A passphrase that does not decrypt the passphrase unlocker, from SB_UNLOCK_PASSPHRASE or typed at the prompt, used to fail with age's "no identity matched any of the recipients" and advice to give the vault a new unlocker from its mnemonic, which would replace an unlocker that works. Every command that opens the vault now ends its error with "wrong passphrase for unlocker" and the unlocker's ID, with no mnemonic advice, and exits 1.
PassphraseUnlocker.GetIdentity turns age's no-match error into one that wraps the new secret.ErrWrongPassphrase. Both ways of giving the passphrase reach this code.
withMnemonicAdvice leaves that error alone, as it already does when no passphrase was read.
TestWrongPassphraseNamesMnemonic, which pinned the old message, became TestWrongPassphraseNamesPassphrase: it checks the sentinel with errors.Is and that the advice is absent, then opens the vault with the right passphrase. The new TestDamagedUnlockerNamesMnemonic checks that a priv.age that is not an age file keeps the advice. TestAddSecretForceWithWrongPassphraseChangesNothing checks the sentinel instead of age's error, which is no longer in the chain.
README.md does not describe this error, so it is unchanged.
Judgement call: age cannot tell a wrong passphrase from a damaged key inside a priv.age whose header reads, so that case now reads as a wrong passphrase.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/secret/issues/157.
A passphrase that does not decrypt the passphrase unlocker, from `SB_UNLOCK_PASSPHRASE` or typed at the prompt, used to fail with age's "no identity matched any of the recipients" and advice to give the vault a new unlocker from its mnemonic, which would replace an unlocker that works. Every command that opens the vault now ends its error with "wrong passphrase for unlocker" and the unlocker's ID, with no mnemonic advice, and exits 1.
- `PassphraseUnlocker.GetIdentity` turns age's no-match error into one that wraps the new `secret.ErrWrongPassphrase`. Both ways of giving the passphrase reach this code.
- `withMnemonicAdvice` leaves that error alone, as it already does when no passphrase was read.
- `TestWrongPassphraseNamesMnemonic`, which pinned the old message, became `TestWrongPassphraseNamesPassphrase`: it checks the sentinel with `errors.Is` and that the advice is absent, then opens the vault with the right passphrase. The new `TestDamagedUnlockerNamesMnemonic` checks that a `priv.age` that is not an age file keeps the advice. `TestAddSecretForceWithWrongPassphraseChangesNothing` checks the sentinel instead of age's error, which is no longer in the chain.
`README.md` does not describe this error, so it is unchanged.
Judgement call: age cannot tell a wrong passphrase from a damaged key inside a `priv.age` whose header reads, so that case now reads as a wrong passphrase.
Model: opus-5-5
A passphrase that did not decrypt the passphrase unlocker failed with age's
"no identity matched any of the recipients" and advice to give the vault a
new unlocker from its mnemonic, which would replace an unlocker that works.
GetIdentity now turns that age error into "wrong passphrase for unlocker
<id>", wrapping the new secret.ErrWrongPassphrase, and withMnemonicAdvice
leaves it alone, as it does when no passphrase was read. A passphrase from
SB_UNLOCK_PASSPHRASE and a typed one both reach this code. A priv.age that
is not an age file keeps the advice.
Judgement call: age cannot tell a wrong passphrase from a damaged key inside
a priv.age whose header reads, so that case now reads as a wrong passphrase.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #157.
A passphrase that does not decrypt the passphrase unlocker, from
SB_UNLOCK_PASSPHRASEor typed at the prompt, used to fail with age's "no identity matched any of the recipients" and advice to give the vault a new unlocker from its mnemonic, which would replace an unlocker that works. Every command that opens the vault now ends its error with "wrong passphrase for unlocker" and the unlocker's ID, with no mnemonic advice, and exits 1.PassphraseUnlocker.GetIdentityturns age's no-match error into one that wraps the newsecret.ErrWrongPassphrase. Both ways of giving the passphrase reach this code.withMnemonicAdviceleaves that error alone, as it already does when no passphrase was read.TestWrongPassphraseNamesMnemonic, which pinned the old message, becameTestWrongPassphraseNamesPassphrase: it checks the sentinel witherrors.Isand that the advice is absent, then opens the vault with the right passphrase. The newTestDamagedUnlockerNamesMnemonicchecks that apriv.agethat is not an age file keeps the advice.TestAddSecretForceWithWrongPassphraseChangesNothingchecks the sentinel instead of age's error, which is no longer in the chain.README.mddoes not describe this error, so it is unchanged.Judgement call: age cannot tell a wrong passphrase from a damaged key inside a
priv.agewhose header reads, so that case now reads as a wrong passphrase.Model: opus-5-5
ef61db976cto24e74e5f6124e74e5f61to655a112e74Review passed.
Model: opus-5-5