non-repo subcommands that don't need passwords still try to run RESTIC_PASSWORD_COMMAND

[solidgoldbomb]

Output of restic version

restic 0.10.0 compiled with go1.15.2 on linux/amd64

How did you run restic exactly?

This was my initial scenario -- I store my restic password in a password-store file which requires a hardware token to decrypt. The token was not plugged in at the time that I was running the help command because I had no intention of performing any backup/restore operations at the time. Had just updated to v0.10.0 and thought I'd look at the help output and update bash completions.

$ export RESTIC_PASSWORD_COMMAND='pass show my-restic-password'
$ restic help
Resolving password failed: exit status 1

This is easily reproduced with any password-command that fails, not specifically related to pass

$ export RESTIC_PASSWORD_COMMAND=/bin/false
$ restic help
Resolving password failed: exit status 1

Same behaviour for other commands that are unrelated to using a repository that might need a password for decryption

$ export RESTIC_PASSWORD_COMMAND=/bin/false
$ restic generate --bash-completion ~/.local/etc/bash_completion.d/restic.bash-completion
Resolving password failed: exit status 1

What backend/server/service did you use to store the repository?

Not storing a repository at all yet, just trying to run help or generate.

Expected behavior

I expected to be able to see the help output in the first command and to generate the tab-completions for bash in the second command.

The RESTIC_PASSWORD_COMMAND feature is really nice and works really well with password-store but it doesn't need to be evaluated for commands that don't require the password.

Actual behavior

I get an error about resolving passwords instead of seeing the output from help or generate -- non repo commands.

Steps to reproduce the behavior

$ RESTIC_PASSWORD_COMMAND=/bin/false restic help
Resolving password failed: exit status 1

Do you have any idea what may have caused this?

Even though I was running subcommands that have no need for a password, code inspection shows that main.go evaluates resolvePassword() for all subcommands (except version). resolvePassword() tries to execute the RESTIC_PASSWORD_COMMAND. This command fails due to a no hardware token being plugged in.

Do you have an idea how to solve the issue?

One of these will solve the issue

• Move execution of resolvePassword() into each subcommand that needs a password
• Add a list of subcommands to main.go for which you skip running resolvePassword()

It's easy enough to unset the env var as a workaround but it's not that initially obvious what's failing or why it even needs a password for help.

Did restic help you today? Did it make you happy in any way?

Restic is awesome. It works very well and is an important part of my backup strategy. Thanks for all the work you put into this!