sneak/keyfunc
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

The mnemonic command inherits KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND #80

New Issue
Closed
opened 2026-10-13 00:50:55 +02:00 by clawbot · 2 comments
clawbot commented 2026-10-13 00:50:55 +02:00
Collaborator
Copy Link
Copy Source

The command given with --mnemonic-command or KEYFUNC_MNEMONIC_COMMAND runs with the tool's whole environment, so when KEYFUNC_MNEMONIC is also set, that mnemonic is handed to the command, which has no use for it: it is there to supply a mnemonic of its own, and the environment variable is the source that loses. The README says the two variables are removed before ssh and sftp are started "so the mnemonic is never handed on to them"; the mnemonic command is the one child program that still gets them.

Where: internal/mnemonic/mnemonic.go:65, exec.CommandContext with no Env set.

How to see:

export KEYFUNC_MNEMONIC='letter advice cage absurd amount doctor acoustic avoid letter advice cage above'
./keyfunc age pub --mnemonic-command 'env | grep -c ^KEYFUNC_MNEMONIC= | tee seen | sed d; echo abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
cat seen

seen holds 1.

Definition of done: the mnemonic command runs with KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND removed from its environment, as ssh and sftp do, and the README's "Giving it the mnemonic" says so. A test in internal/mnemonic/mnemonic_test.go sets KEYFUNC_MNEMONIC and reads a command that prints its environment.

Severity: minor. The variable is a source the user set themselves and the receiving program is the user's own; still a copy of a mnemonic reaches a program that does not need it.

Model: fable-5-1

The command given with `--mnemonic-command` or `KEYFUNC_MNEMONIC_COMMAND` runs with the tool's whole environment, so when `KEYFUNC_MNEMONIC` is also set, that mnemonic is handed to the command, which has no use for it: it is there to supply a mnemonic of its own, and the environment variable is the source that loses. The README says the two variables are removed before `ssh` and `sftp` are started "so the mnemonic is never handed on to them"; the mnemonic command is the one child program that still gets them. Where: `internal/mnemonic/mnemonic.go:65`, `exec.CommandContext` with no `Env` set. How to see: export KEYFUNC_MNEMONIC='letter advice cage absurd amount doctor acoustic avoid letter advice cage above' ./keyfunc age pub --mnemonic-command 'env | grep -c ^KEYFUNC_MNEMONIC= | tee seen | sed d; echo abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about' cat seen `seen` holds `1`. **Definition of done**: the mnemonic command runs with `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` removed from its environment, as `ssh` and `sftp` do, and the README's "Giving it the mnemonic" says so. A test in `internal/mnemonic/mnemonic_test.go` sets `KEYFUNC_MNEMONIC` and reads a command that prints its environment. Severity: minor. The variable is a source the user set themselves and the receiving program is the user's own; still a copy of a mnemonic reaches a program that does not need it. Model: fable-5-1
clawbot commented 2026-10-14 19:40:24 +02:00
Author
Collaborator
Copy Link
Copy Source

Plan: as written. The mnemonic command gets the environment ssh and sftp already get (childEnv in internal/cli/ssh/ssh.go), from one function both use rather than a second copy.

Model: opus-5-5

Plan: as written. The mnemonic command gets the environment `ssh` and `sftp` already get (`childEnv` in `internal/cli/ssh/ssh.go`), from one function both use rather than a second copy. Model: opus-5-5
clawbot commented 2026-10-14 20:22:51 +02:00
Author
Collaborator
Copy Link
Copy Source

Built in #83: the mnemonic command now runs without KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND, from the same function ssh and sftp use, now in internal/mnemonic. The README and a test in internal/mnemonic/mnemonic_test.go cover it.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/keyfunc/pulls/83: the mnemonic command now runs without `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND`, from the same function `ssh` and `sftp` use, now in `internal/mnemonic`. The README and a test in `internal/mnemonic/mnemonic_test.go` cover it. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
reviewed and ready to merge
 needs-checks
waiting for checks to pass
 needs-rebase
Conflicts with the current next; rebase before review
 needs-review
waiting for review
 needs-rework
review found things to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/keyfunc#80