}
-
-// recorded returns the lines a stand-in wrote down.
-func recorded(t *testing.T, path string) []string {
-	t.Helper()
-
-	return strings.Split(strings.TrimSuffix(read(t, path), "\n"), "\n")
-}

internal/derive/derive.go

@@ -35,47 +35,24 @@ func Path(application, index uint32) string {
 	return fmt.Sprintf("m/%d'/%d'/%d'", purpose, application, index)
 }
 
-// CheckIndex refuses a key index above MaxIndex, so that every key
-// type turns such an index down before deriving anything.
-func CheckIndex(index uint32) error {
-	if index > MaxIndex {
-		return fmt.Errorf(
-			"%w: %d is above %d",
-			ErrIndexTooLarge, index, MaxIndex,
-		)
-	}
-
-	return nil
-}
-
-// Master returns the BIP-32 master key a mnemonic stands for: the
-// mnemonic becomes a seed with an empty passphrase, and the seed
-// becomes the key.
-func Master(words string) (*hdkeychain.ExtendedKey, error) {
-	seed := bip39.NewSeed(words, "")
-
-	master, err := hdkeychain.NewMaster(seed, &chaincfg.MainNetParams)
-	if err != nil {
-		return nil, fmt.Errorf("making the master key: %w", err)
-	}
-
-	return master, nil
-}
-
 // Bytes returns the bytes for an application number and a key index.
 // The mnemonic becomes a seed with an empty passphrase, the seed
 // becomes a master key, the master key gives BIP-85 entropy at the
 // path, and the entropy seeds the generator the bytes are read from.
 // An index above MaxIndex is refused before any of that happens.
 func Bytes(words string, application, index uint32) ([]byte, error) {
-	err := CheckIndex(index)
-	if err != nil {
-		return nil, err
+	if index > MaxIndex {
+		return nil, fmt.Errorf(
+			"%w: %d is above %d",
+			ErrIndexTooLarge, index, MaxIndex,
+		)
 	}
 
-	master, err := Master(words)
+	seed := bip39.NewSeed(words, "")
+
+	master, err := hdkeychain.NewMaster(seed, &chaincfg.MainNetParams)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("making the master key: %w", err)
 	}
 
 	entropy, err := bip85.DeriveBIP85Entropy(master, Path(application, index))

internal/sshkey/agent.go

@@ -1,86 +0,0 @@
-package sshkey
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-
-	"golang.org/x/crypto/ssh/agent"
-)
-
-// Agent is an SSH agent that holds one key and serves it on a unix
-// socket. The socket sits in a directory of its own that only its
-// owner may enter, and the key stays in memory: nothing is written to
-// disk.
-type Agent struct {
-	socket   string
-	listener net.Listener
-}
-
-// Serve starts an agent holding this key under the given comment.
-// Stop takes it down again.
-func (k *Key) Serve(ctx context.Context, comment string) (*Agent, error) {
-	keyring := agent.NewKeyring()
-
-	err := keyring.Add(agent.AddedKey{
-		PrivateKey: k.private,
-		Comment:    comment,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("giving the key to the agent: %w", err)
-	}
-
-	// A temporary directory is made enterable by its owner alone,
-	// which is the protection the socket inside it has.
-	directory, err := os.MkdirTemp("", "keyfunc-agent-")
-	if err != nil {
-		return nil, fmt.Errorf("making the agent directory: %w", err)
-	}
-
-	socket := filepath.Join(directory, "socket")
-
-	var listen net.ListenConfig
-
-	listener, err := listen.Listen(ctx, "unix", socket)
-	if err != nil {
-		_ = os.RemoveAll(directory)
-
-		return nil, fmt.Errorf("listening on the agent socket: %w", err)
-	}
-
-	served := &Agent{socket: socket, listener: listener}
-
-	go served.accept(keyring)
-
-	return served, nil
-}
-
-// Socket is the path to point ssh at.
-func (a *Agent) Socket() string {
-	return a.socket
-}
-
-// Stop takes the agent down and removes the socket and the directory
-// it is in.
-func (a *Agent) Stop() {
-	_ = a.listener.Close()
-	_ = os.RemoveAll(filepath.Dir(a.socket))
-}
-
-// accept answers connections until Stop closes the listener.
-func (a *Agent) accept(keyring agent.Agent) {
-	for {
-		connection, err := a.listener.Accept()
-		if err != nil {
-			return
-		}
-
-		go func() {
-			defer func() { _ = connection.Close() }()
-
-			_ = agent.ServeAgent(keyring, connection)
-		}()
-	}
-}

internal/sshkey/sshkey_test.go

@@ -1,9 +1,6 @@
 package sshkey_test
 
 import (
-	"net"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -11,16 +8,8 @@ import (
 	"git.eeqj.de/sneak/keyfunc/internal/sshkey"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/agent"
 )
 
-// agentDirectoryMode is what the directory holding the agent socket
-// has to be: nobody but its owner may enter it.
-const agentDirectoryMode = 0o700
-
-// exampleIndex is the key index every test here derives at.
-const exampleIndex = 0
-
 // example returns the mnemonic every BIP-39 document uses to show its
 // test vectors: eleven abandons and about.
 func example() string {
@@ -37,7 +26,7 @@ func TestTooFewBytesAreRefused(t *testing.T) {
 func TestTheCommentIsPutAtTheEndOfTheLine(t *testing.T) {
 	t.Parallel()
 
-	key := exampleKey(t)
+	key := forIndex(t, 0)
 
 	line, err := key.Line("hello")
 	require.NoError(t, err)
@@ -48,7 +37,7 @@ func TestTheCommentIsPutAtTheEndOfTheLine(t *testing.T) {
 func TestThePrivateKeyCarriesTheSamePublicKey(t *testing.T) {
 	t.Parallel()
 
-	key := exampleKey(t)
+	key := forIndex(t, 0)
 
 	line, err := key.Line("")
 	require.NoError(t, err)
@@ -65,60 +54,11 @@ func TestThePrivateKeyCarriesTheSamePublicKey(t *testing.T) {
 	require.Equal(t, line, back)
 }
 
-func TestTheAgentServesTheOneKeyAndNothingElse(t *testing.T) {
-	t.Parallel()
-
-	key := exampleKey(t)
-
-	served, err := key.Serve(t.Context(), "a comment")
-	require.NoError(t, err)
-	t.Cleanup(served.Stop)
-
-	directory, err := os.Stat(filepath.Dir(served.Socket()))
-	require.NoError(t, err)
-	require.Equal(t,
-		os.FileMode(agentDirectoryMode), directory.Mode().Perm(),
-	)
-
-	var dialer net.Dialer
-
-	connection, err := dialer.DialContext(t.Context(), "unix", served.Socket())
-	require.NoError(t, err)
-
-	defer func() { _ = connection.Close() }()
-
-	held, err := agent.NewClient(connection).List()
-	require.NoError(t, err)
-	require.Len(t, held, 1)
-
-	line, err := key.Line("a comment")
-	require.NoError(t, err)
-	require.Equal(t, line, held[0].String())
-}
-
-func TestStoppingTheAgentLeavesNothingBehind(t *testing.T) {
-	t.Parallel()
-
-	served, err := exampleKey(t).Serve(t.Context(), "a comment")
-	require.NoError(t, err)
-
-	directory := filepath.Dir(served.Socket())
-	require.DirExists(t, directory)
-
-	served.Stop()
-	require.NoDirExists(t, directory)
-
-	var dialer net.Dialer
-
-	_, err = dialer.DialContext(t.Context(), "unix", served.Socket())
-	require.Error(t, err)
-}
-
-// exampleKey derives the key the example mnemonic gives.
-func exampleKey(t *testing.T) *sshkey.Key {
+// forIndex derives the key for one index.
+func forIndex(t *testing.T, index uint32) *sshkey.Key {
 	t.Helper()
 
-	material, err := derive.Bytes(example(), sshkey.Application, exampleIndex)
+	material, err := derive.Bytes(example(), sshkey.Application, index)
 	require.NoError(t, err)
 
 	key, err := sshkey.New(material)