Use keepassxc-cli to fetch emails for mbsync email client

[mankoff]

This isn't a bug but I don't see a users help mailing list so I hope it is OK to ask this question here.

I'm trying to use keepassxc-cli to fetch passwords for my email accounts with mbsync. Previously on OS X I used the "Security" command to get system-level passwords, using this line in ~/.mbsyncrc:

PassCmd "security find-generic-password -s mbsync-email-password -w" # OSX

Most linux documentation suggests using gpg:

PassCmd "gpg2 -q --for-your-eyes-only --no-tty -d ~/.emacs.d/.mbsyncpass.gpg"

But why can't I use keepassxc-cli? When I try with:

PassCmd +"/usr/bin/keepassxc-cli show /path/to/keepass.kbdx email_passwd -a Password"

Nothing happens when I run mbsync. If I enter this at the CLI, it does work.

It seems that keepassxc-cli would be easier to use in many ways than gpg. Support for this use case would be nice. Please let me know if I'm doing something wrong by trying to do this.

Debug Info

KeePassXC - Version 2.3.1
Revision: 2fcaeea

Libraries:

• Qt 5.9.5
• libgcrypt 1.8.1

Operating system: Ubuntu 18.04.1 LTS
CPU architecture: x86_64
Kernel: linux 4.15.0-33-generic

Enabled extensions:

• Auto-Type
• Browser Integration
• Legacy Browser Integration (KeePassHTTP)
• SSH Agent
• YubiKey

[ntd]

I think this is related to #1873 (i.e. keepassxc-cli requires a password).

To let it work I had to protect the database with a dummy password. Only then I am able to access it with a variant of the following command:

echo dumbpassword | keepassxc-cli show mydatabase -k mykey myemail -a Password | tail -1

The --no-password flag suggested there by @louib would be much better.

[louib]

Also related to #831, which would also make it easier to use the CLI with other commands with piping or redirection.

@mankoff thanks for the input. I'm going to close this one as I feel those problems are already tracked in the 2 issues mentioned so far.

[mankoff]

Sure lets close this. I'll monitor #831. But for the record, I want a password protecting my keepass database. I'm not sure I see the use case for a keepass db w/o a password, and therefore I don't see the connection to this and #1873 or a --no-password option.

I just want the password prompt accessible from when I call the program via mbsync from inside Emacs. There should be an option for a GUI popup or perhaps "the invoking pty" (not sure what that means) as mentioned in #831, if that solved this use case.

[Rovanion]

I can report that the above issue has been solved and that the following .mbsyncrc line works for me:

PassCmd "keepassxc-cli show <keepass-db-file> <account-name> -a password"