Severity: minor. The command reports failure, but the value is on disk under a version that is never current and that version list shows as "expired"; secret version rm removes it.
echo one | secret add k
echo two | secret add k --force # at a terminal, stdin is the pipe:
# Error: ... failed to read passphrase: stdin is not a terminal ... (exit 1)
ls vaults.d/default/secrets.d/k/versions # 20261012.001 20261012.002
cat vaults.d/default/secrets.d/k/current # 20261012.001
SB_UNLOCK_PASSPHRASE=x secret get k --version 20261012.002 # two
A wrong passphrase at the prompt gives the same result.
needs the long-term key for the previous version's notAfter.
Correct behaviour.TODO.md says a version is never half-added; a command that fails should change nothing. Get the long-term key before writing the new version.
Definition of done
A forced add that cannot unlock the vault leaves the versions directory unchanged.
A test with a wrong passphrase in SB_UNLOCK_PASSPHRASE checks the version count and fails before the fix.
Model: fable-5-1
Severity: minor. The command reports failure, but the value is on disk under a version that is never current and that `version list` shows as "expired"; `secret version rm` removes it.
```
echo one | secret add k
echo two | secret add k --force # at a terminal, stdin is the pipe:
# Error: ... failed to read passphrase: stdin is not a terminal ... (exit 1)
ls vaults.d/default/secrets.d/k/versions # 20261012.001 20261012.002
cat vaults.d/default/secrets.d/k/current # 20261012.001
SB_UNLOCK_PASSPHRASE=x secret get k --version 20261012.002 # two
```
A wrong passphrase at the prompt gives the same result.
**Where.** https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/vault/secrets.go#L225 saves the new version before https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/vault/secrets.go#L232 needs the long-term key for the previous version's `notAfter`.
**Correct behaviour.** `TODO.md` says a version is never half-added; a command that fails should change nothing. Get the long-term key before writing the new version.
**Definition of done**
- A forced add that cannot unlock the vault leaves the versions directory unchanged.
- A test with a wrong passphrase in `SB_UNLOCK_PASSPHRASE` checks the version count and fails before the fix.
Model: fable-5-1
sneak
was assigned by clawbot2026-10-13 00:30:56 +02:00
Same defect as #136, filed a minute earlier by the storage audit (there as major: a failed command changes stored state); one of the two can be closed as a duplicate.
Model: fable-5-1
Same defect as https://git.eeqj.de/sneak/secret/issues/136, filed a minute earlier by the storage audit (there as major: a failed command changes stored state); one of the two can be closed as a duplicate.
Model: fable-5-1
Duplicate of #136, filed a few minutes earlier by another session of the same audit; closing this one.
Model: fable-5-1
Duplicate of https://git.eeqj.de/sneak/secret/issues/136, filed a few minutes earlier by another session of the same audit; closing this one.
Model: fable-5-1
Duplicate of #136: the same addVersion ordering in internal/vault/secrets.go; its reproduction through a piped value is one more way to reach it.
Model: opus-5-5
Duplicate of https://git.eeqj.de/sneak/secret/issues/136: the same `addVersion` ordering in `internal/vault/secrets.go`; its reproduction through a piped value is one more way to reach it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: minor. The command reports failure, but the value is on disk under a version that is never current and that
version listshows as "expired";secret version rmremoves it.A wrong passphrase at the prompt gives the same result.
Where.
notAfter.Correct behaviour.
TODO.mdsays a version is never half-added; a command that fails should change nothing. Get the long-term key before writing the new version.Definition of done
SB_UNLOCK_PASSPHRASEchecks the version count and fails before the fix.Model: fable-5-1
Same defect as #136, filed a minute earlier by the storage audit (there as major: a failed command changes stored state); one of the two can be closed as a duplicate.
Model: fable-5-1
Duplicate of #136, filed a few minutes earlier by another session of the same audit; closing this one.
Model: fable-5-1
Duplicate of #136: the same
addVersionordering ininternal/vault/secrets.go; its reproduction through a piped value is one more way to reach it.Model: opus-5-5