Establish pass compatibility fixtures and behavioral harness #1

New Issue

hugo · 2026-08-09T18:54:45Z

hugo commented

2026-08-09 18:54:45 +00:00

Objective

Create the executable compatibility baseline for upstream pass and pass-otp before implementing behavior.

Scope

Pin the upstream password-store revision and pass-otp 1.2 behavior used by this milestone.
Add synthetic public and encrypted secret-key material, .gpg-id hierarchies, encrypted entries, nested stores, and Git repositories containing no real credentials.
Cover every first-party command, alias, option, prompt decision, exit status, filesystem result, encryption recipient result, and automatic Git commit relevant to the milestone.
Provide development-only fixture refresh instructions; production and application tests must not require pass, gpg, git, or another process.

Acceptance criteria

Fixtures can be consumed by upstream tools and crates/storage in both directions.
Tests prove failure as well as success behavior and do not weaken security checks.
Upstream GPL source or test code is not copied into the project.

Prerequisites

None.

## Objective Create the executable compatibility baseline for upstream `pass` and `pass-otp` before implementing behavior. ## Scope - Pin the upstream password-store revision and pass-otp 1.2 behavior used by this milestone. - Add synthetic public and encrypted secret-key material, `.gpg-id` hierarchies, encrypted entries, nested stores, and Git repositories containing no real credentials. - Cover every first-party command, alias, option, prompt decision, exit status, filesystem result, encryption recipient result, and automatic Git commit relevant to the milestone. - Provide development-only fixture refresh instructions; production and application tests must not require `pass`, `gpg`, `git`, or another process. ## Acceptance criteria - Fixtures can be consumed by upstream tools and `crates/storage` in both directions. - Tests prove failure as well as success behavior and do not weaken security checks. - Upstream GPL source or test code is not copied into the project. ## Prerequisites None.

hugo added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 18:54:45 +00:00

hugo added the enhancement label 2026-08-09 18:54:45 +00:00

hugo referenced this issue from a commit

2026-08-09 21:00:00 +00:00

Establish pass compatibility fixture harness (#1)

hugo commented

2026-08-09 21:00:23 +00:00

Implemented in commit 41e5636 (Establish pass compatibility fixture harness).

Implementation:

pinned password-store 1.7.4 / 1078f2514d579178d5df7042c6a790e9c9b731ad and pass-otp v1.2.0 / 1e9d10ca75ae1a8672a7f192809713463657778e, including the upstream 1.1.1 reported-version behavior;
added a pure-Rust refresh generator for synthetic armored/binary protected keys, OpenPGP entries, detached .gpg-id signatures, hierarchical/multi-recipient stores, and valid loose-object Git repository templates;
added 108 data-driven success/failure cases covering the milestone command surface, aliases, options, prompt decisions, statuses, filesystem/encryption effects, forbidden Git remote forms, and commit intent;
added reusable Rust materialization and validation support for exact plaintext, fingerprints, wrong-passphrase rejection, signatures, hashes, Git objects/refs, hostile layouts, and interrupted-write recipes;
documented development-only refresh/interoperability procedures. Runtime and automated tests invoke no pass, gpg, git, shell, OTP, or QR process.

Verification:

cargo test -p ironstorage --test compatibility_fixtures: 6 passed;
cargo fmt --all -- --check: passed;
RUSTFLAGS=-D warnings cargo check --workspace --all-targets: passed;
cargo clippy --workspace --all-targets -- -D warnings: passed;
cargo test --workspace: passed;
one-time disposable GnuPG audit imported both protected synthetic keys, decrypted every single- and multi-recipient entry byte-for-byte, and verified both .gpg-id signatures.

Implemented in commit 41e5636 (Establish pass compatibility fixture harness). Implementation: - pinned password-store 1.7.4 / 1078f2514d579178d5df7042c6a790e9c9b731ad and pass-otp v1.2.0 / 1e9d10ca75ae1a8672a7f192809713463657778e, including the upstream 1.1.1 reported-version behavior; - added a pure-Rust refresh generator for synthetic armored/binary protected keys, OpenPGP entries, detached .gpg-id signatures, hierarchical/multi-recipient stores, and valid loose-object Git repository templates; - added 108 data-driven success/failure cases covering the milestone command surface, aliases, options, prompt decisions, statuses, filesystem/encryption effects, forbidden Git remote forms, and commit intent; - added reusable Rust materialization and validation support for exact plaintext, fingerprints, wrong-passphrase rejection, signatures, hashes, Git objects/refs, hostile layouts, and interrupted-write recipes; - documented development-only refresh/interoperability procedures. Runtime and automated tests invoke no pass, gpg, git, shell, OTP, or QR process. Verification: - cargo test -p ironstorage --test compatibility_fixtures: 6 passed; - cargo fmt --all -- --check: passed; - RUSTFLAGS=-D warnings cargo check --workspace --all-targets: passed; - cargo clippy --workspace --all-targets -- -D warnings: passed; - cargo test --workspace: passed; - one-time disposable GnuPG audit imported both protected synthetic keys, decrypted every single- and multi-recipient entry byte-for-byte, and verified both .gpg-id signatures.

hugo closed this issue

2026-08-09 21:00:23 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#1