{"id":18660337,"url":"https://github.com/frederick888/git-credential-keepassxc","last_synced_at":"2025-05-15T13:05:48.140Z","repository":{"id":43299556,"uuid":"262435420","full_name":"Frederick888/git-credential-keepassxc","owner":"Frederick888","description":"Helper that allows Git (and shell scripts) to use KeePassXC as credential store","archived":false,"fork":false,"pushed_at":"2025-01-30T09:47:34.000Z","size":861,"stargazers_count":226,"open_issues_count":11,"forks_count":11,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-05-10T02:06:33.323Z","etag":null,"topics":["cli","command-line","command-line-tool","git","keepass","keepassxc","password-manager","password-safety","password-store","rust","shell-scripting"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Frederick888.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-08T21:48:32.000Z","updated_at":"2025-05-09T02:26:06.000Z","dependencies_parsed_at":"2024-01-06T01:08:00.984Z","dependency_job_id":"36bf72cb-d6e2-4c65-a72d-d23409dc1bad","html_url":"https://github.com/Frederick888/git-credential-keepassxc","commit_stats":{"total_commits":335,"total_committers":6,"mean_commits":"55.833333333333336","dds":"0.017910447761193993","last_synced_commit":"5cb8047d6d9684d5c63081cc675fff850f6e221d"},"previous_names":[],"tags_count":37,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Frederick888%2Fgit-credential-keepassxc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Frederick888%2Fgit-credential-keepassxc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Frederick888%2Fgit-credential-keepassxc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Frederick888%2Fgit-credential-keepassxc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Frederick888","download_url":"https://codeload.github.com/Frederick888/git-credential-keepassxc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254346624,"owners_count":22055808,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","command-line","command-line-tool","git","keepass","keepassxc","password-manager","password-safety","password-store","rust","shell-scripting"],"created_at":"2024-11-07T07:43:22.105Z","updated_at":"2025-05-15T13:05:48.110Z","avatar_url":"https://github.com/Frederick888.png","language":"Rust","readme":"# `git-credential-keepassxc`\n\n[![GitHub Actions Status](https://github.com/Frederick888/git-credential-keepassxc/workflows/Build%20and%20Test/badge.svg)](https://github.com/Frederick888/git-credential-keepassxc/actions)\n[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)\n[![crates.io version](https://img.shields.io/crates/v/git-credential-keepassxc?color=greenyellow\u0026cacheSeconds=1800)](https://crates.io/crates/git-credential-keepassxc)\n\n`git-credential-keepassxc` is a [Git credential](https://git-scm.com/docs/gitcredentials) helper that allows Git (and shell scripts) to get/store logins from/to [KeePassXC](https://keepassxc.org/).\n\nIt communicates with KeePassXC using [keepassxc-protocol](https://github.com/keepassxreboot/keepassxc-browser/blob/develop/keepassxc-protocol.md), which was originally designed for browser extensions.\n\n## How to install\n\n### Quick\n\n1. Install [Rust](https://www.rust-lang.org/) compiler via [rustup](https://rustup.rs/) or your favourite package manager\n0. Run `cargo install --locked git-credential-keepassxc` and it will be installed to [Cargo installation root](https://doc.rust-lang.org/cargo/commands/cargo-install.html#description)\n\n### Pre-Built Binaries (Experimental)\n\nExperimental pre-built binaries are available at the [GitHub release page](https://github.com/Frederick888/git-credential-keepassxc/releases).\n\n`*-minimal` ones are built with no optional features, and `*-full` ones are built with all.\n\n### Optional features\n\n`git-credential-keepassxc` has the following optional features:\n\n| Feature         | Description                                                                                                      |\n|-----------------|------------------------------------------------------------------------------------------------------------------|\n| `all`           | Enable all features                                                                                              |\n| `notification`  | Desktop notifications, helpful if `git-credential-keepassxc` is used in scripts                                  |\n| `yubikey`       | Allow encrypting configuration file using YubiKey HMAC-SHA1                                                      |\n| `strict-caller` | Enforce caller limiting when associated databases exist (see [Limiting callers](#limiting-callers) for details!) |\n\nYou can use [cargo-update](https://crates.io/crates/cargo-update) to make the features persistent across updates.\n\n```sh\n# install cargo-update first\n$ cargo install --locked cargo-update\n# enable and persist features\n$ cargo install --locked --features \u003cFEATURE\u003e... git-credential-keepassxc\n# note the different order of package name and --feature (singular) flag\n$ cargo install-update-config git-credential-keepassxc --enforce-lock --feature \u003cFEATURE\u003e...\n\n# later when you update\n$ cargo install-update git-credential-keepassxc\n```\n\n## Configuration\n\nSimilar to the browser extensions, `git-credential-keepassxc` needs to be associated with KeePassXC first:\n\n```sh\n# enable browser integration in KeePassXC settings, then\n$ git-credential-keepassxc caller me  # only required if compiled with strict-caller, see Limiting callers\n$ git-credential-keepassxc configure\n$ git config --global --replace-all credential.helper 'keepassxc --git-groups'\n```\n\nA dedicated group (by default `Git`) will be created. If you want to use credentials from other groups, please check out [Filtering results](#filtering-results).\n\nFor more options, run `git-credential-keepassxc -h` to show the help message.\n\n## Limiting callers\n\n`git-credential-keepassxc` allows you to limit callers of the program:\n\n```sh\n# don't forget to add yourself first\n$ git-credential-keepassxc caller me\nGonna save current caller to allowed callers list:\n{\n  \"path\": \"/usr/bin/zsh\",\n  \"uid\": 1000,\n  \"gid\": 1000,\n  \"canonicalize\": false\n}\nPress Enter to continue...\n# then add Git\n$ git-credential-keepassxc caller add --uid \"$(id -u)\" --gid \"$(id -g)\" \"$(command -v git)\"\n# you may also need to add other executables in /usr/lib/git-core/\n# run `git config --global --replace-all credential.helper 'keepassxc -vv --git-groups'` to enable logs if any Git subcommand is blocked\n\n$ sh -c 'printf \"url=https://example.com\\nusername=foo\\n\" | git-credential-keepassxc get'\nMay 10 12:51:56.108 ERRO /usr/bin/bash (uid=1000, gid=1000) is not allowed to call git-credential-keepassxc, Caused by: N/A\n$ printf 'url=https://example.com\\nusername=foo\\n' | git credential fill\nMay 10 12:52:53.995 WARN Request get-logins failed. Error: No logins found, Error Code: 15\nMay 10 12:52:53.995 ERRO Request get-logins failed, Caused by: N/A, Message: Request get-logins failed\n\n# disable this function\n$ git-credential-keepassxc caller clear\n```\n\n*Note:* If you've enabled `strict-caller`, you must add caller profiles before configuring databases, otherwise you won't be able to run `git-credential-keepassxc` afterwards.\n\n## Encrypting KeePassXC keys using YubiKey\n\nBy default the keys for authentication are stored in plaintext, which can be particularly dangerous if you've allowed clients to retrieve any credentials without confirmation.\n\n`git-credential-keepassxc` is capable of encrypting these keys using YubiKey HMAC-SHA1 Challenge-Response. First make sure you've enabled the `yubikey` feature, then:\n\n```sh\n# encrypt using YubiKey slot 2 and a randomly generated challenge\n$ git-credential-keepassxc encrypt challenge-response\n```\n\nTo decrypt the keys:\n\n```sh\n$ git-credential-keepassxc decrypt\n```\n\nFor more details, see: [wiki/Encryption](https://github.com/Frederick888/git-credential-keepassxc/wiki/Encryption)\n\n## Filtering results\n\n### By group names\n\n`--group \u003cGROUP\u003e`. This option can be repeated. This is the name of the group itself. Paths are not supported.\n\n### By dedicated Git group names\n\n`--git-groups`. This uses the names of the groups created by `git-credential-keepassxc configure [--group \u003cGROUP\u003e]`.\n\nNote if you have more than one database, it's recommended to use the same group name, as this option filters all results using all the group names.\n\n### By an advanced string field\n\n1. In KeePassXC, go to Tools -\u003e Settings -\u003e Browser Integration -\u003e Advanced, enable `Return advanced string fields which start with \"KPH: \"` (this is enabled by default)\n0. Open the entry you'd like to hide\n0. Go to Advanced\n0. Add an additional attribute `KPH: git` (the space after colon is required) of which the value is `false`\n\n### A note on `git-credential-keepassxc store`\n\nSince `git-credential-keepassxc store` consists of looking up existing entries and then updating or creating one, these filters can also stop it from updating certain entries.\n\nThis is *important* as Git may call `git-credential-keepassxc store` after validating a password, and it can update your login password entry rather than the API token one.\n\n## Scripting\n\n`git-credential-keepassxc` can also help manage credentials in shell scripts. You can send a request via standard input in the [git-credential input/output format](https://git-scm.com/docs/git-credential#IOFMT) then process the response.\n\nAccepted fields in input (unknown fields are ignored):\n\n- `url`\n- `username`\n- `password` (`store` requests only)\n\nResponses are in the same format. Alternatively `get`, `totp`, and `generate-password` responses can also be formatted in JSON with `--json` flag; `get` and `totp` also support `--raw` flag.\n\nFor instance, to connect to a Remote Desktop service:\n\n```sh\n#!/usr/bin/env -S bash -euET -o pipefail -O inherit_errexit\n\ntrap 'notify-send \"RDP Failure\" \"Failed to connect to Remote Desktop service\"' ERR\n\nHOST=\"example.com\"\nPORT=\"3389\"\nUSERNAME=\"Administrator\"\nPASSWORD=\"$(printf 'url=rdp://%s:%s\\nusername=%s\\n' \"$HOST\" \"$PORT\" \"$USERNAME\" | git-credential-keepassxc get | sed -n 's/^password=//p')\"\n\nxfreerdp /v:\"$HOST:$PORT\" /cert-tofu /cert:ignore \\\n    /size:2560x1620 /smart-sizing /scale:140 /scale-desktop:140 /scale-device:140 \\\n    +compression /compression-level:2 +clipboard +themes +wallpaper \\\n    /t:Example +decorations /u:\"$USERNAME\" /p:\"$PASSWORD\"\n```\n\n## Troubleshooting and more\n\n[Wiki](https://github.com/Frederick888/git-credential-keepassxc/wiki)\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrederick888%2Fgit-credential-keepassxc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffrederick888%2Fgit-credential-keepassxc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrederick888%2Fgit-credential-keepassxc/lists"}