Skip to content

KeePass Folder Export (community preview)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@devbytexx devbytexx released this 01 Sep 18:51
v0.5.2-keepass-folders.1
08785b1

go-passbolt-cli — KeePass Folder Export (community preview build)

Unofficial preview build based on v0.5.2 (branch feature/keepass-folder-groups).
It overhauls passbolt export keepass and addresses several long-standing issues.

Fixed issues

  • passbolt#57 / passbolt#138 — KeePass export loses the folder hierarchy. The export now
    mirrors the Passbolt folder tree as nested KeePass groups. Resources
    without a folder go into the top group ("Passbolt Export"). Same-named
    sibling folders (legal in Passbolt) stay separate groups, folders whose
    parent is not shared with you attach to the top group instead of
    disappearing, and broken/cyclic folder data cannot hang the export.
  • passbolt#75 — Export a specific folder. New flag --folder <id> exports only
    that folder and its subfolders. Resources outside the subtree are not even
    decrypted, which makes partial exports of large vaults fast.
  • Related: PR passbolt#73 proposed a folder-structure export earlier; this build
    covers that ground and adds verification tests on the produced kdbx.

New in the KeePass export

  • TOTP works out of the box in both worlds. Every TOTP resource is
    written in two conventions: the otp otpauth:// field (KeePassXC,
    KeeOtp2) and the native TimeOtp-* fields used by the built-in
    generator of KeePass 2.x (Ctrl+T) — secret as Base32, digits, period and
    algorithm mapped.
  • --comments appends the Passbolt comment threads (with timestamps,
    replies indented) to the KeePass Notes field. Opt-in because it costs one
    API request per resource.
  • Tags, timestamps and expiry are carried over: Passbolt tags become
    KDBX entry tags, creation/modification times replace the "now" stamps,
    and expired resources get a KeePass expiry date.
  • Passbolt descriptions (including the encrypted description of
    password-and-description/v5 resources) and v5 custom fields were already
    exported and continue to land in Notes / protected custom fields.

Hardening and fixes

  • KeePass no longer warns about weak key transformation settings. The
    export now uses the KeePass 2.x defaults (600,000 AES-KDF rounds for
    KDBX 3.1, 64 MiB Argon2 memory for KDBX 4) instead of the library
    defaults (6,000 rounds / 1 MiB).
  • An empty export password is rejected instead of silently writing an
    unprotected kdbx. Interactive prompts now mask input with * and ask for
    the new password twice.
  • A resource without a secret is skipped with a message instead of crashing
    the whole export.
  • A failed export no longer leaves a partial .kdbx behind (temp file +
    atomic rename); write errors on close are reported.

Install

Debian/Ubuntu (.deb):

sudo dpkg -i go-passbolt-cli_*_amd64.deb

Windows: unzip and run passbolt.exe (no installation needed).

Linux (plain binary): untar, then install -m 0755 passbolt /usr/local/bin/.

The packages ship man pages (man passbolt-export-keepass) and shell
completions for bash/zsh/fish. Full command reference: doc/ (markdown) or
passbolt export keepass --help.

Usage

# full export, folder tree included
passbolt export keepass --file export.kdbx

# only one folder and its subfolders, with comments
passbolt export keepass --file customers.kdbx --folder <folder-id> --comments

# KDBX 4 / Argon2 instead of the KDBX 3.1 default
passbolt export keepass --file export.kdbx --kdbx-version v4

All changes are covered by unit tests plus an integration test that runs
against a live Passbolt 5.14.3 container, opens the produced kdbx and
asserts group placement and TOTP fields.

Assets 14
Loading