Copy go-bip39 into internal/bip39 (closes #42)

go-bip39's repository no longer exists, so keyfunc now carries the
part of v1.1.0 it uses, with the upstream LICENSE beside it, and
imports it from internal/bip39. Upstream's tests and test vectors for
the kept code come along unchanged; where they called a removed
function, crypto/rand stands in for NewEntropy and EntropyFromMnemonic
for MnemonicToByteArray.

Changes beyond the trimming are what the linter asked for: the
package-level variables moved into the functions that use them, three
error strings were lower-cased, and the unknown-word error now wraps
ErrInvalidMnemonic.

go.mod no longer requires go-bip39. go mod tidy keeps its two go.sum
lines, because a test in sneak/secret's bip85 package imports it, and
drops six lines that only go-bip39's own requirements needed.

Model: opus-5-5

README.md

@@ -6,7 +6,7 @@ identities and child mnemonics, each of which can be recreated from that
 mnemonic at any time. The same mnemonic, key type and index always give the same
 key.
 
-It uses the BIP-85 entropy deriver from `sneak.berlin/go/secret/pkg/bip85` and
+It uses the BIP-85 entropy deriver from `git.eeqj.de/sneak/secret/pkg/bip85` and
 takes the same steps as that repository's `agehd` package.
 
 Commands are grouped by what is derived: `keyfunc ssh ...` for ed25519 SSH keys,
@@ -100,9 +100,7 @@ m/83696968'/<app>'/<n>'
   to one tool. Each key type's number is spelled the way BIP-85 spells its own
   RSA application (`828365` is the ASCII codes of `R`, `S`, `A` written out):
   SSH is `838372` (`S` `S` `H`), age is `657169` (`A` `G` `E`).
-- `n` is the key index, a decimal number: flag `--index` / `-n`, default `0`. A
-  leading zero is still decimal (`-n 010` is index 10); a base prefix, an
-  underscore or a sign (`0x10`, `1_0`, `+1`) is refused.
+- `n` is the key index: flag `--index` / `-n`, default `0`.
 
 ## Giving it the mnemonic
 

go.mod

@@ -4,13 +4,13 @@ go 1.26.0
 
 require (
 	filippo.io/age v1.3.2
+	git.eeqj.de/sneak/secret v0.0.0-20260810132333-41cea400a7fd
 	github.com/btcsuite/btcd v0.25.0
 	github.com/btcsuite/btcd/btcutil v1.2.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.12.1
 	golang.org/x/crypto v0.57.0
 	golang.org/x/term v0.46.0
-	sneak.berlin/go/secret v0.0.0-20261007105610-ef0ae90768c8
 )
 
 require (

go.sum

@@ -4,6 +4,8 @@ filippo.io/age v1.3.2 h1:r6RSZLFSMm6rzKepZ7ZAYkKCu14f3/Me8c7uKYh7C8c=
 filippo.io/age v1.3.2/go.mod h1:TH/Yr2sSRhCKbaH4XPxpUV0Us8Gv6txYUpiZQWz8Evk=
 filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
 filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY=
+git.eeqj.de/sneak/secret v0.0.0-20260810132333-41cea400a7fd h1:6YFV6horz2wDFPWWhour8qx8gLGyO0qoplwEeOuQ2J4=
+git.eeqj.de/sneak/secret v0.0.0-20260810132333-41cea400a7fd/go.mod h1:gKCcMZvlBOqusn/BxR8IyFmSJQr6R4vvjJ926iNpOSI=
 github.com/btcsuite/btcd v0.25.0 h1:JPbjwvHGpSywBRuorFFqTjaVP4y6Qw69XJ1nQ6MyWJM=
 github.com/btcsuite/btcd v0.25.0/go.mod h1:qbPE+pEiR9643E1s1xu57awsRhlCIm1ZIi6FfeRA4KE=
 github.com/btcsuite/btcd/btcec/v2 v2.5.0 h1:KioMXOWa76b86sTZZOmbzv/ldaQCmB8KFAyn5PbB8E8=
@@ -28,6 +30,8 @@ github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/tyler-smith/go-bip39 v1.1.0 h1:5eUemwrMargf3BSLRRCalXT93Ns6pQJIjYQN2nyfOP8=
+github.com/tyler-smith/go-bip39 v1.1.0/go.mod h1:gUYDtqQw1JS3ZJ8UWVcGTGqqr6YIN3CWg+kkNaLt55U=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
@@ -38,5 +42,3 @@ golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
 golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-sneak.berlin/go/secret v0.0.0-20261007105610-ef0ae90768c8 h1:Bd2bUsRCN8xhcrpH3LpJqHxR2QffeOuF5z76iP4BFnw=
-sneak.berlin/go/secret v0.0.0-20261007105610-ef0ae90768c8/go.mod h1:uVx9ZuE7ZMIOBY2B1ElXCs97CTsEfuham3NQRdLj5lI=

internal/childmnemonic/childmnemonic.go

@@ -5,10 +5,10 @@ import (
 	"errors"
 	"fmt"
 
+	"git.eeqj.de/sneak/secret/pkg/bip85"
 	"github.com/btcsuite/btcd/btcutil/hdkeychain"
 	"sneak.berlin/go/keyfunc/internal/bip39"
 	"sneak.berlin/go/keyfunc/internal/derive"
-	"sneak.berlin/go/secret/pkg/bip85"
 )
 
 // english is the number BIP-85 gives the English word list.

internal/cli/cli_test.go

@@ -2,7 +2,6 @@ package cli_test
 
 import (
 	"bytes"
-	"strconv"
 	"strings"
 	"testing"
 
@@ -107,56 +106,6 @@ func TestAnIndexWithNoHardenedChildIsRefused(t *testing.T) {
 	require.Empty(t, out)
 }
 
-func TestAnIndexWithALeadingZeroIsDecimal(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	line := run(t, "ssh", "pub", "-n", "010")
-	require.Equal(t, run(t, "ssh", "pub", "-n", "10"), line)
-	require.True(t,
-		strings.HasSuffix(strings.TrimSpace(line), " keyfunc/ssh/10"),
-	)
-}
-
-// The mnemonic command in these runs fails, so a refusal naming the
-// flag shows that the number was refused before the mnemonic was
-// looked for.
-func TestAnIndexThatIsNotDecimalDigitsIsRefused(t *testing.T) {
-	t.Parallel()
-
-	for _, index := range []string{"0x10", "1_0", "+1", "-1", ""} {
-		t.Run(index, func(t *testing.T) {
-			t.Parallel()
-
-			out, err := execute(t,
-				"ssh", "pub", "-n", index, "--mnemonic-command", "exit 1",
-			)
-			require.ErrorIs(t, err, strconv.ErrSyntax)
-			require.ErrorContains(t, err, "--index")
-			require.Empty(t, out)
-		})
-	}
-}
-
-// Neither a command group nor --version reads the index, so these
-// show that it is refused while the flags are parsed.
-func TestAnIndexNotInDecimalIsRefusedBeforeAnyCommandRuns(t *testing.T) {
-	t.Parallel()
-
-	for _, args := range [][]string{
-		{"ssh", "-n", "0x10"},
-		{"-n", "0x10", "--version"},
-	} {
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			t.Parallel()
-
-			out, err := execute(t, args...)
-			require.ErrorIs(t, err, strconv.ErrSyntax)
-			require.ErrorContains(t, err, "--index")
-			require.Empty(t, out)
-		})
-	}
-}
-
 func TestTheMnemonicCommandIsUsed(t *testing.T) {
 	t.Setenv(mnemonic.Variable, "")
 
@@ -189,22 +138,6 @@ func TestALengthTheToolDoesNotOfferIsRefused(t *testing.T) {
 	require.Empty(t, out)
 }
 
-func TestTheWordCountIsDecimal(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	words := strings.Fields(run(t, "mnemonic", "--words", "012"))
-	require.Len(t, words, twelve)
-
-	// As for the index, the failing mnemonic command shows that the
-	// number was refused first.
-	out, err := execute(t,
-		"mnemonic", "--words", "0x18", "--mnemonic-command", "exit 1",
-	)
-	require.ErrorIs(t, err, strconv.ErrSyntax)
-	require.ErrorContains(t, err, "--words")
-	require.Empty(t, out)
-}
-
 // run executes the tool with the given arguments and returns what it
 // wrote to standard output.
 func run(t *testing.T, args ...string) string {

internal/cli/mnemonic/mnemonic.go

@@ -31,9 +31,8 @@ func Command() *cobra.Command {
 		},
 	}
 
-	words := options.Decimal(childmnemonic.DefaultWords)
-	cmd.Flags().Var(
-		&words, "words",
+	cmd.Flags().Uint32(
+		"words", childmnemonic.DefaultWords,
 		"how long the child mnemonic is: 12, 18 or 24 words",
 	)
 

internal/cli/options/options.go

@@ -4,7 +4,6 @@ package options
 
 import (
 	"fmt"
-	"strconv"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
@@ -17,8 +16,8 @@ func Add(cmd *cobra.Command) {
 		"mnemonic-command", "",
 		"shell command whose output is the mnemonic",
 	)
-	cmd.PersistentFlags().VarP(
-		new(Decimal), "index", "n",
+	cmd.PersistentFlags().Uint32P(
+		"index", "n", 0,
 		"which key to derive",
 	)
 }
@@ -42,33 +41,3 @@ func Mnemonic(cmd *cobra.Command) (string, error) {
 
 	return mnemonic.Read(cmd.Context(), command)
 }
-
-// Decimal is a flag value for a number written in decimal digits only.
-// The flag library's own uint32 flags read 010 as octal 8 and also
-// take 0x10 or 1_0.
-type Decimal uint32
-
-// String returns the number in decimal digits.
-func (d *Decimal) String() string {
-	return strconv.FormatUint(uint64(*d), 10)
-}
-
-// Set reads text as a decimal number that fits in 32 bits: a leading
-// zero is still decimal, and a base prefix, an underscore or a sign is
-// refused.
-func (d *Decimal) Set(text string) error {
-	number, err := strconv.ParseUint(text, 10, 32)
-	if err != nil {
-		return err
-	}
-
-	*d = Decimal(number)
-
-	return nil
-}
-
-// Type is what --help shows as the flag's type, and what GetUint32
-// checks before it reads the value back.
-func (d *Decimal) Type() string {
-	return "uint32"
-}

internal/derive/derive.go

@@ -5,10 +5,10 @@ import (
 	"errors"
 	"fmt"
 
+	"git.eeqj.de/sneak/secret/pkg/bip85"
 	"github.com/btcsuite/btcd/btcutil/hdkeychain"
 	"github.com/btcsuite/btcd/chaincfg"
 	"sneak.berlin/go/keyfunc/internal/bip39"
-	"sneak.berlin/go/secret/pkg/bip85"
 )
 
 const (