Git errors during gopass fsck --decrypt

[WPettersson]

Summary

When updating recipients and running a gopass fsck --decrypt, I had some unexpected git errors. In particular,

] 524 / 620 [Goooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooopass                         ]  84.52% 
[] Re-encrypting some/really/secret to fix recipients and storage format.                                                                                            
❌ Task failed: failed to commit changes to git: exit status 128: fatal: Unable to create '/home/user/.password-store/.git/index.lock': File exists.
                                                                                                                                                                                       
Another git process seems to be running in this repository, e.g.                                                                                                                       
an editor opened by 'git commit'. Please make sure all processes                                                                                                                       
are terminated then try again. If it still fails, a git process                                                                                                                        
may have crashed in this repository earlier:                                                                                                                                           
remove the file manually to continue. 

My initial response was to both check for this file, and also other running git processes, but the file did not exist, and neither was I doing anything else in the password store. I have since tested this some 5-6 more times, and I have once successfully run a whole fsck --decrypt, but the other ~5 times I've had this exact same error occur again, but on some other secret every time.

I suspect what is happening here is that somehow, because gopass spawns so many git "edit,commit" cycles very quickly, that sometimes before one commit can clean up the index.lock file the next commit is already ready to set up the index.lock file. I don't think gopass does any sort of parallel things here, so it may well be that either git, or the file system driver, does some sort of quick return without waiting for the file to actually be deleted.

I don't know if this is true, and I also don't know how to reliably reproduce, since before today I've not seen this issue.

Steps To Reproduce

1. I really don't know. Maybe have many secrets?
2. Run gopass fsck --decrypt

Expected behavior

Everything works

Environment

• OS: Gentoo
• OS version: 5.15.74
• gopass Version: 1.14.4
• Installation method: portage

Additional context

[dominikschulz]

This does sound like a concurrency bug, but I've never observed this and we're trying to avoid concurrent git operations. But I'll see if we might have concurrency issues somewhere.

Also we haven't changed anything about how we interact with git or concurrency related stuff in a long time.

[WPettersson]

Yeah, I also don't mind this being closed with wontfix, I more wanted to report it so that if others encounter similar issues, they might either find this report useful, or have more useful things to say on the same topic.

[DEvil0000]

Have the same issue on fedora 37 (I tested a few of the newer versions including the latest one 1.15.2).
Works at least most of the time with gopass 1.12.0.
I have about 200 secrets in the repo (secret key local and not on a external hardware device).
looks like it "changes" all files but I can not see a actual change to them (without need - and again on every run).
it adds more files then one per commit but not all of them to one commit (6 secret commits at least, 1 pub key commit at the end, then crash).
It does commit public keys parallel to the last fsck commit which causes the issue as far as I can tell.
disabling core.autosync and core.exportkeys did not help.
I am the only one pushing to this git repo and for sure at that moment only this local gopass used it.

edit:
most of the time I get an error like this:

[] RCS Push failed: exit status 1: remote: error: cannot lock ref 'refs/heads/master': is at ae3ab52ccd91a0385d8539ba8d22ccd025449305 but expected 2bc18e03cfdc818e45fc0f91d0a0957e6ba78431        
To https://$censored.git
 ! [remote rejected] master -> master (failed to update ref)
error: failed to push some refs to 'https://$censored.git'

but the error with the lock file is one I also got when I did not get this one.
Also note: I have a very fast machine ;) so if there is a change for a race I may hit it more likely

[dominikschulz]

I should have some time next week to investigate. Thanks for the details, this might help to narrow it down.

[dominikschulz]

Once you see it, it's obvious. I wonder why I never hit this, but should be fixed soon.
I do wonder why disabling core.exportkeys does not help. And why it would update all files in the password store.

Feel free to open separate issues for that.

[DEvil0000]

looked like the config changes did not have any effect and it did still do all the same.
I have two ideas why it reencrypted all files:

• because it crashed and never finished with success
• may be related to BTRFS which is used

thanks for the fix will try as soon as the next release is out

[AnomalRoil]

@DEvil0000 can you try with the latest master version to see if you still have this issue?

[DEvil0000]

tested your fix, works for me. thanks!
retested the other two things mentioned and opened separate issues as you told me.

[dominikschulz]

Amazing. Thanks for all three 👍