Include gpg's stderr in the error when gpg fails (closes #146)

When gpg failed while decrypting, encrypting or looking up a key
fingerprint, the error gave only gpg's exit status, so the user could
not tell why. cmd.Output keeps gpg's stderr in the *exec.ExitError it
returns; the three errors now end with that stderr, trimmed.

gpg's stderr can run to more than one line, and the error then does too.

The regression test gives gpg data that is not an OpenPGP message
instead of one encrypted to a missing key: gpg reports both the same
way, and this case starts no gpg-agent the test would have to stop.

Model: opus-5-5

internal/cli/version.go

@@ -64,7 +64,7 @@ func VersionCommands(cli *Instance) *cobra.Command {
 	promoteCmd := &cobra.Command{
 		Use:   "promote <secret-name> <version>",
 		Short: "Promote a specific version to current",
-		Long: "Rewrites the secret's current file to name the specified " +
+		Long: "Updates the current symlink to point to the specified " +
 			"version. The versions' own times are left unchanged; secret " +
 			"list then gives the time of the promote as the secret's last " +
 			"update.",
@@ -293,7 +293,7 @@ func (cli *Instance) PromoteVersion(
 			version, vault.ErrVersionNotFound, secretName)
 	}
 
-	// Rewrite the secret's current file to name the version
+	// Update the current symlink using the proper function
 	err = secret.SetCurrentVersion(cli.fs, secretDir, version)
 	if err != nil {
 		return fmt.Errorf("failed to update current version: %w", err)

internal/cli/version_test.go

@@ -6,8 +6,6 @@
 // - TestListVersionsNonExistentSecret: Tests error handling for missing secrets
 // - TestPromoteVersionCommand: Tests `secret version promote` command
 // - TestPromoteNonExistentVersion: Tests error handling for invalid promotion
-// - TestPromoteHelpSaysCurrentFileIsRewritten: Tests `secret version promote
-//   --help` text
 // - TestGetSecretWithVersion: Tests `secret get --version` flag functionality
 // - TestGetSecretWritesBinaryValue: Tests `secret get` output of binary values
 // - TestGetSecretReturnsWriteError: Tests `secret get` when stdout fails
@@ -272,23 +270,6 @@ func TestPromoteNonExistentVersion(t *testing.T) {
 	require.ErrorIs(t, err, vault.ErrVersionNotFound)
 }
 
-// TestPromoteHelpSaysCurrentFileIsRewritten is a regression test for
-// https://git.eeqj.de/sneak/secret/issues/153: `secret version promote
-// --help` said it updates a symlink, but promote rewrites the secret's
-// `current` file, which is a plain file.
-//
-//nolint:paralleltest // executes the CLI in-process and sets the environment
-func TestPromoteHelpSaysCurrentFileIsRewritten(t *testing.T) {
-	env := map[string]string{secret.EnvStateDir: t.TempDir()}
-
-	output, err := ExecuteCommandInProcess(
-		[]string{"version", "promote", "--help"}, "", env)
-	require.NoError(t, err)
-
-	assert.NotContains(t, output, "symlink")
-	assert.Contains(t, output, "current file")
-}
-
 func TestGetSecretWithVersion(t *testing.T) {
 	t.Parallel()
 

internal/secret/pgpunlocker.go

@@ -421,20 +421,14 @@ func checkGPGAvailable() error {
 
 // withGPGStderr appends gpg's stderr, which says why gpg failed, to err
 // from cmd.Output. cmd.Output keeps that stderr in the *exec.ExitError.
-// err is returned unchanged when gpg wrote nothing to stderr.
 func withGPGStderr(err error) error {
 	var exitErr *exec.ExitError
 
-	if !errors.As(err, &exitErr) {
-		return err
+	if errors.As(err, &exitErr) {
+		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(exitErr.Stderr)))
 	}
 
-	stderr := strings.TrimSpace(string(exitErr.Stderr))
-	if stderr == "" {
-		return err
-	}
-
-	return fmt.Errorf("%w: %s", err, stderr)
+	return err
 }
 
 // gpgEncryptDefault is the default implementation of GPG encryption

internal/secret/pgpunlocker_test.go

@@ -115,14 +115,3 @@ func TestGPGDecryptErrorHasGPGReason(t *testing.T) {
 	_, err := secret.GPGDecryptFunc([]byte("not an OpenPGP message"))
 	require.ErrorContains(t, err, "gpg: no valid OpenPGP data found")
 }
-
-// TestGPGDecryptErrorWithoutGPGStderr checks that when gpg fails without
-// writing to stderr, the error ends with the exit status and nothing after it.
-//
-//nolint:paralleltest // installFakeGPG uses t.Setenv
-func TestGPGDecryptErrorWithoutGPGStderr(t *testing.T) {
-	installFakeGPG(t)
-
-	_, err := secret.GPGDecryptFunc([]byte("not an OpenPGP message"))
-	require.EqualError(t, err, "GPG decryption failed: exit status 1")
-}