BORG_PASSPHRASE environment variable not working as usual in 1.5.6 #330

New Issue

netgreg · 2020-06-17T08:47:07Z

netgreg commented

2020-06-17 08:47:07 +00:00

What I'm trying to do and why

I've noticed that since borgmatic version 1.5.6 backups won't work automatically. The problem is that even though the environment variable "BORG_PASSPHRASE" is set like "BORG_PASSPHRASE=PASSPHRASE", I get asked to enter it:
"Enter passphrase for key ssh://someserver/somearchive:". If I enter the passphrase manually the backup continues. If I install borgmatic version 1.5.5 and down, it works as expected.

Steps to reproduce (if a bug)

Load env variables and start the backup

. /borg/env
/usr/local/bin/borgmatic -c /etc/borgmatic/filesystem.yaml -v2

borgmatic-config.yaml:
location:
    source_directories:
      - /

    one_file_system: true

    repositories:
      - ssh://someserver.com/somearchive

    exclude_patterns:
        - '/proc'
        - '/sys'

    exclude_caches: true

    exclude_if_present: .nobackup

storage:
    compression: lz4

    ssh_command: ssh -i /borg/ssh/id_rsa

    archive_name_format: 'filesystem-{now}'

retention:
    keep_hourly: 1
    keep_daily: 7
    keep_weekly: 4
    keep_monthly: 6
    keep_yearly: 1

    prefix: filesystem-

consistency:
    checks:
        - repository
        - archives
    check_last: 3
    prefix: filesystem-

/borg/env:
export BORG_PASSPHRASE="PASSPHRASE"
export BORG_REPO="ssh://someserver.com/somearchive"
export BORG_RSH="ssh -i /borg/ssh/id_rsa -o StrictHostKeyChecking=no"

Actual behavior (if a bug)

root@someserver.com:~$ . /borg/env; /usr/local/bin/borgmatic -c /etc/borgmatic/filesystem.yaml -v2
Ensuring legacy configuration is upgraded
/etc/borgmatic/filesystem.yaml: No commands to run for pre-everything hook
/etc/borgmatic/filesystem.yaml: No commands to run for pre-prune hook
/etc/borgmatic/filesystem.yaml: No commands to run for pre-backup hook
Mit Jun 17 10:37:38 CEST 2020 - Starting a backup job.
/etc/borgmatic/filesystem.yaml: No commands to run for pre-check hook
ssh://someserver.com/somearchive: Pruning archives
borg prune --keep-monthly 6 --keep-weekly 4 --keep-daily 7 --keep-hourly 1 --prefix filesystem- --keep-yearly 1 --debug --show-rc ssh://someserver.com/somearchive
using builtin fallback logging configuration
35 self tests completed in 0.13 seconds
SSH command line: ['ssh', '-i', '/borg/ssh/id_rsa', '-p', '23', 'someserver.com/somearchive', 'borg', 'serve', '--umask=077', '--debug']
Enter passphrase for key ssh://someserver.com/somearchive:

Expected behavior (if a bug)

Backup working automatically without having to input the passphrase.

Other notes / implementation ideas

Environment

borgmatic version: 1.5.6

borgmatic installation method: pip3 install borgmatic

Borg version: 1.1.9

Python version: 3.5.3

operating system and version: Debian Stretch 9.12 and Ubuntu 18.04

#### What I'm trying to do and why I've noticed that since borgmatic version 1.5.6 backups won't work automatically. The problem is that even though the environment variable "BORG_PASSPHRASE" is set like "BORG_PASSPHRASE=PASSPHRASE", I get asked to enter it: "Enter passphrase for key ssh://someserver/somearchive:". If I enter the passphrase manually the backup continues. If I install borgmatic version 1.5.5 and down, it works as expected. #### Steps to reproduce (if a bug) Load env variables and start the backup ``` . /borg/env /usr/local/bin/borgmatic -c /etc/borgmatic/filesystem.yaml -v2 ``` ----- ``` borgmatic-config.yaml: location: source_directories: - / one_file_system: true repositories: - ssh://someserver.com/somearchive exclude_patterns: - '/proc' - '/sys' exclude_caches: true exclude_if_present: .nobackup storage: compression: lz4 ssh_command: ssh -i /borg/ssh/id_rsa archive_name_format: 'filesystem-{now}' retention: keep_hourly: 1 keep_daily: 7 keep_weekly: 4 keep_monthly: 6 keep_yearly: 1 prefix: filesystem- consistency: checks: - repository - archives check_last: 3 prefix: filesystem- ``` ----- ``` /borg/env: export BORG_PASSPHRASE="PASSPHRASE" export BORG_REPO="ssh://someserver.com/somearchive" export BORG_RSH="ssh -i /borg/ssh/id_rsa -o StrictHostKeyChecking=no" ``` #### Actual behavior (if a bug) ``` root@someserver.com:~$ . /borg/env; /usr/local/bin/borgmatic -c /etc/borgmatic/filesystem.yaml -v2 Ensuring legacy configuration is upgraded /etc/borgmatic/filesystem.yaml: No commands to run for pre-everything hook /etc/borgmatic/filesystem.yaml: No commands to run for pre-prune hook /etc/borgmatic/filesystem.yaml: No commands to run for pre-backup hook Mit Jun 17 10:37:38 CEST 2020 - Starting a backup job. /etc/borgmatic/filesystem.yaml: No commands to run for pre-check hook ssh://someserver.com/somearchive: Pruning archives borg prune --keep-monthly 6 --keep-weekly 4 --keep-daily 7 --keep-hourly 1 --prefix filesystem- --keep-yearly 1 --debug --show-rc ssh://someserver.com/somearchive using builtin fallback logging configuration 35 self tests completed in 0.13 seconds SSH command line: ['ssh', '-i', '/borg/ssh/id_rsa', '-p', '23', 'someserver.com/somearchive', 'borg', 'serve', '--umask=077', '--debug'] Enter passphrase for key ssh://someserver.com/somearchive: ``` #### Expected behavior (if a bug) Backup working automatically without having to input the passphrase. #### Other notes / implementation ideas #### Environment **borgmatic version:** 1.5.6 **borgmatic installation method:** pip3 install borgmatic **Borg version:** 1.1.9 **Python version:** 3.5.3 **operating system and version:** Debian Stretch 9.12 and Ubuntu 18.04

witten commented

2020-06-17 17:22:16 +00:00

Thank you for filing this! Here's what I believe is going on: The fix for #323 changed the behavior of borgmatic passing environment variables to Borg, so that unless an option is specified in borgmatic's configuration file (like encryption_passhprase), its corresponding environment variable (like BORG_PASSPHRASE) won't get passed to Borg. The rationale is that certain options specified in one borgmatic configuration file should not still be present for subsequent configuration file invocations of Borg.

But there's an unintended side-effect, which is what you're seeing here: The implicit feature of borgmatic passing through Borg-specific environment variables directly to Borg no longer works.

The good news is that there's already a pull request (#327) from another user to fix this. So hopefully it'll get solved soon! As a temporary work-around, you could use borgmatic's encryption_passphrase configuration file option.

Thank you for filing this! Here's what I believe is going on: The fix for #323 changed the behavior of borgmatic passing environment variables to Borg, so that unless an option is specified in borgmatic's configuration file (like `encryption_passhprase`), its corresponding environment variable (like `BORG_PASSPHRASE`) won't get passed to Borg. The rationale is that certain options specified in one borgmatic configuration file should not still be present for subsequent configuration file invocations of Borg. But there's an unintended side-effect, which is what you're seeing here: The implicit feature of borgmatic passing through Borg-specific environment variables directly to Borg no longer works. The good news is that there's already a pull request (#327) from another user to fix this. So hopefully it'll get solved soon! As a temporary work-around, you could use borgmatic's `encryption_passphrase` configuration file option.

👍 1

witten added the

bug

label 2020-06-17 17:22:23 +00:00

witten commented

2020-06-21 21:45:01 +00:00

This is fixed in master now. I'll add a note here when the fix is released. Thanks again for the bug report!

witten closed this issue

2020-06-21 21:45:06 +00:00

Sign in to join this conversation.