26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# Secure password generation
|
|
|
|
`PasswordGenerator` owns `pass generate` semantics in `crates/storage`.
|
|
Production calls use `OsRng`; tests inject a deterministic cryptographic RNG.
|
|
Random bytes are converted to character indexes with fallible rejection
|
|
sampling, so arbitrary set sizes have no modulo bias and operating-system RNG
|
|
failure is reported before repository mutation.
|
|
|
|
The default is 25 characters from printable ASCII punctuation and
|
|
alphanumerics. `--no-symbols` selects ASCII letters and digits. A
|
|
`GeneratorConfig` may supply another Unicode character set and default length.
|
|
Lengths must be 1 through 4096. Sets must be nonempty and contain no duplicate
|
|
or control characters; rejecting duplicates prevents accidental weighting.
|
|
|
|
Normal generation uses the same overwrite decision and `--force` rules as
|
|
insert. `--in-place` requires an existing entry, decrypts it, replaces only the
|
|
bytes before its first newline, and preserves that newline and every following
|
|
byte exactly. The generated password is returned separately as redacted,
|
|
zeroizing data for typed terminal, clipboard, or QR presentation.
|
|
|
|
The completed entry is encrypted for the nearest recipient policy and written
|
|
atomically. Embedded Git receives `Add generated password for ...` only after a
|
|
successful write. Decline, missing in-place targets, validation, randomness,
|
|
encryption, and commit failures leave the previous repository state intact;
|
|
commit failure uses the write-domain rollback path.
|