Bug: Init command writes longterm.age twice, second write overwrites correct encryption #6

New Issue

2026-02-08T21:02:11+01:00

clawbot commented

2026-02-08 21:02:11 +01:00

Bug

In internal/cli/init.go, after calling vlt.CreatePassphraseUnlocker(passphraseBuffer), the Init() function redundantly re-reads the unlocker's public key, re-encrypts the long-term private key, and overwrites longterm.age:

// CreatePassphraseUnlocker already wrote longterm.age correctly
passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)

// Then Init does it AGAIN:
unlockerPubKeyData, err := afero.ReadFile(cli.fs, filepath.Join(unlockerDir, "pub.age"))
// ... reads pub key, encrypts lt key, writes longterm.age again

CreatePassphraseUnlocker (in internal/vault/unlockers.go) already correctly:

Generates the unlocker keypair
Encrypts the long-term key to the unlocker
Writes longterm.age

The duplicate code in Init overwrites this with a functionally equivalent but separately encrypted blob. This is:

Wasteful: double encryption work
A maintenance hazard: if CreatePassphraseUnlocker changes its encryption scheme, Init would overwrite with the old approach
Confusing: suggests CreatePassphraseUnlocker doesn't handle this step

Fix

Remove the redundant longterm.age encryption and writing from Init().

## Bug In `internal/cli/init.go`, after calling `vlt.CreatePassphraseUnlocker(passphraseBuffer)`, the `Init()` function redundantly re-reads the unlocker's public key, re-encrypts the long-term private key, and overwrites `longterm.age`: ```go // CreatePassphraseUnlocker already wrote longterm.age correctly passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer) // Then Init does it AGAIN: unlockerPubKeyData, err := afero.ReadFile(cli.fs, filepath.Join(unlockerDir, "pub.age")) // ... reads pub key, encrypts lt key, writes longterm.age again ``` `CreatePassphraseUnlocker` (in `internal/vault/unlockers.go`) already correctly: 1. Generates the unlocker keypair 2. Encrypts the long-term key to the unlocker 3. Writes `longterm.age` The duplicate code in `Init` overwrites this with a functionally equivalent but separately encrypted blob. This is: - **Wasteful**: double encryption work - **A maintenance hazard**: if `CreatePassphraseUnlocker` changes its encryption scheme, `Init` would overwrite with the old approach - **Confusing**: suggests `CreatePassphraseUnlocker` doesn't handle this step ## Fix Remove the redundant longterm.age encryption and writing from `Init()`.

clawbot referenced a pull request that will close this issue

2026-02-08 21:06:03 +01:00

Remove redundant longterm.age encryption in Init command (closes #6) #11

sneak closed this issue

2026-02-09 02:39:55 +01:00

sneak referenced this issue from a commit

2026-02-09 02:39:56 +01:00

Merge pull request 'Remove redundant longterm.age encryption in Init command (closes #6)' (#11) from clawbot/secret:fix/issue-6 into main

Sign in to join this conversation.