Ramblings of an aging IT geek
← Ramblings of an aging IT geek
linux

KeePassXC Joins the Collection

rosec gains a KeePassXC provider, reading a .kdbx file straight onto the Secret Service bus, SSH keys and TOTP seeds included.

John Mylchreest
John Mylchreest
· 1 min read
Listen to this post
A laptop with KeePassXC open and a key beside it

The provider list keeps growing, and this one I'd wanted from the start. rosec can now read a KeePassXC .kdbx file directly: unlock it, list its entries, and serve them on the Secret Service bus next to Bitwarden, your local vault and a migrating GNOME Keyring. A libsecret lookup doesn't care which one answered.

The nice part is what comes along for the ride. KeePassXC stores more than passwords, and rosec picks up the rest of it:

  • SSH keys in the database, including KeePassXC's own KeeAgent attachments, register with rosec's built-in SSH agent automatically. The keys you already keep in your .kdbx just work with ssh, no ssh-add.
  • TOTP seeds surface as live files under $XDG_RUNTIME_DIR/rosec/totp/, same as every other provider.
yay -S rosec-provider-keepassxc-file-bin
rosec provider add keepassxc-file
rosec unlock
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/rosec/agent.sock"
ssh-add -l            # keys straight out of your .kdbx

It's marked experimental: the .kdbx format has corners, and I'd rather under-promise on a file your whole credential life might live in. Try it against a copy first. Repo and docs, as ever, on GitHub.