How can I set up a password command in mbsync?

Question

The manual for isync/mbsync says I can use PassCmd instead of Pass :

PassCmd [+]command

Specify a shell command to obtain a password rather than specifying a password directly. This allows you to use password files and agents. The command must produce exactly one line on stdout; the trailing newline is optional. Prepend + to the command to indicate that it produces TTY output (e.g., a decryption password prompt); failure to do so will merely produce messier output.

So I've tried:

PassCmd +"/nix/store/wjn7l5jdpsd5kb47z0dzqp37y7m533rb-password-store-1.7.3/bin/pass protonmail-bridge"

and

PassCmd "/nix/store/wjn7l5jdpsd5kb47z0dzqp37y7m533rb-password-store-1.7.3/bin/pass protonmail-bridge"

and other variations, but nothing works—I keep getting Authenticating with SASL mechanism PLAIN...IMAP command 'AUTHENTICATE PLAIN <authdata>' returned an error: NO backend/credentials: incorrect password .

Yet: other invocations of pass within mbsync work just as expected, and I'm writing them the same exact way.

I can get mbsync to work if I use Pass my-password instead, but I don't want to store my password in plain text.

I can verify that the output of the pass command is exactly the same as the password which works with Pass . So something is going wrong, and I can't figure it out.

I've also tried adding a trailing newline to the file echoed by pass , and adding several newlines. I've tried appending | head | head to the command, too, to see if that works.

How can I get PassCmd to work as expected?

I'm on NixOS, BTW.

Answer 1

The manual for isync/mbsync says I can use PassCmd instead of Pass :

PassCmd [+]command

Specify a shell command to obtain a password rather than specifying a password directly. This allows you to use password files and agents. The command must produce exactly one line on stdout; the trailing newline is optional. Prepend + to the command to indicate that it produces TTY output (e.g., a decryption password prompt); failure to do so will merely produce messier output.

So I've tried:

PassCmd +"/nix/store/wjn7l5jdpsd5kb47z0dzqp37y7m533rb-password-store-1.7.3/bin/pass protonmail-bridge"

and

PassCmd "/nix/store/wjn7l5jdpsd5kb47z0dzqp37y7m533rb-password-store-1.7.3/bin/pass protonmail-bridge"

and other variations, but nothing works—I keep getting Authenticating with SASL mechanism PLAIN...IMAP command 'AUTHENTICATE PLAIN <authdata>' returned an error: NO backend/credentials: incorrect password .

Yet: other invocations of pass within mbsync work just as expected, and I'm writing them the same exact way.

I can get mbsync to work if I use Pass my-password instead, but I don't want to store my password in plain text.

I can verify that the output of the pass command is exactly the same as the password which works with Pass . So something is going wrong, and I can't figure it out.

I've also tried adding a trailing newline to the file echoed by pass , and adding several newlines. I've tried appending | head | head to the command, too, to see if that works.

How can I get PassCmd to work as expected?

I'm on NixOS, BTW.