Severity: minor
The most common failure a user hits is described in age's internal terms and answered with the wrong remedy; nothing is lost and retrying with the right passphrase works.
What happens: with SB_UNLOCK_PASSPHRASE wrong, or a mistyped passphrase at the prompt, secret get prints:
Error: failed to unlock vault: failed to get long-term key: failed to get unlocker identity: failed to decrypt unlocker private key: failed to create decryptor: no identity matched any of the recipients; the vault 'default' still opens with its mnemonic: run 'secret unlocker add passphrase' with SB_SECRET_MNEMONIC set to the mnemonic to give it a new unlocker
The word "passphrase" never appears as the cause, and the advice (added for a damaged unlocker by #47) tells the user to replace a working unlocker. add --force, encrypt, decrypt, version list and unlocker add give the same text.
(withMnemonicAdvice, which exempts only ErrPassphraseNotRead).
Correct behaviour: when age reports that no identity matched for a passphrase unlocker, the error says the passphrase is wrong (for example "wrong passphrase for unlocker <id>"), and the mnemonic advice is left out, as it already is when no passphrase was read. A damaged priv.age (header or truncation errors) keeps the advice.
Definition of done
A wrong SB_UNLOCK_PASSPHRASE and a wrong typed passphrase both give an error that names the passphrase as the cause and carries no mnemonic advice, exit 1.
A test checks the error with errors.Is against a sentinel for a wrong passphrase and that the message lacks the advice; it fails before the fix.
Model: fable-5-1
Severity: minor
The most common failure a user hits is described in age's internal terms and answered with the wrong remedy; nothing is lost and retrying with the right passphrase works.
What happens: with `SB_UNLOCK_PASSPHRASE` wrong, or a mistyped passphrase at the prompt, `secret get` prints:
```
Error: failed to unlock vault: failed to get long-term key: failed to get unlocker identity: failed to decrypt unlocker private key: failed to create decryptor: no identity matched any of the recipients; the vault 'default' still opens with its mnemonic: run 'secret unlocker add passphrase' with SB_SECRET_MNEMONIC set to the mnemonic to give it a new unlocker
```
The word "passphrase" never appears as the cause, and the advice (added for a damaged unlocker by https://git.eeqj.de/sneak/secret/issues/47) tells the user to replace a working unlocker. `add --force`, `encrypt`, `decrypt`, `version list` and `unlocker add` give the same text.
Where: https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/secret/passphraseunlocker.go#L71 (`GetIdentity`: a failed `DecryptWithPassphrase` is wrapped as "failed to decrypt unlocker private key") and https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/vault/vault.go#L309 (`withMnemonicAdvice`, which exempts only `ErrPassphraseNotRead`).
Correct behaviour: when age reports that no identity matched for a passphrase unlocker, the error says the passphrase is wrong (for example "wrong passphrase for unlocker <id>"), and the mnemonic advice is left out, as it already is when no passphrase was read. A damaged `priv.age` (header or truncation errors) keeps the advice.
**Definition of done**
- A wrong `SB_UNLOCK_PASSPHRASE` and a wrong typed passphrase both give an error that names the passphrase as the cause and carries no mnemonic advice, exit 1.
- A test checks the error with `errors.Is` against a sentinel for a wrong passphrase and that the message lacks the advice; it fails before the fix.
Model: fable-5-1
sneak
was assigned by clawbot2026-10-13 00:39:00 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: minor
The most common failure a user hits is described in age's internal terms and answered with the wrong remedy; nothing is lost and retrying with the right passphrase works.
What happens: with
SB_UNLOCK_PASSPHRASEwrong, or a mistyped passphrase at the prompt,secret getprints:The word "passphrase" never appears as the cause, and the advice (added for a damaged unlocker by #47) tells the user to replace a working unlocker.
add --force,encrypt,decrypt,version listandunlocker addgive the same text.Where:
GetIdentity: a failedDecryptWithPassphraseis wrapped as "failed to decrypt unlocker private key") andwithMnemonicAdvice, which exempts onlyErrPassphraseNotRead).Correct behaviour: when age reports that no identity matched for a passphrase unlocker, the error says the passphrase is wrong (for example "wrong passphrase for unlocker <id>"), and the mnemonic advice is left out, as it already is when no passphrase was read. A damaged
priv.age(header or truncation errors) keeps the advice.Definition of done
SB_UNLOCK_PASSPHRASEand a wrong typed passphrase both give an error that names the passphrase as the cause and carries no mnemonic advice, exit 1.errors.Isagainst a sentinel for a wrong passphrase and that the message lacks the advice; it fails before the fix.Model: fable-5-1