diff --git a/borgmatic/config/schema.yaml b/borgmatic/config/schema.yaml index 85fcb9d0e..991b072dc 100644 --- a/borgmatic/config/schema.yaml +++ b/borgmatic/config/schema.yaml @@ -2691,8 +2691,12 @@ properties: yubikey: type: string description: | - Path or identifier for the YubiKey to use for unlocking the KeePassXC database. - example: /path/to/yubikey + YubiKey slot and optional serial number used to access the KeePassXC database. + Format: "", where: + - is the YubiKey slot number (e.g., `1` or `2`). + - (optional) is the YubiKey's serial number (e.g., `1:7370001`). + example: "1:7370001" + description: | Configuration for integration with the KeePassXC password manager. default_actions: diff --git a/borgmatic/hooks/credential/keepassxc.py b/borgmatic/hooks/credential/keepassxc.py index e3799da96..acaeb449f 100644 --- a/borgmatic/hooks/credential/keepassxc.py +++ b/borgmatic/hooks/credential/keepassxc.py @@ -16,7 +16,7 @@ def load_credential(hook_config, config, credential_parameters): Raise ValueError if keepassxc-cli can't retrieve the credential. ''' try: - database_path, attribute_name = credential_parameters[:2] + (database_path, attribute_name) = credential_parameters except ValueError: raise ValueError( f'Invalid KeePassXC credential parameters: {credential_parameters}') diff --git a/tests/unit/hooks/credential/test_keepassxc.py b/tests/unit/hooks/credential/test_keepassxc.py index b3d013667..d34b72325 100644 --- a/tests/unit/hooks/credential/test_keepassxc.py +++ b/tests/unit/hooks/credential/test_keepassxc.py @@ -166,7 +166,7 @@ def test_load_credential_with_yubikey(): '--attributes', 'Password', '--yubikey', - '/path/to/yubikey', + '1:7370001', 'database.kdbx', 'mypassword', ) @@ -176,7 +176,7 @@ def test_load_credential_with_yubikey(): assert ( module.load_credential( - hook_config={'yubikey': '/path/to/yubikey'}, + hook_config={'yubikey': '1:7370001'}, config={}, credential_parameters=('database.kdbx', 'mypassword'), ) @@ -201,7 +201,7 @@ def test_load_credential_with_key_file_and_yubikey(): '--key-file', '/path/to/keyfile', '--yubikey', - '/path/to/yubikey', + '2', 'database.kdbx', 'mypassword', ) @@ -211,7 +211,7 @@ def test_load_credential_with_key_file_and_yubikey(): assert ( module.load_credential( - hook_config={'key_file': '/path/to/keyfile', 'yubikey': '/path/to/yubikey'}, + hook_config={'key_file': '/path/to/keyfile', 'yubikey': '2'}, config={}, credential_parameters=('database.kdbx', 'mypassword'), )