{"record":{"id":"73b28ec3e36d594a","repo":"kopia/kopia","slug":"source-repository-password","errorCode":null,"errorMessage":"source repository password","messagePattern":"source repository password","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command_snapshot_migrate.go","lineNumber":150,"sourceCode":"\t\t}(s)\n\t}\n\n\twg.Wait()\n\tc.svc.getProgress().FinishShared()\n\tc.out.printStderr(\"\\r\\n\")\n\tlog(ctx).Info(\"Migration finished.\")\n\n\treturn nil\n}\n\nfunc (c *commandSnapshotMigrate) openSourceRepo(ctx context.Context) (repo.Repository, error) {\n\tpass, err := c.svc.passwordPersistenceStrategy().GetPassword(ctx, c.migrateSourceConfig)\n\tif err != nil {\n\t\tpass, err = c.svc.getPasswordFromFlags(ctx, false, false)\n\t}\n\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"source repository password\")\n\t}\n\n\tsourceRepo, err := repo.Open(ctx, c.migrateSourceConfig, pass, c.svc.optionsFromFlags(ctx))\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"can't open source repository\")\n\t}\n\n\treturn sourceRepo, nil\n}\n\nfunc (c *commandSnapshotMigrate) migratePoliciesForSources(ctx context.Context, sourceRepo repo.Repository, destRepo repo.RepositoryWriter, sources []snapshot.SourceInfo) error {\n\tfor _, si := range sources {\n\t\tif err := c.migrateSinglePolicy(ctx, sourceRepo, destRepo, si); err != nil {\n\t\t\treturn errors.Wrapf(err, \"unable to migrate policy for %v\", si)\n\t\t}\n\t}\n\n\treturn nil","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/cli/command_snapshot_migrate.go#L132-L168","documentation":"openSourceRepo first tries the persisted password for the source repository config, then falls back to the --password / KOPKA environment flag. If both fail, the error \"source repository password\" is returned. It means kopia could not obtain credentials to decrypt/authenticate to the source repository.","triggerScenarios":"passwordPersistenceStrategy().GetPassword fails for c.migrateSourceConfig AND svc.getPasswordFromFlags also fails (no --password flag, no KOPASSWORD env, empty stdin prompt).","commonSituations":"Migrating from an old repository whose password is not in the keyring on a new machine; running non-interactively (CI) without --password; env var name mismatch; keyring service locked.","solutions":["Pass the source password explicitly via --password (or the password file flag) when running non-interactively.","Set the KOPASSWORD environment variable in CI/non-interactive contexts.","Reconnect the source config (`kopia repository connect ...`) on this machine so the password is persisted in the local keyring.","Verify you are using the correct source repository password — a wrong password surfaces as open/verify failure downstream, but a missing one surfaces here."],"exampleFix":"// before (CI)\nkopia snapshot migrate --source-config /path/to/config\n// after\nKOPASSWORD=$(cat /secrets/src-pass) kopia snapshot migrate --source-config /path/to/config","handlingStrategy":"validation","validationCode":"# ensure a password source exists before running\nif [ -z \"$KOPASSWORD\" ] && [ ! -f \"$PASSFILE\" ]; then echo \"no source password available\" >&2; exit 1; fi","typeGuard":null,"tryCatchPattern":"if err := runMigrate(ctx); err != nil && strings.Contains(err.Error(), \"source repository password\") {\n\t// prompt operator or reload from secret manager, then retry once\n}","preventionTips":["Store the source repo password in a secret manager and pass it via flag/env in CI.","Reconnect source configs on each machine so the keyring has the password.","Never rely on interactive prompts in scheduled/automated migrations."],"tags":["kopia","password","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}