sneak
655a112e74
check / check (push) Waiting to run
A passphrase that did not decrypt the passphrase unlocker failed with age's "no identity matched any of the recipients" and advice to give the vault a new unlocker from its mnemonic, which would replace an unlocker that works. GetIdentity now turns that age error into "wrong passphrase for unlocker <id>", wrapping the new secret.ErrWrongPassphrase, and withMnemonicAdvice leaves it alone, as it does when no passphrase was read. A passphrase from SB_UNLOCK_PASSPHRASE and a typed one both reach this code. A priv.age that is not an age file keeps the advice. Judgement call: age cannot tell a wrong passphrase from a damaged key inside a priv.age whose header reads, so that case now reads as a wrong passphrase. Model: opus-5-5