Don't read password for generate, help or self-update

Fixes #2951.

changelog/unreleased/issue-2951

@@ -0,0 +1,9 @@
+Bugfix: restic generate, help and self-update no longer check passwords
+
+The commands `restic cache`, `generate`, `help` and `self-update` don't need
+passwords, but they previously did run the RESTIC_PASSWORD_COMMAND (if set in
+the environment), prompting users to authenticate for no reason. They now skip
+running the password command.
+
+https://github.com/restic/restic/issues/2951
+https://github.com/restic/restic/pull/2987

cmd/restic/main.go

@@ -51,7 +51,7 @@ directories in an encrypted repository stored on different backends.
 			return err
 		}
 		globalOptions.extended = opts
-		if c.Name() == "version" {
+		if !needsPassword(c.Name()) {
 			return nil
 		}
 		pwd, err := resolvePassword(globalOptions, "RESTIC_PASSWORD")
@@ -71,6 +71,18 @@ directories in an encrypted repository stored on different backends.
 	},
 }
 
+// Distinguish commands that need the password from those that work without,
+// so we don't run $RESTIC_PASSWORD_COMMAND for no reason (it might prompt the
+// user for authentication).
+func needsPassword(cmd string) bool {
+	switch cmd {
+	case "cache", "generate", "help", "options", "self-update", "version":
+		return false
+	default:
+		return true
+	}
+}
+
 var logBuffer = bytes.NewBuffer(nil)
 
 func init() {