With SB_UNLOCK_PASSPHRASE set, secret unlocker add passphrase gives the new unlocker the old passphrase without asking #154

New Issue

2026-10-13T00:31:09+02:00

clawbot commented

2026-10-13 00:31:09 +02:00

Severity: minor. The README calls the variable the "unlock passphrase" and says the prompt "is the safer default"; a user who sets it to unlock the vault and expects to be asked for the new passphrase gets a replacement unlocker with the old one, and nothing says so.

SB_UNLOCK_PASSPHRASE=pw1 secret unlocker add passphrase
# Created passphrase unlocker: passphrase-...
# Automatically selected as current unlocker
SB_UNLOCK_PASSPHRASE=newpw secret get s1     # fails: no identity matched
SB_UNLOCK_PASSPHRASE=pw1 secret get s1       # works

With the variable unset the command asks for the new passphrase twice and then for the current one, which is right.

Where.

		secret/internal/cli/unlockers.go
		Line 467 in ef0ae90768
	
					passphraseBuffer := cli.UnlockPassphrase

.

Correct behaviour is a product decision; the README says only "adding one replaces the one the vault has". Recommended: use the variable to unlock and still ask for the new passphrase when stdin is a terminal; when it is not, say in the output that the new unlocker takes the passphrase from the variable.

Definition of done

Either the new passphrase is asked for when a terminal is present, or the command's output and the README say that the variable becomes the new passphrase.
A test runs unlocker add passphrase with the variable set and fails before the fix.

Model: fable-5-1

Severity: minor. The README calls the variable the "unlock passphrase" and says the prompt "is the safer default"; a user who sets it to unlock the vault and expects to be asked for the new passphrase gets a replacement unlocker with the old one, and nothing says so. ``` SB_UNLOCK_PASSPHRASE=pw1 secret unlocker add passphrase # Created passphrase unlocker: passphrase-... # Automatically selected as current unlocker SB_UNLOCK_PASSPHRASE=newpw secret get s1 # fails: no identity matched SB_UNLOCK_PASSPHRASE=pw1 secret get s1 # works ``` With the variable unset the command asks for the new passphrase twice and then for the current one, which is right. **Where.** https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/unlockers.go#L467. **Correct behaviour** is a product decision; the README says only "adding one replaces the one the vault has". Recommended: use the variable to unlock and still ask for the new passphrase when stdin is a terminal; when it is not, say in the output that the new unlocker takes the passphrase from the variable. **Definition of done** - Either the new passphrase is asked for when a terminal is present, or the command's output and the README say that the variable becomes the new passphrase. - A test runs `unlocker add passphrase` with the variable set and fails before the fix. Model: fable-5-1

sneak was assigned by clawbot

2026-10-13 00:31:09 +02:00

clawbot referenced this issue

2026-10-13 01:17:13 +02:00

Finish 1.0 and tag it; after that, bugfixes only #131

Sign in to join this conversation.