Pull out file attachment from kbdx onto stdout through CLI tool

[etosan]

Summary

Maybe I am missing something but it seems it's impossible to pull out Entry's file attachment through CLI tool/"client" from the database. Would it be possible to implement this?

It would be best if, by default, this sub-command would emit to stdout so that embedded files can be used in shell pipelines.

Examples

Imagined help string

Usage: keepassxc-cli pullout [options] database entry file
Pull out an entry's file atatchment.

Options:
  -q, --quiet                   Silence password prompt and other secondary
                                outputs.
  -k, --key-file <path>         Key file of the database.
  --no-password                 Deactivate password key for the database.
  -y, --yubikey <slot>          Yubikey slot used to encrypt the database.
  -o, --output-file <path>      File where to write pulled out file attachment,
                                by default -.
  -h, --help                    Display this help.

Arguments:
  database                      Path of the database.
  entry                         Name of the entry to pull out.
  file                          Name of file attachment to pull out.

In following piped case, password query (only!) has to go to stderr if isatty(stdout) == false. Maybe ASKPASS proto should be supported too?

Usage:

$ keepassxc-cli pullout kpdb.kdbx /Group/Entry secret.tz | tar -tz
Enter password to unlock kpdb.kdbx: *****
secret/dox.txt
secret/pws.txt
...

Treating kdbx as storage:

Usage:

$ ls -al ~/secret.key
"secret.key": No such file or directory (os error 2)

$ keepassxc-cli pullout -o ~/secret.key kpdb.kdbx /Group/Entry secret.key
Enter password to unlock kpdb.kdbx: *****

$ ls -al ~/secret.key
.rw-r--r-- 512b etosan etosan 18 May  4:2 secret.key

Context

It would be immensely useful to be able pull out various temporary secret and keyfiles stored in kdbx into command line programs. Such files might have specific formats and are not just random password plaintexts that can be pulled out already.

[AaronDMarasco]

This might be related to #4847 as well.

[louib]

Attachment handling has been implemented by #5538, and will be available in version 2.7. The attachment-export command includes an --stdout option to send the content of the attachment to the console.

In following piped case, password query (only!) has to go to stderr

This was already addressed, see #4794