Global rotate ignores a per-env key that lives only in keychain or pass
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- Half a day
- Newbie friendliness
- 55/100
Research direction
Start at bin/xenv around line 1940, where the global rotate decides which key to use, and at lookup_key, which already probes per-env sources. Reproduce by storing a per-env passphrase only in the keychain or pass with no keys/<env>.key, then running xenv key rotate without an @env argument. Done means the rotate completes for that env, with the per-env key resolved through the same probes that lookup_key uses.
Written by the indexing model from the issue text.
Description
Files: bin/xenv:1940
Repro: Put a per-env passphrase only in the keychain, with no keys/.key. xenv key rotate (no @env) decrypts that env with the global key and dies before any rewrite. The vault is intact. The rotate cannot finish.
Fix: Decide uses _global with the same per-env probes as lookup_key, not only the .key file.
Found at 6e8d2b4 by three runs of a whole-repo review team (deploystrata/offload), then hand-checked against the code by Grok. Lines marked Reproduced were also run by Claude.
- Dominant language
- Shell
- Stars
- 8
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ahoward/xenv
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
bug
Difficulty 1/5 1-3 hours Newbie friendliness 62/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
area:docs phase:release priority:p0 type:test
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
premises-missing
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
WingedGuardian/GENesis-AGI#3917 ·
Maintainers usually reply within 1 day
-
Non-root first start logs "Base venv updated (stamp mismatch)" instead of the first-run messageOpenarea: infrastructure bug priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
snapotter-hq/SnapOtter#4573 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100