Read secret environment variables once per command, then unset them (closes #60)

init and vault create put the mnemonic into the process environment for
vault.CreateVault to read back, so every program they ran, gpg included,
inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read
at 13 places and never unset. Each command that may need them now reads
both once, in its RunE, into locked buffers on the CLI Instance, and
unsets them at once. The buffers are passed down: vault.CreateVault
takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and
the PGP, keychain and Secure Enclave unlocker constructors take both;
CreatePGPUnlocker sets them on the vault it loads through SetMnemonic
and SetUnlockPassphrase, new in VaultInterface. README warns against
both variables.

Model: opus-5-5

internal/cli/lock_test.go

@@ -52,15 +52,18 @@ func lockInBackground(t *testing.T, fs afero.Fs) <-chan func() {
 }
 
 // addAtOnce runs one add of the secret name per value, all at once, and
-// returns their errors.
+// returns their errors. Each add is given mnemonic, which a forced add
+// needs.
 func addAtOnce(
 	fs afero.Fs, stateDir, name string, force bool, values []string,
+	mnemonic *memguard.LockedBuffer,
 ) []error {
 	errs := make(chan error, len(values))
 
 	for _, value := range values {
 		go func() {
 			cli := NewCLIInstanceWithStateDir(fs, stateDir)
+			cli.Mnemonic = mnemonic
 			cli.cmd = &cobra.Command{}
 			cli.cmd.SetIn(strings.NewReader(value))
 
@@ -92,9 +95,9 @@ func numbered(prefix string, count int) []string {
 // forced adds read the same highest version number and overwrite each
 // other's version. With it they behave as if run one after another.
 //
-//nolint:paralleltest // t.Setenv forbids parallel subtests
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	mnemonic := testMnemonicBuffer(t)
 
 	const adds = 8
 
@@ -107,14 +110,14 @@ func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
 		{"real", afero.NewOsFs(), t.TempDir()},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default")
+			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default", mnemonic)
 			require.NoError(t, err)
 
 			// One add creates the secret; the others find that it exists
 			created := 0
 
 			for _, err := range addAtOnce(tc.fs, tc.stateDir, "shared", false,
-				numbered("create", adds)) {
+				numbered("create", adds), mnemonic) {
 				if err == nil {
 					created++
 				} else {
@@ -126,13 +129,15 @@ func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
 
 			// Every forced add stores a version of its own
 			for _, err := range addAtOnce(tc.fs, tc.stateDir, "shared", true,
-				numbered("force", adds)) {
+				numbered("force", adds), mnemonic) {
 				require.NoError(t, err)
 			}
 
 			vlt, err := vault.GetCurrentVault(tc.fs, tc.stateDir)
 			require.NoError(t, err)
 
+			vlt.Mnemonic = mnemonic
+
 			vaultDir, err := vlt.GetDirectory()
 			require.NoError(t, err)
 
@@ -176,11 +181,11 @@ func (r *readNotifier) Read(p []byte) (int, error) {
 // taken the state directory lock before reading, it would hold the lock
 // while waiting for encrypt's output, and encrypt would wait for the lock
 // to store its key: neither would finish.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptPipedIntoAdd(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default")
+	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("piped"), 0o600))
 
@@ -283,14 +288,16 @@ func setupEveryCommand(
 ) (string, string) {
 	t.Helper()
 
-	other, err := vault.CreateVault(fs, testStateDir, "other")
+	mnemonic := testMnemonicBuffer(t)
+
+	other, err := vault.CreateVault(fs, testStateDir, "other", mnemonic)
 	require.NoError(t, err)
 
 	otherDir, err := other.GetDirectory()
 	require.NoError(t, err)
 	require.NoError(t, fs.Remove(filepath.Join(otherDir, "pub.age")))
 
-	vlt, err := vault.CreateVault(fs, testStateDir, "work")
+	vlt, err := vault.CreateVault(fs, testStateDir, "work", mnemonic)
 	require.NoError(t, err)
 
 	addTestSecret(t, vlt, []byte("older"), false)
@@ -363,7 +370,12 @@ func requireWaitsForLock(
 	release = sync.OnceFunc(release)
 	defer release()
 
+	unlockPassphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	defer unlockPassphrase.Destroy()
+
 	cli := NewCLIInstanceWithStateDir(fs, testStateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
+	cli.UnlockPassphrase = unlockPassphrase
 	cli.cmd = &cobra.Command{}
 	cli.cmd.SetIn(strings.NewReader("value"))
 	cli.cmd.SetOut(io.Discard)
@@ -400,11 +412,8 @@ func requireWaitsForLock(
 // TestChangingCommandsWaitForLock checks that each command that changes the
 // state directory waits for its lock.
 //
-//nolint:paralleltest // t.Setenv forbids parallel subtests
+//nolint:paralleltest // waitingForLock sees any test's command waiting for the lock
 func TestChangingCommandsWaitForLock(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
 	for _, tc := range []struct {
 		name         string
 		withUnlocker bool
@@ -468,15 +477,18 @@ func TestChangingCommandsWaitForLock(t *testing.T) {
 // TestEncryptWithExistingKeyTakesNoLock checks that secret encrypt with a
 // key that already exists, which only reads the state directory, finishes
 // while another command holds the state directory lock.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptWithExistingKeyTakesNoLock(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	mnemonic := testMnemonicBuffer(t)
 
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default")
+	_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic)
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("input"), 0o600))
 
 	encrypt := NewCLIInstanceWithStateDir(fs, testStateDir)
+	encrypt.Mnemonic = mnemonic
 	encrypt.cmd = &cobra.Command{}
 	encrypt.cmd.SetOut(io.Discard)
 
@@ -505,11 +517,11 @@ func TestEncryptWithExistingKeyTakesNoLock(t *testing.T) {
 // state directory lock by the time it writes its output. Holding it while
 // streaming would stall every other changing command for as long as the
 // stream lasts, and forever when the other end of the pipe is one of them.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptStreamsUnlocked(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default")
+	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("streamed"), 0o600))