{"record":{"id":"0152f211757e10d8","repo":"wtfutil/wtf","slug":"store-v-w","errorCode":null,"errorMessage":"store %v: %w","messagePattern":"store (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cfg/secrets.go","lineNumber":190,"sourceCode":"\t\treturn errors.New(\"cannot store secrets: wtf.secretStore is not configured\")\n\t}\n\n\tcred := &credentials.Credentials{\n\t\tServerURL: secret.Service,\n\t\tUsername:  secret.Username,\n\t\tSecret:    secret.Secret,\n\t}\n\n\t// docker-credential requires a username, but it isn't necessary for\n\t// all services. Use a default if a username was not set.\n\tif cred.Username == \"\" {\n\t\tcred.Username = \"default\"\n\t}\n\n\terr := client.Store(prog.runner, cred)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"store %v: %w\", prog.store, err)\n\t}\n\n\treturn nil\n}\n\ntype program struct {\n\tstore  string\n\trunner client.ProgramFunc\n}\n\nfunc newProgram(globalConfig *config.Config) *program {\n\tsecretStore := globalConfig.UString(\"wtf.secretStore\", \"(none)\")\n\n\tif secretStore == \"(none)\" {\n\t\treturn nil\n\t}\n\n\tif secretStore == \"\" {","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/wtfutil/wtf/blob/bb838c1ccb0f0f3223690df44afdec663d622881/cfg/secrets.go#L172-L208","documentation":"StoreSecret wraps failures from client.Store(prog.runner, cred) as 'store <store>: <cause>'. The credential object was built fine, but the external store program refused or failed the write. The inner error after the store name carries the real reason.","triggerScenarios":"Writing to a pass store with no initialized GPG key; keychain denied access (locked or ACL prompt rejected); read-only or missing store directory; the runner binary exiting nonzero; store rejecting an entry with empty username (code defaults it to \"default\", but empty service/secret can still fail).","commonSituations":"Headless servers without keychain access; disk full or permissions on ~/.password-store; passphrase-protected GPG key prompting in a non-interactive terminal; SELinux/AppArmor blocking the helper binary.","solutions":["Inspect the wrapped cause after 'store <store>:' and address it","Test the store manually (e.g. `pass insert test`) with the same user/environment","Unlock the keychain / ensure gpg-agent is available and the GPG key is initialized","Fix filesystem permissions or disk issues on the store path","Check the secretStore runner configuration points at a working, executable binary"],"exampleFix":"# before (headless, keychain locked)\nwtf.secretStore.type: keychain\n# after\nwtf.secretStore:\n  type: pass\n  # pass works headlessly once GNUPGHOME + key are initialized","handlingStrategy":"try-catch","validationCode":"// ensure backend reachable before writing\nif out, err := exec.Command(storeCmd, \"ls\").CombinedOutput(); err != nil {\n    return fmt.Errorf(\"store backend unhealthy: %s: %w\", out, err)\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.StoreSecret(conf, secret); err != nil {\n    if unwrapped := errors.Unwrap(err); unwrapped != nil {\n        log.Printf(\"store write failed: %v\", unwrapped) // e.g. gpg/keychain error\n    }\n    return err\n}","preventionTips":["Unlock the keychain / ensure gpg-agent before headless runs","Verify store directory permissions and free disk space","Test writes manually: pass insert wtf-test","Run the store helper as the same user wtfutil runs as"],"tags":["go","secrets","error-wrapping"],"backgroundTag":"secret-store-write-failed","analyzedSha":"bb838c1ccb0f0f3223690df44afdec663d622881","analyzedAt":"2026-09-03T17:02:45.030Z","contentChangedAt":"2026-09-03T17:02:45.030Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}