KeePass export: mirror folder hierarchy, TOTP for KeePass 2, hardening - #139
Closed
devbytexx wants to merge 2 commits into
Closed
KeePass export: mirror folder hierarchy, TOTP for KeePass 2, hardening#139devbytexx wants to merge 2 commits into
devbytexx wants to merge 2 commits into
Conversation
Rework `passbolt export keepass` (fixes passbolt#57, passbolt#138, implements passbolt#75): - Mirror the Passbolt folder tree as nested KeePass groups. Folders are matched by ID (sibling names are not unique), folders whose parent is not shared attach to the top group, cyclic parent data cannot hang the export. Folderless resources stay in the top group. - New --folder flag: export only the given folder and its subfolders; resources outside the subtree are not decrypted at all. - New --comments flag: append Passbolt comment threads to the Notes field. - Write TOTP in both conventions: otpauth "otp" field (KeePassXC, KeeOtp2) and native TimeOtp-* fields for KeePass 2.x built-in generator. - Carry over tags, creation/modification timestamps and expiry dates. - Harden KDF settings to KeePass 2.x defaults (600k AES-KDF rounds for KDBX 3.1, 64 MiB Argon2 memory for KDBX 4); the library defaults triggered the KeePass "weak key transformation settings" warning. - Reject empty export passwords instead of writing an unprotected kdbx; mask interactive password input with '*' and confirm new passwords. - Skip resources without a secret instead of panicking; write to a temp file and rename on success so failed exports leave no partial kdbx. Verified by unit tests and an integration test that decodes the produced kdbx (new kdbxcheck testscript command) and asserts group placement and TimeOtp fields against a live Passbolt container. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Author
|
Prebuilt packages for testing are available here: The prerelease contains .deb/.rpm (amd64 + arm64), Windows zips, Linux/macOS tarballs, SHA-256 checksums and the generated command reference. Feedback welcome — especially from those affected by #57, #138 and #75. |
Author
|
recheck |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rework
passbolt export keepass(fixes #57, #138, implements #75):Verified by unit tests and an integration test that decodes the produced kdbx (new kdbxcheck testscript command) and asserts group placement and TimeOtp fields against a live Passbolt container.