tiers
tiers
¶
The passphrase-tier vocabulary — one registry, every derived subset.
Each tier is one place the vault's SQLCipher passphrase can live. The
enum's declaration order is the resolution-chain order that
resolve_passphrase_with_source
walks, and the traits table answers the questions the other modules
used to hard-code their own copies of: does the tier survive a reboot,
and can a value be landed on it programmatically?
Adding a tier is: one enum member, one traits row, one branch in each
of the resolver / prober / writer switchboards
(encryption,
provision_passphrase_tier).
The derived sets below propagate it everywhere else — chooser
vocabulary, --passphrase-tier validation, shadow detection, the
change-passphrase rewrite fan-out — by construction.
DURABLE_TIERS = frozenset(t for t in PassphraseTier if t.durable)
module-attribute
¶
PROVISIONABLE_TIERS = frozenset(t for t in PassphraseTier if t.provisionable)
module-attribute
¶
CHOOSER_TIERS = tuple(t for t in PassphraseTier if t.chooser_offered)
module-attribute
¶
__all__ = ['CHOOSER_TIERS', 'DURABLE_TIERS', 'PROVISIONABLE_TIERS', 'PassphraseTier', 'TierTraits']
module-attribute
¶
PassphraseTier
¶
Bases: StrEnum
Where the vault passphrase can live, in resolution-chain priority order.
A StrEnum so members compare, hash, and serialise as their
plain string values — status JSON, config knobs, and CLI arguments
all speak the same vocabulary without conversion shims.
SESSION_FILE = 'session-file'
class-attribute
instance-attribute
¶
Tmpfs session-unlock file — RAM-backed, cleared on reboot.
SYSTEMD_CREDS = 'systemd-creds'
class-attribute
instance-attribute
¶
Sealed machine-bound credential (TPM2 / host key); needs systemd ≥ 257.
KEYRING = 'keyring'
class-attribute
instance-attribute
¶
OS keyring entry, unlocked together with the login session.
PASSPHRASE_COMMAND = 'passphrase-command'
class-attribute
instance-attribute
¶
Operator-supplied helper command that prints the passphrase
(pass show …, bw get …, op read …, cloud secret CLIs).
PROMPT = 'prompt'
class-attribute
instance-attribute
¶
Interactive TTY entry — stores nothing, ever.
durable
property
¶
True iff the tier survives a reboot.
A volatile tier resolving on top of a durable one is shadowing it — the vault silently reads the copy that dies on the next boot.
provisionable
property
¶
True iff a value can be written into the tier programmatically.
passphrase-command is the counter-example: the secret lives
in a store the operator owns (pass / bitwarden / a cloud
secret manager), so the sandbox can read it but never write it.
prompt stores nothing at all.
chooser_offered
property
¶
True iff the interactive setup chooser lists the tier.
systemd-creds is deliberately not offered — it auto-selects
whenever the host supports it, so listing it would only add a
dead option to the menu.