From 23009e22aa3f9f96cbf836435e01a6ccf2605269 Mon Sep 17 00:00:00 2001
From: Dan Helfman <witten@torsion.org>
Date: Mon, 3 Feb 2025 23:20:31 -0800
Subject: [PATCH] When both "encryption_passcommand" and
 "encryption_passphrase" are configured, prefer "encryption_passphrase" even
 if it's an empty value (#987).

---
 NEWS                                |  2 ++
 borgmatic/borg/passcommand.py       |  2 +-
 tests/unit/borg/test_passcommand.py | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 9e81eae9..25b6a918 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,7 @@
 1.9.10.dev0
  * #987: Fix a "list" action error when the "encryption_passcommand" option is set.
+ * #987: When both "encryption_passcommand" and "encryption_passphrase" are configured, prefer
+   "encryption_passphrase" even if it's an empty value.
 
 1.9.9
  * #635: Log the repository path or label on every relevant log message, not just some logs.
diff --git a/borgmatic/borg/passcommand.py b/borgmatic/borg/passcommand.py
index 2574ce23..f70a1392 100644
--- a/borgmatic/borg/passcommand.py
+++ b/borgmatic/borg/passcommand.py
@@ -47,4 +47,4 @@ def get_passphrase_from_passcommand(config):
     passphrase = config.get('encryption_passphrase')
     working_directory = borgmatic.config.paths.get_working_directory(config)
 
-    return run_passcommand(passcommand, bool(passphrase), working_directory)
+    return run_passcommand(passcommand, bool(passphrase is not None), working_directory)
diff --git a/tests/unit/borg/test_passcommand.py b/tests/unit/borg/test_passcommand.py
index 2b6161c8..198cfd15 100644
--- a/tests/unit/borg/test_passcommand.py
+++ b/tests/unit/borg/test_passcommand.py
@@ -53,3 +53,19 @@ def test_get_passphrase_from_passcommand_with_configured_passphrase_and_passcomm
         )
         is None
     )
+
+
+def test_get_passphrase_from_passcommand_with_configured_blank_passphrase_and_passcommand_detects_passphrase():
+    flexmock(module.borgmatic.config.paths).should_receive('get_working_directory').and_return(
+        '/working'
+    )
+    flexmock(module).should_receive('run_passcommand').with_args(
+        'command', True, '/working'
+    ).and_return(None).once()
+
+    assert (
+        module.get_passphrase_from_passcommand(
+            {'encryption_passphrase': '', 'encryption_passcommand': 'command'},
+        )
+        is None
+    )