Final

borgmatic/config/schema.yaml

@@ -2691,8 +2691,12 @@ properties:
             yubikey:
                 type: string
                 description: |
-                    Path or identifier for the YubiKey to use for unlocking the KeePassXC database.
-                example: /path/to/yubikey
+                    YubiKey slot and optional serial number used to access the KeePassXC database.
+                    Format: "<slot[:serial]>", where:
+                     - <slot> is the YubiKey slot number (e.g., `1` or `2`).
+                     - <serial> (optional) is the YubiKey's serial number (e.g., `1:7370001`).
+                example: "1:7370001"
+
         description: |
             Configuration for integration with the KeePassXC password manager.
     default_actions:

borgmatic/hooks/credential/keepassxc.py

@@ -16,7 +16,7 @@ def load_credential(hook_config, config, credential_parameters):
     Raise ValueError if keepassxc-cli can't retrieve the credential.
     '''
     try:
-        database_path, attribute_name = credential_parameters[:2]
+        (database_path, attribute_name) = credential_parameters
     except ValueError:
         raise ValueError( f'Invalid KeePassXC credential parameters: {credential_parameters}')
 

tests/unit/hooks/credential/test_keepassxc.py

@@ -166,7 +166,7 @@ def test_load_credential_with_yubikey():
             '--attributes',
             'Password',
             '--yubikey',
-            '/path/to/yubikey',
+            '1:7370001',
             'database.kdbx',
             'mypassword',
         )
@@ -176,7 +176,7 @@ def test_load_credential_with_yubikey():
 
     assert (
         module.load_credential(
-            hook_config={'yubikey': '/path/to/yubikey'},
+            hook_config={'yubikey': '1:7370001'},
             config={},
             credential_parameters=('database.kdbx', 'mypassword'),
         )
@@ -201,7 +201,7 @@ def test_load_credential_with_key_file_and_yubikey():
             '--key-file',
             '/path/to/keyfile',
             '--yubikey',
-            '/path/to/yubikey',
+            '2',
             'database.kdbx',
             'mypassword',
         )
@@ -211,7 +211,7 @@ def test_load_credential_with_key_file_and_yubikey():
 
     assert (
         module.load_credential(
-            hook_config={'key_file': '/path/to/keyfile', 'yubikey': '/path/to/yubikey'},
+            hook_config={'key_file': '/path/to/keyfile', 'yubikey': '2'},
             config={},
             credential_parameters=('database.kdbx', 'mypassword'),
         )