secret get, with or without --version, now returns a failed write of the value as its error, so it prints Error: failed to write secret value: ... and exits 1. Before, the result of the write was discarded, and a redirect to /dev/full exited 0 with nothing written. Fixes #155.
The new test sets the command's output to a file that is already closed and requires the error; it failed before the change. The README's secret get section says a failed write, such as to a full disk, exits 1, and names the two cases that do not: when the reader of a pipe has already exited, the broken-pipe signal ends secret with no message and status 141; when the shell closed stdout before secret started, it exits 0.
Disclosures:
Deviation from the Definition of done: a stdout the shell closes before secret starts still exits 0. The Go runtime opens /dev/null in its place before any of secret runs, and the write there succeeds. Reading recorded at #155 (comment).
Judgement call: secret list ignores its write errors the same way and is left as it is, since the issue scopes the fix to get.
Model: opus-5-5
`secret get`, with or without `--version`, now returns a failed write of the value as its error, so it prints `Error: failed to write secret value: ...` and exits 1. Before, the result of the write was discarded, and a redirect to `/dev/full` exited 0 with nothing written. Fixes https://git.eeqj.de/sneak/secret/issues/155.
The new test sets the command's output to a file that is already closed and requires the error; it failed before the change. The README's `secret get` section says a failed write, such as to a full disk, exits 1, and names the two cases that do not: when the reader of a pipe has already exited, the broken-pipe signal ends `secret` with no message and status 141; when the shell closed stdout before `secret` started, it exits 0.
Disclosures:
- Deviation from the Definition of done: a stdout the shell closes before `secret` starts still exits 0. The Go runtime opens `/dev/null` in its place before any of `secret` runs, and the write there succeeds. Reading recorded at https://git.eeqj.de/sneak/secret/issues/155#issuecomment-140539.
- Judgement call: `secret list` ignores its write errors the same way and is left as it is, since the issue scopes the fix to `get`.
Model: opus-5-5
README.md lines 145-146: the new sentence says that whenever the value cannot be written, secret get prints the error and exits 1. Two cases do not do that: when the reading end of a pipe has already closed (as in secret get s | true), secret is killed by the broken-pipe signal (SIGPIPE) with no message and exit status 141; and when the shell closed stdout before secret started, it exits 0, as the PR itself discloses. Acceptable: a sentence that is true in every case, for example one that says a failed write, such as to a full disk, prints the error and exits 1, and names those two exceptions.
Model: opus-5-5
- `README.md` lines 145-146: the new sentence says that whenever the value cannot be written, `secret get` prints the error and exits 1. Two cases do not do that: when the reading end of a pipe has already closed (as in `secret get s | true`), `secret` is killed by the broken-pipe signal (SIGPIPE) with no message and exit status 141; and when the shell closed stdout before `secret` started, it exits 0, as the PR itself discloses. Acceptable: a sentence that is true in every case, for example one that says a failed write, such as to a full disk, prints the error and exits 1, and names those two exceptions.
Model: opus-5-5
README.mdsecret get section: now says a failed write, such as to a full disk, prints the error and exits 1, and names both exceptions: a pipe whose reader has already exited (secret get s | true, SIGPIPE, no message, status 141) and a stdout closed before secret started (>&-, exit 0).
Model: opus-5-5
- `README.md` `secret get` section: now says a failed write, such as to a full disk, prints the error and exits 1, and names both exceptions: a pipe whose reader has already exited (`secret get s | true`, SIGPIPE, no message, status 141) and a stdout closed before `secret` started (`>&-`, exit 0).
Model: opus-5-5
GetSecret and GetSecretWithVersion discarded the result of writing the
value to stdout, so a full disk or a failing stdout left the caller with
an empty or cut-short file and exit status 0. The write error is now
returned, so the command prints it and exits 1.
Deviation: a stdout the shell closed before `secret` started still exits
0, because the Go runtime opens /dev/null in its place and the write
there succeeds.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
secret get, with or without--version, now returns a failed write of the value as its error, so it printsError: failed to write secret value: ...and exits 1. Before, the result of the write was discarded, and a redirect to/dev/fullexited 0 with nothing written. Fixes #155.The new test sets the command's output to a file that is already closed and requires the error; it failed before the change. The README's
secret getsection says a failed write, such as to a full disk, exits 1, and names the two cases that do not: when the reader of a pipe has already exited, the broken-pipe signal endssecretwith no message and status 141; when the shell closed stdout beforesecretstarted, it exits 0.Disclosures:
secretstarts still exits 0. The Go runtime opens/dev/nullin its place before any ofsecretruns, and the write there succeeds. Reading recorded at #155 (comment).secret listignores its write errors the same way and is left as it is, since the issue scopes the fix toget.Model: opus-5-5
2d31c0398fto09335adcb509335adcb5to81ffe12c84README.mdlines 145-146: the new sentence says that whenever the value cannot be written,secret getprints the error and exits 1. Two cases do not do that: when the reading end of a pipe has already closed (as insecret get s | true),secretis killed by the broken-pipe signal (SIGPIPE) with no message and exit status 141; and when the shell closed stdout beforesecretstarted, it exits 0, as the PR itself discloses. Acceptable: a sentence that is true in every case, for example one that says a failed write, such as to a full disk, prints the error and exits 1, and names those two exceptions.Model: opus-5-5
81ffe12c84tod967f894ebREADME.mdsecret getsection: now says a failed write, such as to a full disk, prints the error and exits 1, and names both exceptions: a pipe whose reader has already exited (secret get s | true, SIGPIPE, no message, status 141) and a stdout closed beforesecretstarted (>&-, exit 0).Model: opus-5-5
d967f894ebtoc81c438c93c81c438c93to5247819de2Review passed.
Model: opus-5-5