From 031c5769103a6860b0e75baab1ecff237cc8cc28 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 04:10:42 +0200
Subject: [PATCH 01/12] enable tests on ubuntu 24, and add doas and argon2 to
 CI

also remove python2 from latest ubuntu as no more found

doas test is enabled only for latest
---
 .github/workflows/linux.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index a2a963f8..81d84a91 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -25,13 +25,24 @@ jobs:
   build-matrix:
     strategy:
       matrix:
-        os: [ubuntu-22.04, ubuntu-20.04]
+        os: [ubuntu-22.04, ubuntu-20.04, ubuntu-24.04]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Install tomb dependencies
         run: |
           sudo apt-get update -y -q
-          sudo apt-get install -y -q zsh cryptsetup gpg gawk libgcrypt20-dev steghide qrencode python2 python3-pip python3-dev libssl-dev make gcc sudo gettext bsdmainutils file pinentry-curses xxd libsodium23 libsodium-dev
+          sudo apt-get install -y -q zsh cryptsetup gpg gawk libgcrypt20-dev steghide qrencode python3-pip python3-dev libssl-dev make gcc sudo gettext bsdmainutils file pinentry-curses xxd libsodium23 libsodium-dev argon2
+      - name: Install python2 on ubuntu 20
+        if: matrix.os == 'ubuntu-20.04'
+        run: sudo apt-get install -y -q python2
+      - name: Install python2 on ubuntu 22
+        if: matrix.os == 'ubuntu-22.04'
+        run: sudo apt-get install -y -q python2
+      - name: Install doas where found
+        if: matrix.os == 'ubuntu-24.04'
+        run: |
+          sudo apt-get install -y -q opendoas
+          echo "permit nopass root" | sudo tee /etc/doas.conf
       - uses: actions/checkout@v3
       - name: Build the pbkdf2 extras
         run: |

From 79ce0bf348c1c9c6fca480294a9b5af08b2f49ae Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 04:39:03 +0200
Subject: [PATCH 02/12] add argon2 kdf test

---
 extras/test/30_kdf.sh | 29 ++++++++++++++++++++++++++++-
 extras/test/setup     |  1 +
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/extras/test/30_kdf.sh b/extras/test/30_kdf.sh
index f9bb329f..cb613f60 100644
--- a/extras/test/30_kdf.sh
+++ b/extras/test/30_kdf.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env zsh
 
-export test_description="Testing tomb with KDF key"
+export test_description="Testing tomb with KDF keys"
 
 source ./setup
 
@@ -28,4 +28,31 @@ if test_have_prereq KDF; then
         '
 fi
 
+# clean to avoid overwrite errors
+# rm -f "$tomb_key" "$tomb"
+
+if test_have_prereq ARGON2; then
+    test_export "argon2"
+    test_expect_success 'Testing KDF ARGON2: tomb creation' '
+        tt_dig -s 20 &&
+        tt_forge --tomb-pwd $DUMMYPASS --kdftype argon2 --kdfmem 18 --kdf 1 &&
+        print $DUMMYPASS \
+            | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
+            | xxd &&
+        tt_lock --tomb-pwd $DUMMYPASS --kdf 1
+        '
+
+    test_expect_success 'Testing KDF ARGON2: tomb passwd' '
+        tt passwd -k $tomb_key --kdf 1 \
+            --unsafe --tomb-old-pwd $DUMMYPASS --tomb-pwd $DUMMYPASSNEW &&
+        tt passwd -k $tomb_key --kdf 1 \
+            --unsafe --tomb-old-pwd $DUMMYPASSNEW --tomb-pwd $DUMMYPASS
+        '
+
+    test_expect_success 'Testing KDF ARGON2: tomb open & close' '
+        tt_open --tomb-pwd $DUMMYPASS --kdf 1 &&
+        tt_close
+        '
+fi
+
 test_done
diff --git a/extras/test/setup b/extras/test/setup
index a7ea7ea6..74c8bc4e 100755
--- a/extras/test/setup
+++ b/extras/test/setup
@@ -58,6 +58,7 @@ command -v decloakify > /dev/null && test_set_prereq DECLOAKIFY
 command -v sphinx > /dev/null && test_set_prereq SPHINX
 command -v oracle > /dev/null && test_set_prereq ORACLE
 command -v doas > /dev/null && test_set_prereq DOAS
+command -v argon2 > /dev/null && test_set_prereq ARGON2
 
 
 # GnuPG config

From 7ef972ba2885fe19127da859edac1b0d761f071b Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 04:51:16 +0200
Subject: [PATCH 03/12] kdf iterations need only to be specified when forging a
 key

the key header saves the key iteration set when forging
---
 extras/test/30_kdf.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/extras/test/30_kdf.sh b/extras/test/30_kdf.sh
index cb613f60..32628624 100644
--- a/extras/test/30_kdf.sh
+++ b/extras/test/30_kdf.sh
@@ -12,18 +12,18 @@ if test_have_prereq KDF; then
         print $DUMMYPASS \
             | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
             | xxd &&
-        tt_lock --tomb-pwd $DUMMYPASS --kdf 1
+        tt_lock --tomb-pwd $DUMMYPASS
         '
 
     test_expect_success 'Testing KDF: tomb passwd' '
-        tt passwd -k $tomb_key --kdf 1 \
+        tt passwd -k $tomb_key \
             --unsafe --tomb-old-pwd $DUMMYPASS --tomb-pwd $DUMMYPASSNEW &&
-        tt passwd -k $tomb_key --kdf 1 \
+        tt passwd -k $tomb_key \
             --unsafe --tomb-old-pwd $DUMMYPASSNEW --tomb-pwd $DUMMYPASS
         '
 
     test_expect_success 'Testing KDF: tomb open & close' '
-        tt_open --tomb-pwd $DUMMYPASS --kdf 1 &&
+        tt_open --tomb-pwd $DUMMYPASS &&
         tt_close
         '
 fi
@@ -39,18 +39,18 @@ if test_have_prereq ARGON2; then
         print $DUMMYPASS \
             | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
             | xxd &&
-        tt_lock --tomb-pwd $DUMMYPASS --kdf 1
+        tt_lock --tomb-pwd $DUMMYPASS
         '
 
     test_expect_success 'Testing KDF ARGON2: tomb passwd' '
-        tt passwd -k $tomb_key --kdf 1 \
+        tt passwd -k $tomb_key \
             --unsafe --tomb-old-pwd $DUMMYPASS --tomb-pwd $DUMMYPASSNEW &&
-        tt passwd -k $tomb_key --kdf 1 \
+        tt passwd -k $tomb_key \
             --unsafe --tomb-old-pwd $DUMMYPASSNEW --tomb-pwd $DUMMYPASS
         '
 
     test_expect_success 'Testing KDF ARGON2: tomb open & close' '
-        tt_open --tomb-pwd $DUMMYPASS --kdf 1 &&
+        tt_open --tomb-pwd $DUMMYPASS &&
         tt_close
         '
 fi

From 5998231788f91e6888f310dc61c46448fb9a022a Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 04:54:50 +0200
Subject: [PATCH 04/12] remove unused and old libsphinx support

steff seems to be moving towards new implementations and this was
never reported as used by anyone
---
 extras/install_sphinx.sh |  15 ------
 tomb                     | 102 ---------------------------------------
 2 files changed, 117 deletions(-)
 delete mode 100755 extras/install_sphinx.sh

diff --git a/extras/install_sphinx.sh b/extras/install_sphinx.sh
deleted file mode 100755
index c2323514..00000000
--- a/extras/install_sphinx.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-set -ex
-git clone https://github.com/stef/libsphinx 
-cd libsphinx
-git submodule update --init --recursive --remote
-cd src
-sed -i 's|/usr/local|/usr|' makefile
-make && make install && ldconfig
-cd ../..
-git clone https://github.com/stef/pwdsphinx
-cd pwdsphinx
-python3 setup.py install
-mkdir -p /etc/sphinx && cp ../test/sphinx.cfg /etc/sphinx/config && cd /etc/sphinx
-openssl req -new -x509 -nodes -out server.crt -keyout server.key -subj '/CN=localhost'
-sphinx init
diff --git a/tomb b/tomb
index addc150f..cbb953fe 100755
--- a/tomb
+++ b/tomb
@@ -61,7 +61,6 @@ typeset -i KDF=1
 typeset -i STEGHIDE=1
 typeset -i CLOAKIFY=1
 typeset -i DECLOAKIFY=1
-typeset -i SPHINX=1
 typeset -i RESIZER=1
 typeset -i RECOLL=1
 typeset -i QRENCODE=1
@@ -569,12 +568,6 @@ ask_password() {
 		return 1
 	}
 
-	# if sphinx mode is chosen, use the provided input
-	# as master password to retrieve the actual password
-	if option_is_set --sphx-user || option_is_set --sphx-host; then
-		password=$(sphinx_get_password "$password")
-	fi
-
 	[[ -z $password ]] && {
 		_warning "Empty password"
 		print "empty"
@@ -585,65 +578,6 @@ ask_password() {
 	return 0
 }
 
-# Retrieve PASSWORD from sphinx
-# $1 MASTER password for the password store
-# requires --sphx-host and --sphx-user flags to be set
-sphinx_get_password() {
-	local errorfile
-	local password
-	if option_is_set --sphx-user && option_is_set --sphx-host; then
-		# value error in sphinx doesn't set exit code
-		# using tempfile as a workaround to notice the error
-		errorfile=$(mktemp /tmp/tomb_error.XXXXXXXXX)
-		password=$(echo "$1" | sphinx get $(option_value --sphx-user) $(option_value --sphx-host) 2>$errorfile)
-		if  ! grep -q "ValueError: fail" $errorfile ; then
-			echo "$password"
-			rm $errorfile
-			return 0
-		else
-			_warning "sphinx returns error: ::1 error::" $(cat $errorfile)
-			rm $errorfile
-			_failure "Failed to retrieve actual password with sphinx."
-		fi
-	else
-		_failure "Both host and user have to be set to use sphinx"
-	fi
-}
-
-# Create PASSWORD in sphinx
-# $1 MASTER password for the password store
-# requires --sphx-host and --sphx-user flags to be set
-sphinx_set_password() {
-	local errorfile
-	local password
-	if option_is_set --sphx-user && option_is_set --sphx-host; then
-		# value error in sphinx doesn't set exit code
-		# using tempfile as a workaround to notice the error
-		errorfile=$(mktemp /tmp/tomb_error.XXXXXXXXX)
-		# check first if this host/user combination exists in store
-		# if yes, there is no need to make a call to create
-		password=$(echo "$1" | sphinx get $(option_value --sphx-user) $(option_value --sphx-host) 2>$errorfile)
-		if  ! grep -q "error: sphinx protocol failure" $errorfile ; then
-			echo "$password"
-			rm $errorfile
-			return 0
-		fi
-		# no such host/user combination in store, create one
-		password=$(echo "$1" | sphinx create $(option_value --sphx-user) $(option_value --sphx-host) ulsd 0 2>$errorfile)
-		if  ! grep -q "error: sphinx protocol failure" $errorfile ; then
-			echo "$password"
-			rm $errorfile
-			return 0
-		else
-			_warning "sphinx returns error: ::1 error::" $(cat $errorfile)
-			rm $errorfile
-			_failure "Failed to create password with sphinx"
-		fi
-	else
-		_failure "Both host and user have to be set to use sphinx"
-	fi
-}
-
 # Check if a filename is a valid tomb
 is_valid_tomb() {
 
@@ -818,11 +752,6 @@ usage() {
 	_print " -R           provide GnuPG hidden recipients (separated by comma)"
 	_print " --sudo       super user exec alternative to sudo (doas or none)"
 
-	[[ $SPHINX == 1 ]] && {
-		_print " --sphx-user  user associated with the key (for use with pitchforkedsphinx)"
-		_print " --sphx-host  host associated with the key (for use with pitchforkedsphinx)"
-	}
-
 	[[ $KDF == 1 ]] && {
 		_print " --kdf        forge keys armored against dictionary attacks"
 	}
@@ -1025,8 +954,6 @@ _ensure_dependencies() {
 	command -v cloakify 1>/dev/null 2>/dev/null || CLOAKIFY=0
 	# Check for decloakify
 	command -v decloakify 1>/dev/null 2>/dev/null || DECLOAKIFY=0
-	# Check for pitchforkedsphinx client
-	command -v sphinx 1>/dev/null 2>/dev/null || SPHINX=0
 	# Check for resize
 	command -v resize2fs 1>/dev/null 2>/dev/null || RESIZER=0
 	# Check for KDF auxiliary tools
@@ -1385,12 +1312,6 @@ ask_key_password() {
 		tombpass="$1"
 		_verbose "ask_key_password with tombpass: ::1 tomb pass::" $tombpass
 
-		# if sphinx mode is chosen, use the provided input
-		# as master password to retrieve the actual password
-		if option_is_set --sphx-user || option_is_set --sphx-host; then
-			tombpass=$(sphinx_get_password "$tombpass")
-		fi
-
 		get_lukskey "$tombpass"
 
 		[[ $? = 0 ]] && {
@@ -1488,16 +1409,6 @@ gen_key() {
 	tombpass=""
 	tombpasstmp=""
 
-	# remove sphinx opts not to mess with initial password prompt
-	option_is_set --sphx-user && {
-		sphx_user_tmp="$(option_value --sphx-user)"
-		unset "OPTS[--sphx-user]"
-	}
-	option_is_set --sphx-host && {
-		sphx_host_tmp="$(option_value --sphx-host)"
-		unset "OPTS[--sphx-host]"
-	}
-
 	if option_is_set -g; then
 		gpgopt=(--encrypt)
 
@@ -1558,19 +1469,6 @@ gen_key() {
 			_verbose "gen_key takes tombpass from CLI argument: ::1 tomb pass::" $tombpass
 		fi
 
-		# if sphinx mode is chosen, use the provided input
-		# as master password to generate the actual password
-		if [[ ! -z $sphx_host_tmp ]] || [[ ! -z $sphx_user_tmp ]]; then
-			OPTS[--sphx-user]=$sphx_user_tmp
-			OPTS[--sphx-host]=$sphx_host_tmp
-			unset sphx_user_tmp
-			unset sphx_host_tmp
-			tombpass=$(sphinx_set_password "$tombpass")
-			if [[ $? != 0 ]]; then
-				_failure "User aborted."
-			fi
-		fi
-
 		header=""
 		[[ $KDF == 1 ]] && {
 			{ option_is_set --kdf } && {

From bfd2ca443b127e06aca3d7c5ea3f2c631aa1f853 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 05:18:03 +0200
Subject: [PATCH 05/12] remove sphinx from tests and docs

leftover strings are in translations, maybe take them off later
---
 doc/tomb.1                   | 29 -----------------------------
 extras/test/00_create.sh     | 12 ------------
 extras/test/10_operations.sh |  8 --------
 extras/test/60_resize.sh     | 15 ++++-----------
 extras/test/65_passwd.sh     | 12 ------------
 extras/test/90_setkey.sh     | 19 -------------------
 extras/test/setup            |  6 ------
 extras/test/sphinx.cfg       | 15 ---------------
 8 files changed, 4 insertions(+), 112 deletions(-)
 delete mode 100644 extras/test/sphinx.cfg

diff --git a/doc/tomb.1 b/doc/tomb.1
index fd86025f..f3c0ca72 100644
--- a/doc/tomb.1
+++ b/doc/tomb.1
@@ -306,17 +306,6 @@ Select a different tool than sudo for privilege escalation.
 Alternatives supported so far are: pkexec, doas, sup, sud. For any
 alternative to work the executable must be included in the current
 PATH.
-.B
-.IP "--sphx-user \fI<username>\fR"
-Activate the SPHINX feature for password-authenticated key agreement.
-This option indicates the \fI<username>\fR used to retrieve the
-password from a sphinx oracle key reachable via TCP/IP.
-.B
-.IP "--sphx-host \fI<domain>\fR"
-Activate the SPHINX feature for password-authenticated key agreement.
-This option indicates the \fI<domain>\fR used to retrieve the password
-from a sphinx oracle daemon reachable via TCP/IP. This is not the
-network address of the daemon, which is configured in /etc/sphinx
 
 .B
 .IP "-h"
@@ -484,24 +473,6 @@ its copies are destroyed. The \fI-r\fR option can be used in the tomb
 commands: \fIopen\fR, \fIforge\fR \fIsetkey\fR, \fIpasswd\fR,
 \fIbury\fR, \fIexhume\fR and \fIresize\fR.
 
-.SH SPHINX (PAKE)
-
-Using the package libsphinx
-.UR https://github.com/stef/libsphinx
-.UE
-and its python client/daemon implementation pwdsphinx
-.UR https://github.com/stef/pwdsphinx
-.UE
-is possible to store and retrieve safely the password that locks the
-tomb. Using this feature will make it impossible to retrieve the
-password without the oracle sphinx server running and reachable. Each
-key entry needs a username and a domain specified on creation and
-a password that locks it.
-
-SPHINX makes it impossible to maliciously retrieve the password
-locking the tomb key without an attacker accessing both the
-server, the sphinx password and the tomb key file.
-
 .SH EXAMPLES
 
 .IP \(bu
diff --git a/extras/test/00_create.sh b/extras/test/00_create.sh
index 1aae78f4..74351cf3 100644
--- a/extras/test/00_create.sh
+++ b/extras/test/00_create.sh
@@ -15,18 +15,6 @@ test_expect_success 'Testing tomb creation: dig, forge and lock' '
     tt_lock --tomb-pwd $DUMMYPASS
     '
 
-if test_have_prereq SPHINX ORACLE; then
-	test_export "sphinx_test"
-	test_expect_success 'Testing tomb creation: dig, forge and lock (sphinx password handling)' '
-        tt_dig -s 20 &&
-        tt_forge --tomb-pwd $DUMMYPASS --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST &&
-        print $(echo $DUMMYPASS | sphinx get $DUMMYUSER $DUMMYHOST) \
-            | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
-            | xxd &&
-        tt_lock --tomb-pwd $DUMMYPASS --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST
-        '
-fi
-
 if test_have_prereq DOAS; then
     test_export "doas_test"
     test_expect_success 'Testing tomb creation: dig, forge and lock (using doas instead of sudo)' '
diff --git a/extras/test/10_operations.sh b/extras/test/10_operations.sh
index c9b1be93..53242319 100644
--- a/extras/test/10_operations.sh
+++ b/extras/test/10_operations.sh
@@ -44,14 +44,6 @@ if test_have_prereq LSOF; then
         '
 fi
 
-if test_have_prereq SPHINX ORACLE; then
-    test_export "sphinx_test" # Using already generated tomb
-    test_expect_success 'Testing open with good password (sphinx)' '
-        tt_open --tomb-pwd $DUMMYPASS --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST &&
-        tt_close
-        '
-fi
-
 if test_have_prereq DOAS; then
     test_export "doas_test" # Using already generated tomb
     test_expect_success 'Testing open with good password (using doas instead of sudo)' '
diff --git a/extras/test/60_resize.sh b/extras/test/60_resize.sh
index 3c430c19..baaff317 100644
--- a/extras/test/60_resize.sh
+++ b/extras/test/60_resize.sh
@@ -5,24 +5,17 @@ export test_description="Testing tomb resize feature"
 source ./setup
 
 if test_have_prereq RESIZER; then
-    test_export "test" # Using already generated tomb
-    test_expect_success 'Testing resize to 30 MB tomb' '
+  test_export "test" # Using already generated tomb
+  test_expect_success 'Testing resize to 30 MB tomb' '
         tt resize -s 30 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
         '
-if test_have_prereq GPGRCPT; then
+  if test_have_prereq GPGRCPT; then
     test_export "recipient" # Using already generated tomb
     test_expect_success 'Testing resize to 30 MB tomb with GnuPG keys' '
         tt resize -s 30 $tomb -k $tomb_key -g -r $KEY2
         '
-fi
+  fi
 
 fi # RESIZER
 
-if test_have_prereq RESIZER SPHINX ORACLE; then 
-       test_export "sphinx_test" # Using already generated tomb
-       test_expect_success 'Testing resize to 30 MB tomb (sphinx)' '
-        tt resize -s 30 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST
-        '
-fi
-
 test_done
diff --git a/extras/test/65_passwd.sh b/extras/test/65_passwd.sh
index dca1ce36..55f5c3b3 100644
--- a/extras/test/65_passwd.sh
+++ b/extras/test/65_passwd.sh
@@ -21,16 +21,4 @@ test_expect_success 'Testing tomb with GnuPG keys: passwd' '
 
 fi
 
-if test_have_prereq SPHINX ORACLE; then 
-       test_export "sphinx_test" # Using already generated tomb
-       test_expect_success 'Testing changing tomb password with sphinx' '
-           tt passwd -f -k $tomb_key --unsafe \
-               --tomb-old-pwd $DUMMYPASS --tomb-pwd $DUMMYPASSNEW \
-               --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST &&
-           tt passwd -f -k $tomb_key --unsafe \
-               --tomb-old-pwd $DUMMYPASSNEW --tomb-pwd $DUMMYPASS \
-               --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST
-           '
-fi
-
 test_done
diff --git a/extras/test/90_setkey.sh b/extras/test/90_setkey.sh
index b91d6288..2ccfafc3 100755
--- a/extras/test/90_setkey.sh
+++ b/extras/test/90_setkey.sh
@@ -28,23 +28,4 @@ test_expect_success 'Testing tomb with GnuPG keys: setkey' '
     '
 fi
 
-if test_have_prereq SPHINX ORACLE; then 
-    test_export "sphinx_test" # Using already generated tomb
-    test_expect_success 'Testing set key (sphinx)' '
-        tt forge -f -k $tomb_key_new --tomb-pwd $DUMMYPASS \
-            --ignore-swap --unsafe --force \
-            --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST &&
-        tt setkey -f -k $tomb_key_new $tomb_key $tomb \
-            --unsafe --tomb-pwd $DUMMYPASS --tomb-old-pwd $DUMMYPASS \
-            --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST &&
-        tt open -f -k $tomb_key_new $tomb \
-            --unsafe --tomb-pwd $DUMMYPASS \
-            --sphx-user $DUMMYUSER --sphx-host $DUMMYHOST &&
-        print $DUMMYPASS \
-            | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key_new \
-            | xxd &&
-        tt_close
-        '
-fi
-
 test_done
diff --git a/extras/test/setup b/extras/test/setup
index 74c8bc4e..b4705b50 100755
--- a/extras/test/setup
+++ b/extras/test/setup
@@ -55,8 +55,6 @@ command -v lsof > /dev/null && test_set_prereq LSOF
 command -v python3 > /dev/null && test_set_prereq PYTHON3
 command -v cloakify > /dev/null && test_set_prereq CLOAKIFY
 command -v decloakify > /dev/null && test_set_prereq DECLOAKIFY
-command -v sphinx > /dev/null && test_set_prereq SPHINX
-command -v oracle > /dev/null && test_set_prereq ORACLE
 command -v doas > /dev/null && test_set_prereq DOAS
 command -v argon2 > /dev/null && test_set_prereq ARGON2
 
@@ -80,10 +78,6 @@ fi
 export DUMMYPASS=test
 export DUMMYPASSNEW=changetest
 
-# Dummy host and username for sphinx
-export DUMMYHOST=example.com
-export DUMMYUSER=user
-
 
 # Test helpers
 
diff --git a/extras/test/sphinx.cfg b/extras/test/sphinx.cfg
deleted file mode 100644
index 19437223..00000000
--- a/extras/test/sphinx.cfg
+++ /dev/null
@@ -1,15 +0,0 @@
-[client]
-verbose = False
-address = 127.0.0.1
-port = 2355
-datadir = /tmp/.sphinx/
-ssl_cert = /etc/sphinx/server.crt
-
-[server]
-verbose = False
-address = 127.0.0.1
-port = 2355
-datadir = /tmp/.sphinx/
-keydir = /tmp/.sphinx/
-ssl_cert = /etc/sphinx/server.crt
-ssl_key = /etc/sphinx/server.key

From b70da3d628350ca20eaefea0122bf13b26981782 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 05:38:45 +0200
Subject: [PATCH 06/12] improve readability of code in some complex branching
 points

avoid usage of if...elif...elif...else in some points, substituted
with while true; do ... done loops and break statements on success.
---
 tomb | 176 ++++++++++++++++++++++++++++++-----------------------------
 1 file changed, 89 insertions(+), 87 deletions(-)

diff --git a/tomb b/tomb
index cbb953fe..08e5e843 100755
--- a/tomb
+++ b/tomb
@@ -500,56 +500,54 @@ ask_password() {
 
 	pass_asked=0
 
-	if [[ ! -z $WAYLAND_DISPLAY ]]; then
-		_verbose "wayland display detected"
-		_is_found "pinentry-gnome3" && {
-			_verbose "using pinentry-gnome3 on wayland"
-			output=$(pinentry_assuan_getpass | pinentry-gnome3)
-			pass_asked=1
+	while true; do
+		[[ ! -z $WAYLAND_DISPLAY ]] && {
+			_verbose "wayland display detected"
+			_is_found "pinentry-gnome3" && {
+				_verbose "using pinentry-gnome3 on wayland"
+				output=$(pinentry_assuan_getpass | pinentry-gnome3)
+				break; }
+			# TODO: pinentry on KDE running in wayland?
+		}
+		[[ ! -z $DISPLAY ]] && [[ $pass_asked == 0 ]] && {
+			_verbose "X11 display detected"
+			_is_found "pinentry-gtk-2" && {
+				_verbose "using pinentry-gtk2"
+				output=$(pinentry_assuan_getpass | pinentry-gtk-2)
+				break; }
+			_is_found "pinentry-x11" && {
+				_verbose "using pinentry-x11"
+				output=$(pinentry_assuan_getpass | pinentry-x11)
+				break; }
+			_is_found "pinentry-gnome3" && {
+				_verbose "using pinentry-gnome3 on X11"
+				output=$(pinentry_assuan_getpass | pinentry-gnome3)
+				break; }
+			_is_found "pinentry-qt5" && {
+				_verbose "using pinentry-qt5"
+				output=$(pinentry_assuan_getpass | pinentry-qt5)
+				break; }
+			_is_found "pinentry-qt4" && {
+				_verbose "using pinentry-qt4"
+				output=$(pinentry_assuan_getpass | pinentry-qt4)
+				break; }
 		}
-	fi
-	if [[ ! -z $DISPLAY ]] && [[ $pass_asked == 0 ]]; then
-		_verbose "X11 display detected"
-		if _is_found "pinentry-gtk-2"; then
-			_verbose "using pinentry-gtk2"
-			output=$(pinentry_assuan_getpass | pinentry-gtk-2)
-			pass_asked=1
-		elif _is_found "pinentry-x11"; then
-			_verbose "using pinentry-x11"
-			output=$(pinentry_assuan_getpass | pinentry-x11)
-			pass_asked=1
-		elif _is_found "pinentry-gnome3"; then
-			_verbose "using pinentry-gnome3 on X11"
-			output=$(pinentry_assuan_getpass | pinentry-gnome3)
-			pass_asked=1
-		elif _is_found "pinentry-qt5"; then
-			_verbose "using pinentry-qt5"
-			output=$(pinentry_assuan_getpass | pinentry-qt5)
-			pass_asked=1
-		elif _is_found "pinentry-qt4"; then
-			_verbose "using pinentry-qt4"
-			output=$(pinentry_assuan_getpass | pinentry-qt4)
-			pass_asked=1
-		fi
-	fi
-	if [[ $pass_asked == 0 ]]; then
 		_verbose "no display detected"
-		if _is_found "pinentry-curses"; then
+		_is_found "pinentry-curses" && {
 			_verbose "using pinentry-curses with no display"
 			output=$(pinentry_assuan_getpass | pinentry-curses)
-			pass_asked=1
-		elif _is_found "pinentry-tty"; then
+			break; }
+		_is_found "pinentry-tty" && {
 			_verbose "using pinentry-tty with no display"
 			output=$(pinentry_assuan_getpass | pinentry-tty)
-			pass_asked=1
-    else
-      # TODO: fallback to asking password using read
-		  _failure "Cannot find any pinentry and no DISPLAY detected."
-    fi
-	fi
-
-	[[ $pass_asked == 0 ]] &&
+			break; }
+		# TODO: fallback using read -s - and beware
+		# using read with or without -r may break
+		# passwords, so this must be covered by a test
+		# for compatibility
 		_failure "Cannot find any pinentry and no DISPLAY detected."
+		exit 1
+	done
 
 	# parse the pinentry output
 	local pinentry_error
@@ -589,26 +587,23 @@ is_valid_tomb() {
 	local _fail=0
 	# Tomb file must be a readable, writable, non-empty regular file.
 	# If passed the "ro" mount option, the writable check is skipped.
-	option_value_contains -o ro || {
-		[[ ! -w "$1" ]] && {
-			_warning "Tomb file is not writable: ::1 tomb file::" $1
-			_fail=1
+	while true; do
+		option_value_contains -o ro || {
+			[[ ! -w "$1" ]] && {
+				_warning "Tomb file is not writable: ::1 tomb file::" $1
+				_fail=1; break; }
 		}
-	}
-	_verbose "tomb file is readable"
-
-	[[ ! -f "$1" ]] && {
-		_warning "Tomb file is not a regular file: ::1 tomb file::" $1
-		_fail=1
-	}
-	_verbose "tomb file is a regular file"
-
-	[[ ! -s "$1" ]] && {
-		_warning "Tomb file is empty (zero length): ::1 tomb file::" $1
-		_fail=1
-	}
-	_verbose "tomb file is not empty"
-
+		_verbose "tomb file is readable"
+		[[ ! -f "$1" ]] && {
+			_warning "Tomb file is not a regular file: ::1 tomb file::" $1
+			_fail=1; break; }
+		_verbose "tomb file is a regular file"
+		[[ ! -s "$1" ]] && {
+			_warning "Tomb file is empty (zero length): ::1 tomb file::" $1
+			_fail=1; break; }
+		_verbose "tomb file is not empty"
+		break;
+	done
 	[[ $_fail == 1 ]] && {
 		_failure "Tomb command failed: ::1 command name::" $subcommand
 	}
@@ -922,12 +917,12 @@ _ensure_dependencies() {
 		command -v $req 1>/dev/null 2>/dev/null || {
 			_failure "Missing required dependency ::1 command::.  Please install it." $req; }
 	done
-  # Check for pinentry or at least pinentry-tty (which has no alias)
-  if ! command -v pinentry 1>/dev/null 2>/dev/null; then
-    if ! command -v pinentry-tty 1>/dev/null 2>/dev/null; then
+	# Check for pinentry or at least pinentry-tty (which has no alias)
+	if ! command -v pinentry 1>/dev/null 2>/dev/null; then
+		if ! command -v pinentry-tty 1>/dev/null 2>/dev/null; then
 			_failure "Missing required dependency ::1 command::.  Please install it." pinentry
-    fi
-  fi
+		fi
+	fi
 	# Ensure system binaries are available in the PATH
 	path+=(/sbin /usr/sbin) # zsh magic
 
@@ -1101,24 +1096,27 @@ _load_key() {
 	[[ -z $keyfile ]] && {
 		_failure "This operation requires a key file to be specified using the -k option." }
 
-	if [[ $keyfile == "-" ]]; then
-		_verbose "load_key reading from stdin."
-		_message "Waiting for the key to be piped from stdin... "
-		TOMBKEYFILE=stdin
-		TOMBKEY=$(cat)
-	elif [[ $keyfile == "cleartext" ]]; then
-		_verbose "load_key reading SECRET from stdin"
-		_message "Waiting for the key to be piped from stdin... "
-		TOMBKEYFILE=cleartext
-		TOMBKEY=cleartext
-		TOMBSECRET=$(cat)
-	else
+	while true; do
+		[[ $keyfile == "-" ]] && {
+			_verbose "load_key reading from stdin."
+			_message "Waiting for the key to be piped from stdin... "
+			TOMBKEYFILE=stdin
+			TOMBKEY=$(cat)
+			break; }
+		[[ $keyfile == "cleartext" ]] && {
+			_verbose "load_key reading SECRET from stdin"
+			_message "Waiting for the key to be piped from stdin... "
+			TOMBKEYFILE=cleartext
+			TOMBKEY=cleartext
+			TOMBSECRET=$(cat)
+			break; }
 		_verbose "load_key argument: ::1 key file::" $keyfile
 		[[ -r $keyfile ]] || _failure "Key not found, specify one using -k."
 		_track_stat "$keyfile"
 		TOMBKEYFILE=$keyfile
 		TOMBKEY="${mapfile[$TOMBKEYFILE]}"
-	fi
+		break
+	done
 
 	_verbose "load_key: ::1 key::" $TOMBKEYFILE
 
@@ -2520,14 +2518,18 @@ exec_safe_bind_hooks() {
 			for dir in ${mounted}; do _sudo umount $dir; done
 			return 0 }
 
-		if [[ ! -r "$HOME/${maps[$dir]}" ]]; then
-			_warning "bind-hook target not existent, skipping ::1 home::/::2 subdir::" $HOME ${maps[$dir]}
-		elif [[ ! -r "$mnt/$dir" ]]; then
-			_warning "bind-hook source not found in tomb, skipping ::1 mount point::/::2 subdir::" $mnt $dir
-		else
-			_sudo mount -o bind,$MOUNTOPTS $mnt/$dir $HOME/${maps[$dir]} \
+		while true; do
+			[[ ! -r "$mnt/$dir" ]] && {
+				_warning "bind-hook source not found in tomb, skipping ::1 mount point::/::2 subdir::" $mnt $dir
+				break; }
+			[[ ! -r "$HOME/${maps[$dir]}" ]] && {
+				_warning "bind-hook target not existent, skipping ::1 home::/::2 subdir::" $HOME ${maps[$dir]}
+				break; }
+			_sudo mount -o bind,$MOUNTOPTS \
+			      $mnt/$dir $HOME/${maps[$dir]} \
 				&& mounted+=("$HOME/${maps[$dir]}")
-		fi
+			break
+		done
 	done
 }
 

From af1e7de17aadceb05d12ceefb0336dc0c5cb49d5 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 05:47:30 +0200
Subject: [PATCH 07/12] test btrfs tomb

---
 extras/test/00_create.sh | 22 ++++++++++++++++++++++
 extras/test/setup        |  1 +
 tomb                     |  6 +++---
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/extras/test/00_create.sh b/extras/test/00_create.sh
index 74351cf3..ca0c453c 100644
--- a/extras/test/00_create.sh
+++ b/extras/test/00_create.sh
@@ -27,4 +27,26 @@ if test_have_prereq DOAS; then
         '
 fi
 
+if test_have_prereq BTRFS; then
+    test_export "create_btrfs"
+    test_expect_success 'Testing tomb creation using BTRFS filesystem' '
+    tt_dig -s 50 &&
+    tt_forge --tomb-pwd $DUMMYPASS &&
+    print $DUMMYPASS \
+        | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
+        | xxd &&
+    tt_lock --tomb-pwd $DUMMYPASS --filesystem btrfs
+    '
+
+    test_export "create_btrfsmixed"
+    test_expect_success 'Testing tomb creation using BTRFS mixedmode filesystem' '
+    tt_dig -s 20 &&
+    tt_forge --tomb-pwd $DUMMYPASS &&
+    print $DUMMYPASS \
+        | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
+        | xxd &&
+    tt_lock --tomb-pwd $DUMMYPASS --filesystem btrfsmixedmode
+    '
+fi
+
 test_done
diff --git a/extras/test/setup b/extras/test/setup
index b4705b50..91b5f5b7 100755
--- a/extras/test/setup
+++ b/extras/test/setup
@@ -57,6 +57,7 @@ command -v cloakify > /dev/null && test_set_prereq CLOAKIFY
 command -v decloakify > /dev/null && test_set_prereq DECLOAKIFY
 command -v doas > /dev/null && test_set_prereq DOAS
 command -v argon2 > /dev/null && test_set_prereq ARGON2
+command -v mkfs.btrfs > /dev/null && test_set_prereq BTRFS
 
 
 # GnuPG config
diff --git a/tomb b/tomb
index 08e5e843..db22c8fc 100755
--- a/tomb
+++ b/tomb
@@ -2065,7 +2065,7 @@ lock_tomb_with_key() {
 	_verbose "Tomb found: ::1 tomb path::" $TOMBPATH
 
 	local filesystem=ext4
-    option_is_set --filesystem && {
+	option_is_set --filesystem && {
 		filesystem=`option_value --filesystem`
 		local tombsize=`stat --format '%s' $tombpath`
 		case $filesystem in
@@ -2074,13 +2074,13 @@ lock_tomb_with_key() {
 			btrfs)
 				if [[ $tombsize -lt 49283072 ]]; then
 					_failure "Filesystem ::1 filesystem:: not supported on tombs smaller than 47MB." \
-						$filesystem
+						 $filesystem
 				fi
 				;;
 			btrfsmixedmode)
 				if [[ $tombsize -lt 18874368 ]]; then
 					_failure "Filesystem ::1 filesystem:: not supported on tombs smaller than 18MB." \
-						$filesystem
+						 $filesystem
 				fi
 				;;
 			*)

From 8ea0ab96e497509ea59e35d439b6430da0ec34f7 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 05:53:47 +0200
Subject: [PATCH 08/12] elevate minimum size permitted for btrfs filesystem

---
 extras/test/00_create.sh |  2 +-
 tomb                     | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/extras/test/00_create.sh b/extras/test/00_create.sh
index ca0c453c..5794af99 100644
--- a/extras/test/00_create.sh
+++ b/extras/test/00_create.sh
@@ -30,7 +30,7 @@ fi
 if test_have_prereq BTRFS; then
     test_export "create_btrfs"
     test_expect_success 'Testing tomb creation using BTRFS filesystem' '
-    tt_dig -s 50 &&
+    tt_dig -s 120 &&
     tt_forge --tomb-pwd $DUMMYPASS &&
     print $DUMMYPASS \
         | gpg --batch --passphrase-fd 0 --no-tty --no-options -d $tomb_key \
diff --git a/tomb b/tomb
index db22c8fc..a86f72b2 100755
--- a/tomb
+++ b/tomb
@@ -2072,15 +2072,15 @@ lock_tomb_with_key() {
 			ext3|ext4) ;;
 			ext3maxinodes|ext4maxinodes) ;;
 			btrfs)
-				if [[ $tombsize -lt 49283072 ]]; then
-					_failure "Filesystem ::1 filesystem:: not supported on tombs smaller than 47MB." \
-						 $filesystem
+				if [[ $tombsize -lt 114294784 ]]; then
+					_failure "Filesystem ::1 filesystem:: not supported on tombs smaller than ::2 size::" \
+						 $filesystem "114MB"
 				fi
 				;;
 			btrfsmixedmode)
 				if [[ $tombsize -lt 18874368 ]]; then
-					_failure "Filesystem ::1 filesystem:: not supported on tombs smaller than 18MB." \
-						 $filesystem
+					_failure "Filesystem ::1 filesystem:: not supported on tombs smaller than ::2 size::" \
+						 $filesystem "18MB"
 				fi
 				;;
 			*)

From 9959850554e40abe992748aa6fa2857afb9db45a Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 05:59:48 +0200
Subject: [PATCH 09/12] test btrfs tomb resize

---
 extras/test/00_create.sh |  4 ++--
 extras/test/60_resize.sh | 12 ++++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/extras/test/00_create.sh b/extras/test/00_create.sh
index 5794af99..d82d8160 100644
--- a/extras/test/00_create.sh
+++ b/extras/test/00_create.sh
@@ -28,7 +28,7 @@ if test_have_prereq DOAS; then
 fi
 
 if test_have_prereq BTRFS; then
-    test_export "create_btrfs"
+    test_export "btrfs"
     test_expect_success 'Testing tomb creation using BTRFS filesystem' '
     tt_dig -s 120 &&
     tt_forge --tomb-pwd $DUMMYPASS &&
@@ -38,7 +38,7 @@ if test_have_prereq BTRFS; then
     tt_lock --tomb-pwd $DUMMYPASS --filesystem btrfs
     '
 
-    test_export "create_btrfsmixed"
+    test_export "btrfsmixed"
     test_expect_success 'Testing tomb creation using BTRFS mixedmode filesystem' '
     tt_dig -s 20 &&
     tt_forge --tomb-pwd $DUMMYPASS &&
diff --git a/extras/test/60_resize.sh b/extras/test/60_resize.sh
index baaff317..75808cdd 100644
--- a/extras/test/60_resize.sh
+++ b/extras/test/60_resize.sh
@@ -18,4 +18,16 @@ if test_have_prereq RESIZER; then
 
 fi # RESIZER
 
+if test_have_prereq BTRFS; then
+    test_export "btrfs"
+    test_expect_success 'Testing resize using BTRFS filesystem' '
+        tt resize -s 150 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
+        '
+
+    test_export "btrfsmixed"
+    test_expect_success 'Testing resize using BTRFS filesystem' '
+        tt resize -s 30 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
+        '
+fi
+
 test_done

From a0d3a3cfb6c6a5f69f848b164432a4e2d26a5809 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 14:25:26 +0200
Subject: [PATCH 10/12] correct error message typo in resize (and in all
 translations)

---
 extras/translations/de.po      | 2 +-
 extras/translations/es.po      | 2 +-
 extras/translations/fi.po      | 2 +-
 extras/translations/fr.po      | 2 +-
 extras/translations/it.po      | 2 +-
 extras/translations/pt_BR.po   | 2 +-
 extras/translations/ru.po      | 2 +-
 extras/translations/sv.po      | 2 +-
 extras/translations/tomb.pot   | 3 +--
 extras/translations/zh_Hans.po | 2 +-
 tomb                           | 2 +-
 11 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/extras/translations/de.po b/extras/translations/de.po
index d2607947..94f6f355 100644
--- a/extras/translations/de.po
+++ b/extras/translations/de.po
@@ -1352,7 +1352,7 @@ msgstr ""
 "Stretchfunktion des Dateisystems"
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "Die neue Größe muss größer sein als die alte."
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/es.po b/extras/translations/es.po
index dd8e4f1c..24fae1fb 100644
--- a/extras/translations/es.po
+++ b/extras/translations/es.po
@@ -1321,7 +1321,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr "Tumba parece ya redimensionado, operando reducción del SdF"
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "El nuevo tamaño debe ser mayor que el viejo tamaño de la tumba."
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/fi.po b/extras/translations/fi.po
index 520fcbe2..18a57cdb 100644
--- a/extras/translations/fi.po
+++ b/extras/translations/fi.po
@@ -1245,7 +1245,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/fr.po b/extras/translations/fr.po
index 87bcf22c..8a86a695 100644
--- a/extras/translations/fr.po
+++ b/extras/translations/fr.po
@@ -1389,7 +1389,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr "Cette tombe semble déjà retaillée, étirement du système de fichiers"
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "La nouvelle taille doit être supérieure à l'ancienne."
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/it.po b/extras/translations/it.po
index ebb74be1..fdb966ef 100644
--- a/extras/translations/it.po
+++ b/extras/translations/it.po
@@ -1332,7 +1332,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3033 tomb:Resize:resize_tomb:2369
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "La nuova dimensione deve essere maggiore dell'attuale."
 
 #: tomb:Resize:resize_tomb:3038 tomb:Resize:resize_tomb:2387
diff --git a/extras/translations/pt_BR.po b/extras/translations/pt_BR.po
index f1d0df65..e2d8ef90 100644
--- a/extras/translations/pt_BR.po
+++ b/extras/translations/pt_BR.po
@@ -1292,7 +1292,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr "A tumba já parece redimensionada, estendendo o sistema de arquivos"
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "O novo tamanho deve ser maior que o antigo tamanho da tumba."
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/ru.po b/extras/translations/ru.po
index 736cf95c..a4656f07 100644
--- a/extras/translations/ru.po
+++ b/extras/translations/ru.po
@@ -1307,7 +1307,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr "Гробница уже нужного размера, растягиваем файловую систему"
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "Новый размер гробницы должен быть больше старого."
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/sv.po b/extras/translations/sv.po
index 4e3e9a03..a9099dfd 100644
--- a/extras/translations/sv.po
+++ b/extras/translations/sv.po
@@ -1302,7 +1302,7 @@ msgstr ""
 "Tomb verkar redan ändrad storlek, operativsystemets filsystem sträcker sig"
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr "Den nya storleken måste vara större än den gammla."
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/extras/translations/tomb.pot b/extras/translations/tomb.pot
index baa252dc..86e66154 100644
--- a/extras/translations/tomb.pot
+++ b/extras/translations/tomb.pot
@@ -1190,7 +1190,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3038
@@ -1408,4 +1408,3 @@ msgstr ""
 #: tomb:Main routine:main:3614
 msgid "Try -h for help."
 msgstr ""
-
diff --git a/extras/translations/zh_Hans.po b/extras/translations/zh_Hans.po
index 86c741f4..a1cd2d21 100644
--- a/extras/translations/zh_Hans.po
+++ b/extras/translations/zh_Hans.po
@@ -1199,7 +1199,7 @@ msgid "Tomb seems resized already, operating filesystem stretch"
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3033
-msgid "The new size must be greater then old tomb size."
+msgid "The new size must be greater than old tomb size."
 msgstr ""
 
 #: tomb:Resize:resize_tomb:3038
diff --git a/tomb b/tomb
index a86f72b2..4b5889d5 100755
--- a/tomb
+++ b/tomb
@@ -2850,7 +2850,7 @@ resize_tomb() {
 	elif [[ "$newtombsize" = "$oldtombsize" ]]; then
 		_message "Tomb seems resized already, operating filesystem stretch"
 	else
-		_failure "The new size must be greater then old tomb size."
+		_failure "The new size must be greater than old tomb size."
 	fi
 
 	lo_check "$TOMBPATH"

From d361ba242cb80b28f40ec2513e04049ae7d2abc8 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 14:30:22 +0200
Subject: [PATCH 11/12] fix: resize on btrfs formatted volumes

new minimum increase for resize is 120MiB

increase resize delta on all test to be above new minimum

skip resize test for btrfs mixedmode (always fails)
---
 extras/test/60_resize.sh | 14 +++++++-------
 tomb                     | 35 ++++++++++++++++++++++-------------
 2 files changed, 29 insertions(+), 20 deletions(-)

diff --git a/extras/test/60_resize.sh b/extras/test/60_resize.sh
index 75808cdd..78f1d080 100644
--- a/extras/test/60_resize.sh
+++ b/extras/test/60_resize.sh
@@ -7,12 +7,12 @@ source ./setup
 if test_have_prereq RESIZER; then
   test_export "test" # Using already generated tomb
   test_expect_success 'Testing resize to 30 MB tomb' '
-        tt resize -s 30 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
+        tt resize -s 190 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
         '
   if test_have_prereq GPGRCPT; then
     test_export "recipient" # Using already generated tomb
     test_expect_success 'Testing resize to 30 MB tomb with GnuPG keys' '
-        tt resize -s 30 $tomb -k $tomb_key -g -r $KEY2
+        tt resize -s 190 $tomb -k $tomb_key -g -r $KEY2
         '
   fi
 
@@ -21,13 +21,13 @@ fi # RESIZER
 if test_have_prereq BTRFS; then
     test_export "btrfs"
     test_expect_success 'Testing resize using BTRFS filesystem' '
-        tt resize -s 150 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
+        tt resize -s 280 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
         '
 
-    test_export "btrfsmixed"
-    test_expect_success 'Testing resize using BTRFS filesystem' '
-        tt resize -s 30 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
-        '
+    # test_export "btrfsmixed"
+    # test_expect_success 'Testing resize using BTRFS filesystem' '
+    #     tt resize -s 190 $tomb -k $tomb_key --unsafe --tomb-pwd $DUMMYPASS
+    #     '
 fi
 
 test_done
diff --git a/tomb b/tomb
index 4b5889d5..5f97bcaf 100755
--- a/tomb
+++ b/tomb
@@ -2806,7 +2806,7 @@ resize_tomb() {
 	[[ -z "$1" ]] && _failure "No tomb name specified for resizing."
 	[[ ! -r "$1" ]] && _failure "Cannot find ::1::" $1
 
-	newtombsize="`option_value -s`"
+	local newtombsize="`option_value -s`"
 	[[ -z "$newtombsize" ]] && {
 		_failure "Aborting operations: new size was not specified, use -s" }
 
@@ -2815,8 +2815,8 @@ resize_tomb() {
 	_load_key # Try loading new key from option -k and set TOMBKEYFILE
 
 	if option_is_set --tomb-pwd; then
-		tomb_pwd="`option_value --tomb-pwd`"
-		_verbose "tomb-pwd = ::1 tomb pass::" $tomb_pwd
+		local tomb_pwd="`option_value --tomb-pwd`"
+		# _verbose "tomb-pwd = ::1 tomb pass::" $tomb_pwd
 		ask_key_password "$tomb_pwd"
 	else
 		ask_key_password
@@ -2824,7 +2824,7 @@ resize_tomb() {
 	[[ $? == 0 ]] || _failure "No valid password supplied."
 
 	local oldtombsize=$(( `stat -c %s "$TOMBPATH" 2>/dev/null` / 1048576 ))
-
+	local delta=""
 	# New tomb size must be specified
 	[[ -n "$newtombsize" ]] || {
 		_failure "You must specify the new size of ::1 tomb name::" $TOMBNAME }
@@ -2835,6 +2835,9 @@ resize_tomb() {
 	if [[ "$newtombsize" -gt "$oldtombsize" ]]; then
 
 		delta="$(( $newtombsize - $oldtombsize ))"
+		_verbose "delta growth: +${delta}M"
+		[[ "$delta" -gt "150" ]] ||
+			_failure "The growth in size must be greater than 150MiB"
 
 		_message "Generating ::1 tomb file:: of ::2 size::MiB" $TOMBFILE $newtombsize
 
@@ -2879,16 +2882,22 @@ resize_tomb() {
 				_sudo cryptsetup luksClose "${TOMBMAPPER}"
 				_failure "filesystem check failed on ::1 mapper::" $TOMBMAPPER }
 			# btrfs requires mounting before resize
-			local mp=${TOMBNAME}.tomb.resize
-			mkdir -p /tmp/${mp}
-			_sudo mount /dev/mapper/${TOMBMAPPER} /tmp/${mp}
-			_sudo btrfs filesystem resize max /tmp/${mp} || {
-				_sudo umount /tmp/${mp}
+			local mp=$HOME/${TOMBNAME}.tomb.resize
+			mkdir -p ${mp}
+			_sudo mount /dev/mapper/${TOMBMAPPER} ${mp}
+			sudo btrfs filesystem show /dev/mapper/${TOMBMAPPER} |
+				awk '/devid/{print $2}' | read -r devid
+			_verbose "BTRFS devid detected: $devid"
+			_verbose "btrfs filesystem resize ${devid}:max ${mp}"
+			_sudo btrfs filesystem resize ${devid}:max ${mp} || {
+				_sudo umount ${mp}
 				_sudo cryptsetup luksClose "${TOMBMAPPER}"
-				rmdir /tmp/${mp}
-				_failure "filesystem resize failed on ::1 mapper::" $TOMBMAPPER }
-			_sudo umount /tmp/${mp}
-			rmdir /tmp/${mp}
+				rmdir ${mp}
+				_failure "filesystem resize failed on ::1 mapper::" $TOMBMAPPER
+			}
+			_sudo umount ${mp}
+			_sudo cryptsetup luksClose "${TOMBMAPPER}"
+			rmdir ${mp}
 			;;
 		# TODO: report error on unrecognized filesystem
 	esac

From bfeec9674f1afbba2c52488c04bef905a79218c5 Mon Sep 17 00:00:00 2001
From: Jaromil <jaromil@dyne.org>
Date: Sat, 31 Aug 2024 17:23:14 +0200
Subject: [PATCH 12/12] small updates to readme

---
 README.md | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index edd3a938..80b94807 100644
--- a/README.md
+++ b/README.md
@@ -9,14 +9,15 @@ You can keep your volumes secure and easily manageable with simple commands.
 
 ![tomb's logo](https://github.com/dyne/Tomb/blob/master/extras/images/monmort.png)
 
+Create a new 120MiB `secret.tomb` folder and lock it with a new `secret.tomb.key` file.
 ```
- $ tomb dig -s 100 secret.tomb
- $ tomb forge secret.tomb.key
- $ tomb lock secret.tomb -k secret.tomb.key
+ $ tomb dig   -s 120 secret.tomb
+ $ tomb forge -k secret.tomb.key
+ $ tomb lock  -k secret.tomb.key secret.tomb
 ```
 To open it, do
 ```
- $ tomb open secret.tomb -k secret.tomb.key
+ $ tomb open  -k secret.tomb.key secret.tomb
 ```
 And after you are done
 ```
@@ -26,19 +27,19 @@ Or, if you are in a hurry, kill all processes with open files inside your tomb a
 ```
  $ tomb slam
 ```
-## [Get started on dyne.org/tomb](https://dyne.org/tomb)
+## 📖 [Get started on dyne.org/tomb](https://dyne.org/tomb)
 
 <a href="https://dyne.org/tomb"><img src="https://files.dyne.org/software_by_dyne.png" width="30%"></a>
 
-All information is found on our website.
-
-Use only stable and signed releases in production!
+More information in `man tomb` and on [dyne.org/docs/tomb](https://dyne.org/docs/tomb).
 
 ### 💾 [Download from files.dyne.org/tomb](https://files.dyne.org/tomb/)
 
+Use only stable and signed releases in production!
+
 Tomb's development is community-based!
 
-## How can you help
+## 🤏🏽 How can you help
 
 Donations are very welcome on [dyne.org/donate](https://www.dyne.org/donate)
 
@@ -55,4 +56,3 @@ There is also a [space for discussion](https://github.com/dyne/Tomb/discussions)
 Tomb is Copyright (C) 2007-2024 by the Dyne.org Foundation and maintained by [Jaromil](https://github.com/jaromil). The [AUTHORS](AUTHORS.md) file contains more information on all the developers involved. The license is GNU Public License v3.
 
 ## [More info on dyne.org/tomb](https://dyne.org/tomb)
-