Found by the acceptance test (#418), on next with the fix for 401 merged locally.
Steps to reproduce
Put a valid age private key that is not one of the backup's recipients in VAULTIK_AGE_SECRET_KEY.
vaultik snapshot restore ID DIR or vaultik snapshot verify --deep ID.
What happened
Restore: downloading snapshot database: creating decryption reader: creating decryption reader: no identity matched any of the recipients. Deep verify: failed to decrypt database: failed to create decryption reader: creating decryption reader: no identity matched any of the recipients. "Identity" and "recipients" are age's words; the prefix is repeated.
What should happen
One sentence in the README's words: the private key in VAULTIK_AGE_SECRET_KEY (or age_secret_key) cannot decrypt this snapshot, because it is not one of the keys the backup was encrypted to; the key source is named as the missing-key error now does. The repeated prefix goes.
Model: fable-5-1
Found by the acceptance test (https://git.eeqj.de/sneak/vaultik/issues/418), on `next` with the fix for 401 merged locally.
**Steps to reproduce**
- Put a valid age private key that is not one of the backup's recipients in `VAULTIK_AGE_SECRET_KEY`.
- `vaultik snapshot restore ID DIR` or `vaultik snapshot verify --deep ID`.
**What happened**
Restore: `downloading snapshot database: creating decryption reader: creating decryption reader: no identity matched any of the recipients`. Deep verify: `failed to decrypt database: failed to create decryption reader: creating decryption reader: no identity matched any of the recipients`. "Identity" and "recipients" are age's words; the prefix is repeated.
**What should happen**
One sentence in the README's words: the private key in `VAULTIK_AGE_SECRET_KEY` (or `age_secret_key`) cannot decrypt this snapshot, because it is not one of the keys the backup was encrypted to; the key source is named as the missing-key error now does. The repeated prefix goes.
Model: fable-5-1
Plan: when the private key cannot decrypt a snapshot, the error is one sentence. It says the key from VAULTIK_AGE_SECRET_KEY (or age_secret_key) is not one of the keys this backup was encrypted to, naming the source the way the missing-key error does. The repeated prefix goes.
Package: internal/vaultik.
For every unit from the acceptance test
One branch off current next, one PR with base next, labelled needs-review and assigned to clawbot. The title ends (closes #N).
Add nothing to docs/TODO.md. sneak ruled on 11 November that it is not a history document (#440).
README.md on next: change only a sentence the fix makes false. The rewritten README in #399 is with sneak and is updated after this merges.
A test that fails on current next shows the fix. Run make fmt and make check before the final push.
Model: opus-5-5
Plan: when the private key cannot decrypt a snapshot, the error is one sentence. It says the key from `VAULTIK_AGE_SECRET_KEY` (or `age_secret_key`) is not one of the keys this backup was encrypted to, naming the source the way the missing-key error does. The repeated prefix goes.
Package: `internal/vaultik`.
**For every unit from the acceptance test**
- One branch off current `next`, one PR with base `next`, labelled `needs-review` and assigned to `clawbot`. The title ends `(closes #N)`.
- Add nothing to `docs/TODO.md`. sneak ruled on 11 November that it is not a history document (https://git.eeqj.de/sneak/vaultik/issues/440).
- `README.md` on `next`: change only a sentence the fix makes false. The rewritten README in https://git.eeqj.de/sneak/vaultik/pulls/399 is with sneak and is updated after this merges.
- A test that fails on current `next` shows the fix. Run `make fmt` and `make check` before the final push.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 01:21:28 +01:00
Built in #448: with a private key the backup was not encrypted to, restore and deep verify now fail with cannot decrypt this snapshot: the private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the backup was encrypted to, naming age_secret_key instead when the key came from the config file. The doubled prefix is gone.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/vaultik/pulls/448: with a private key the backup was not encrypted to, restore and deep verify now fail with `cannot decrypt this snapshot: the private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the backup was encrypted to`, naming `age_secret_key` instead when the key came from the config file. The doubled prefix is gone.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the acceptance test (#418), on
nextwith the fix for 401 merged locally.Steps to reproduce
VAULTIK_AGE_SECRET_KEY.vaultik snapshot restore ID DIRorvaultik snapshot verify --deep ID.What happened
Restore:
downloading snapshot database: creating decryption reader: creating decryption reader: no identity matched any of the recipients. Deep verify:failed to decrypt database: failed to create decryption reader: creating decryption reader: no identity matched any of the recipients. "Identity" and "recipients" are age's words; the prefix is repeated.What should happen
One sentence in the README's words: the private key in
VAULTIK_AGE_SECRET_KEY(orage_secret_key) cannot decrypt this snapshot, because it is not one of the keys the backup was encrypted to; the key source is named as the missing-key error now does. The repeated prefix goes.Model: fable-5-1
Plan: when the private key cannot decrypt a snapshot, the error is one sentence. It says the key from
VAULTIK_AGE_SECRET_KEY(orage_secret_key) is not one of the keys this backup was encrypted to, naming the source the way the missing-key error does. The repeated prefix goes.Package:
internal/vaultik.For every unit from the acceptance test
next, one PR with basenext, labelledneeds-reviewand assigned toclawbot. The title ends(closes #N).docs/TODO.md. sneak ruled on 11 November that it is not a history document (#440).README.mdonnext: change only a sentence the fix makes false. The rewritten README in #399 is with sneak and is updated after this merges.nextshows the fix. Runmake fmtandmake checkbefore the final push.Model: opus-5-5
Built in #448: with a private key the backup was not encrypted to, restore and deep verify now fail with
cannot decrypt this snapshot: the private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the backup was encrypted to, namingage_secret_keyinstead when the key came from the config file. The doubled prefix is gone.Model: opus-5-5