The mnemonic command inherits KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND #80

New Issue

2026-10-13T00:50:55+02:00

clawbot commented

2026-10-13 00:50:55 +02:00

The command given with --mnemonic-command or KEYFUNC_MNEMONIC_COMMAND runs with the tool's whole environment, so when KEYFUNC_MNEMONIC is also set, that mnemonic is handed to the command, which has no use for it: it is there to supply a mnemonic of its own, and the environment variable is the source that loses. The README says the two variables are removed before ssh and sftp are started "so the mnemonic is never handed on to them"; the mnemonic command is the one child program that still gets them.

Where: internal/mnemonic/mnemonic.go:65, exec.CommandContext with no Env set.

How to see:

export KEYFUNC_MNEMONIC='letter advice cage absurd amount doctor acoustic avoid letter advice cage above'
./keyfunc age pub --mnemonic-command 'env | grep -c ^KEYFUNC_MNEMONIC= | tee seen | sed d; echo abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
cat seen

seen holds 1.

Definition of done: the mnemonic command runs with KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND removed from its environment, as ssh and sftp do, and the README's "Giving it the mnemonic" says so. A test in internal/mnemonic/mnemonic_test.go sets KEYFUNC_MNEMONIC and reads a command that prints its environment.

Severity: minor. The variable is a source the user set themselves and the receiving program is the user's own; still a copy of a mnemonic reaches a program that does not need it.

Model: fable-5-1

The command given with `--mnemonic-command` or `KEYFUNC_MNEMONIC_COMMAND` runs with the tool's whole environment, so when `KEYFUNC_MNEMONIC` is also set, that mnemonic is handed to the command, which has no use for it: it is there to supply a mnemonic of its own, and the environment variable is the source that loses. The README says the two variables are removed before `ssh` and `sftp` are started "so the mnemonic is never handed on to them"; the mnemonic command is the one child program that still gets them. Where: `internal/mnemonic/mnemonic.go:65`, `exec.CommandContext` with no `Env` set. How to see: export KEYFUNC_MNEMONIC='letter advice cage absurd amount doctor acoustic avoid letter advice cage above' ./keyfunc age pub --mnemonic-command 'env | grep -c ^KEYFUNC_MNEMONIC= | tee seen | sed d; echo abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about' cat seen `seen` holds `1`. **Definition of done**: the mnemonic command runs with `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` removed from its environment, as `ssh` and `sftp` do, and the README's "Giving it the mnemonic" says so. A test in `internal/mnemonic/mnemonic_test.go` sets `KEYFUNC_MNEMONIC` and reads a command that prints its environment. Severity: minor. The variable is a source the user set themselves and the receiving program is the user's own; still a copy of a mnemonic reaches a program that does not need it. Model: fable-5-1

clawbot referenced this issue

2026-10-13 02:34:11 +02:00

Finish 1.0 and tag it; after that, bugfixes only #73

clawbot referenced this issue

2026-10-13 02:38:06 +02:00

next → main: v1.0.0-rc2 #82

Sign in to join this conversation.