kopia/kopia · error

source repository password

Error message

source repository password

What it means

openSourceRepo first tries the persisted password for the source repository config, then falls back to the --password / KOPKA environment flag. If both fail, the error "source repository password" is returned. It means kopia could not obtain credentials to decrypt/authenticate to the source repository.

Solutions

1. Pass the source password explicitly via --password (or the password file flag) when running non-interactively.
2. Set the KOPASSWORD environment variable in CI/non-interactive contexts.
3. Reconnect the source config (`kopia repository connect ...`) on this machine so the password is persisted in the local keyring.
4. Verify you are using the correct source repository password — a wrong password surfaces as open/verify failure downstream, but a missing one surfaces here.

Example fix

// before (CI)
kopia snapshot migrate --source-config /path/to/config
// after
KOPASSWORD=$(cat /secrets/src-pass) kopia snapshot migrate --source-config /path/to/config

# ensure a password source exists before running
if [ -z "$KOPASSWORD" ] && [ ! -f "$PASSFILE" ]; then echo "no source password available" >&2; exit 1; fi

if err := runMigrate(ctx); err != nil && strings.Contains(err.Error(), "source repository password") {
	// prompt operator or reload from secret manager, then retry once
}

When it happens

Trigger: passwordPersistenceStrategy().GetPassword fails for c.migrateSourceConfig AND svc.getPasswordFromFlags also fails (no --password flag, no KOPASSWORD env, empty stdin prompt).

Common situations: Migrating from an old repository whose password is not in the keyring on a new machine; running non-interactively (CI) without --password; env var name mismatch; keyring service locked.

Related errors

• invalid repository password
• can't get password
• error connecting
• error initializing htpasswd
• ErrPasswordNotFound

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/73b28ec3e36d594a. Report an issue: GitHub.

Appendix: source

Thrown at cli/command_snapshot_migrate.go:150

		}(s)
	}

	wg.Wait()
	c.svc.getProgress().FinishShared()
	c.out.printStderr("\r\n")
	log(ctx).Info("Migration finished.")

	return nil
}

func (c *commandSnapshotMigrate) openSourceRepo(ctx context.Context) (repo.Repository, error) {
	pass, err := c.svc.passwordPersistenceStrategy().GetPassword(ctx, c.migrateSourceConfig)
	if err != nil {
		pass, err = c.svc.getPasswordFromFlags(ctx, false, false)
	}

	if err != nil {
		return nil, errors.Wrap(err, "source repository password")
	}

	sourceRepo, err := repo.Open(ctx, c.migrateSourceConfig, pass, c.svc.optionsFromFlags(ctx))
	if err != nil {
		return nil, errors.Wrap(err, "can't open source repository")
	}

	return sourceRepo, nil
}

func (c *commandSnapshotMigrate) migratePoliciesForSources(ctx context.Context, sourceRepo repo.Repository, destRepo repo.RepositoryWriter, sources []snapshot.SourceInfo) error {
	for _, si := range sources {
		if err := c.migrateSinglePolicy(ctx, sourceRepo, destRepo, si); err != nil {
			return errors.Wrapf(err, "unable to migrate policy for %v", si)
		}
	}

	return nil

View on GitHub (pinned to 82495e54b5)