1.6 KiB
Secure password generation
PasswordGenerator owns pass generate semantics in crates/storage.
Production calls use OsRng; tests inject a deterministic cryptographic RNG.
Random bytes are converted to character indexes with fallible rejection
sampling, so arbitrary set sizes have no modulo bias and operating-system RNG
failure is reported before repository mutation.
The default is 25 characters from printable ASCII punctuation and
alphanumerics. --no-symbols selects ASCII letters and digits. A
GeneratorConfig may supply another Unicode character set and default length.
Lengths must be 1 through 4096. Sets must be nonempty and contain no duplicate
or control characters; rejecting duplicates prevents accidental weighting.
Normal generation uses the same overwrite decision and --force rules as
insert. --in-place requires an existing entry, decrypts it, replaces only the
bytes before its first newline, and preserves that newline and every following
byte exactly. The generated password is returned separately as redacted,
zeroizing data for typed terminal, clipboard, or QR presentation. Clipboard and
QR channels use the same storage-owned presentation service as show, so
generated plaintext is never printed for those modes.
The completed entry is encrypted for the nearest recipient policy and written
atomically. Embedded Git receives Add generated password for ... only after a
successful write. Decline, missing in-place targets, validation, randomness,
encryption, and commit failures leave the previous repository state intact;
commit failure uses the write-domain rollback path.