Conversation
The `pass set` command now accepts non-sensitive key=value metadata
alongside the secret value via the new `--metadata` flag (repeatable):
pass set docker/foo=bar --metadata owner=alice --metadata expiry=2027-03-01
When reading from STDIN, a JSON payload can carry both the secret and
metadata in one input:
echo '{"secret":"bar","metadata":{"owner":"alice"}}' | pass set docker/foo
If both STDIN JSON metadata and --metadata flags are provided, the flag
values take precedence on key collision. Plain STDIN input (non-JSON) is
unchanged.
Metadata is stored on PassValue via SetMetadata/Metadata, which were
previously no-op stubs.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
![docker-agent[bot]](https://avatars.githubusercontent.com/in/2787757?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔴 CRITICAL Issue Found
Assessment
This PR introduces a critical data loss bug that breaks the metadata feature for persistent storage. The metadata field is not included in serialization, causing all metadata to be silently discarded when secrets are saved.
Summary
- 1 CRITICAL issue found: Metadata persistence broken
- Issue Type: Data integrity/loss
Details
The --metadata flag implementation works correctly at the command level and in tests, but the metadata is never persisted to disk. The Marshal() method (line 31) only serializes the Value field, completely ignoring the metadata field added in this PR. When secrets are loaded via Unmarshal(), the metadata will always be nil.
This makes the entire metadata feature non-functional for any real storage backend. The tests pass only because they use a mock store that doesn't exercise the Marshal/Unmarshal cycle.
Recommendation: Update both Marshal() and Unmarshal() methods to include the metadata field in serialization.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
2 participants
The
pass setcommand now accepts non-sensitive key=value metadata alongside the secret value via the new--metadataflag (repeatable):pass set docker/foo=bar --metadata owner=alice --metadata expiry=2027-03-01
When reading from STDIN, a JSON payload can carry both the secret and metadata in one input:
echo '{"secret":"bar","metadata":{"owner":"alice"}}' | pass set docker/foo
If both STDIN JSON metadata and --metadata flags are provided, the flag values take precedence on key collision. Plain STDIN input (non-JSON) is unchanged.
Metadata is stored on PassValue via SetMetadata/Metadata, which were previously no-op stubs.