Read secret environment variables once per command, then unset them (closes #60)

init and vault create put the mnemonic into the process environment for
vault.CreateVault to read back, so every program they ran, gpg included,
inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read
at 13 places and never unset. Each command that may need them now reads
both once, in its RunE, into locked buffers on the CLI Instance, and
unsets them at once. The buffers are passed down: vault.CreateVault
takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and
the PGP, keychain and Secure Enclave unlocker constructors take both;
CreatePGPUnlocker sets them on the vault it loads through SetMnemonic
and SetUnlockPassphrase, new in VaultInterface. README warns against
both variables.

Model: opus-5-5

internal/secret/atomic_test.go

@@ -219,7 +219,7 @@ func newVaultWithSecret(
 ) *vault.Vault {
 	t.Helper()
 
-	vlt, err := vault.CreateVault(fs, stateDir, name)
+	vlt, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t))
 	require.NoError(t, err)
 
 	buffer := memguard.NewBufferFromBytes([]byte(value))
@@ -329,14 +329,14 @@ func TestRemoveDirAtomic(t *testing.T) {
 // named with 255 bytes, the most a file name may have, on the real
 // filesystem: the temporary directories they use must fit that limit too.
 func TestLongestNames(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	const longestName = 255
 
 	fs := afero.NewOsFs()
 	name := strings.Repeat("a", longestName)
 
-	vlt, err := vault.CreateVault(fs, t.TempDir(), name)
+	vlt, err := vault.CreateVault(fs, t.TempDir(), name, testMnemonicBuffer(t))
 	require.NoError(t, err)
 
 	value := memguard.NewBufferFromBytes([]byte("long"))
@@ -361,13 +361,13 @@ func TestLongestNames(t *testing.T) {
 // another vault, as a forced move between vaults does, and makes the last
 // step that completes the copy fail. The secret it was to replace must
 // still be there unchanged: it may go only once its replacement is whole.
-//
-//nolint:paralleltest // t.Setenv forbids t.Parallel
 func TestForcedCopyKeepsDestinationUntilReplaced(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	for _, tfs := range testFilesystems {
 		t.Run(tfs.name, func(t *testing.T) {
+			t.Parallel()
+
 			base, stateDir := tfs.open(t)
 			src := newVaultWithSecret(t, base, stateDir, "source", "new")
 			dest := newVaultWithSecret(t, base, stateDir, "dest", "old")
@@ -400,13 +400,13 @@ func TestForcedCopyKeepsDestinationUntilReplaced(t *testing.T) {
 // directory directly in secrets.d or in a versions directory. Those are
 // listed to find secrets and versions, so a temporary directory made there
 // would be listed while half-built, and one left by a crash would stay.
-//
-//nolint:paralleltest // t.Setenv forbids t.Parallel
 func TestTempDirsStayOutOfListings(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	for _, tfs := range testFilesystems {
 		t.Run(tfs.name, func(t *testing.T) {
+			t.Parallel()
+
 			base, stateDir := tfs.open(t)
 			newVaultWithSecret(t, base, stateDir, "default", "first")
 
@@ -419,6 +419,7 @@ func TestTempDirsStayOutOfListings(t *testing.T) {
 				return nil
 			}}
 			vlt := vault.NewVault(fs, stateDir, "default")
+			vlt.Mnemonic = testMnemonicBuffer(t)
 
 			value := memguard.NewBufferFromBytes([]byte("second"))
 			defer value.Destroy()
@@ -527,13 +528,13 @@ func TestVersionSaveFailureLeavesNothing(t *testing.T) {
 // unlocker again and checks, before each change this makes, that the file
 // naming the current one exists: a reader or a crash never finds it
 // missing.
-//
-//nolint:paralleltest // t.Setenv forbids t.Parallel
 func TestCurrentFilesNeverMissing(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	for _, tfs := range testFilesystems {
 		t.Run(tfs.name, func(t *testing.T) {
+			t.Parallel()
+
 			base, stateDir := tfs.open(t)
 			vlt := newVaultWithSecret(t, base, stateDir, testVaultName, "value")
 
@@ -625,11 +626,11 @@ func TestWriteFileAtomicTempFile(t *testing.T) {
 // anything, so that it never leaves a partial unlocker, nor breaks the one
 // it would replace.
 func TestPassphraseUnlockerGetsKeyFirst(t *testing.T) {
-	// No mnemonic, and no current unlocker to get the key from
-	t.Setenv(secret.EnvMnemonic, "")
+	t.Parallel()
 
+	// No mnemonic, and no current unlocker to get the key from
 	base := afero.NewMemMapFs()
-	_, err := vault.CreateVault(base, testVaultStateDir, testVaultName)
+	_, err := vault.CreateVault(base, testVaultStateDir, testVaultName, nil)
 	require.NoError(t, err)
 
 	fs := hookFs{Fs: base, before: func(_, path string) error {
@@ -650,17 +651,18 @@ func TestPassphraseUnlockerGetsKeyFirst(t *testing.T) {
 // creating a passphrase unlocker makes, that the unlocker's directory either
 // does not exist or holds all of its files: a crash or a failure at any point
 // leaves no partial unlocker.
-//
-//nolint:paralleltest // t.Setenv forbids t.Parallel
 func TestPassphraseUnlockerIsWholeOrAbsent(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	files := []string{"pub.age", privKeyFile, "longterm.age", unlockerMetadataFile}
 
 	for _, tfs := range testFilesystems {
 		t.Run(tfs.name, func(t *testing.T) {
+			t.Parallel()
+
 			base, stateDir := tfs.open(t)
-			vlt, err := vault.CreateVault(base, stateDir, testVaultName)
+			vlt, err := vault.CreateVault(base, stateDir, testVaultName,
+				testMnemonicBuffer(t))
 			require.NoError(t, err)
 
 			vaultDir, err := vlt.GetDirectory()
@@ -683,8 +685,10 @@ func TestPassphraseUnlockerIsWholeOrAbsent(t *testing.T) {
 			passphrase := memguard.NewBufferFromBytes([]byte(unlockerPassphrase))
 			defer passphrase.Destroy()
 
-			_, err = vault.NewVault(fs, stateDir, testVaultName).
-				CreatePassphraseUnlocker(passphrase)
+			hooked := vault.NewVault(fs, stateDir, testVaultName)
+			hooked.Mnemonic = vlt.Mnemonic
+
+			_, err = hooked.CreatePassphraseUnlocker(passphrase)
 			require.NoError(t, err)
 			assert.ElementsMatch(t, files, dirNames(t, base, unlockerDir))
 		})