4 files changed, 44 insertions, 11 deletions
diff --git a/internal/readpassword/extpass_test.go b/internal/readpassword/extpass_test.go
index 037d111..b4ca8fa 100644
--- a/internal/readpassword/extpass_test.go
+++ b/internal/readpassword/extpass_test.go
@@ -18,7 +18,7 @@ func TestMain(m *testing.M) {
 
 func TestExtpass(t *testing.T) {
 	p1 := "ads2q4tw41reg52"
-	p2 := string(readPasswordExtpass("echo " + p1))
+	p2 := string(readPasswordExtpass([]string{"echo " + p1}))
 	if p1 != p2 {
 		t.Errorf("p1=%q != p2=%q", p1, p2)
 	}
@@ -26,7 +26,33 @@ func TestExtpass(t *testing.T) {
 
 func TestOnceExtpass(t *testing.T) {
 	p1 := "lkadsf0923rdfi48rqwhdsf"
-	p2 := string(Once("echo "+p1, "", ""))
+	p2 := string(Once([]string{"echo " + p1}, "", ""))
+	if p1 != p2 {
+		t.Errorf("p1=%q != p2=%q", p1, p2)
+	}
+}
+
+// extpass with two arguments
+func TestOnceExtpass2(t *testing.T) {
+	p1 := "foo"
+	p2 := string(Once([]string{"echo", p1}, "", ""))
+	if p1 != p2 {
+		t.Errorf("p1=%q != p2=%q", p1, p2)
+	}
+}
+
+// extpass with three arguments
+func TestOnceExtpass3(t *testing.T) {
+	p1 := "foo bar baz"
+	p2 := string(Once([]string{"echo", "foo", "bar", "baz"}, "", ""))
+	if p1 != p2 {
+		t.Errorf("p1=%q != p2=%q", p1, p2)
+	}
+}
+
+func TestOnceExtpassSpaces(t *testing.T) {
+	p1 := "mypassword"
+	p2 := string(Once([]string{"cat", "passfile_test_files/file with spaces.txt"}, "", ""))
 	if p1 != p2 {
 		t.Errorf("p1=%q != p2=%q", p1, p2)
 	}
@@ -34,7 +60,7 @@ func TestOnceExtpass(t *testing.T) {
 
 func TestTwiceExtpass(t *testing.T) {
 	p1 := "w5w44t3wfe45srz434"
-	p2 := string(Once("echo "+p1, "", ""))
+	p2 := string(Once([]string{"echo " + p1}, "", ""))
 	if p1 != p2 {
 		t.Errorf("p1=%q != p2=%q", p1, p2)
 	}
@@ -46,7 +72,7 @@ func TestTwiceExtpass(t *testing.T) {
 // https://talks.golang.org/2014/testing.slide#23 .
 func TestExtpassEmpty(t *testing.T) {
 	if os.Getenv("TEST_SLAVE") == "1" {
-		readPasswordExtpass("echo")
+		readPasswordExtpass([]string{"echo"})
 		return
 	}
 	cmd := exec.Command(os.Args[0], "-test.run=TestExtpassEmpty$")
diff --git a/internal/readpassword/passfile_test.go b/internal/readpassword/passfile_test.go
index 30f976f..cb7fa44 100644
--- a/internal/readpassword/passfile_test.go
+++ b/internal/readpassword/passfile_test.go
@@ -14,6 +14,7 @@ func TestPassfile(t *testing.T) {
 		{"mypassword.txt", "mypassword"},
 		{"mypassword_garbage.txt", "mypassword"},
 		{"mypassword_missing_newline.txt", "mypassword"},
+		{"file with spaces.txt", "mypassword"},
 	}
 	for _, tc := range testcases {
 		pw := readPassFile("passfile_test_files/" + tc.file)
diff --git a/internal/readpassword/passfile_test_files/file with spaces.txt b/internal/readpassword/passfile_test_files/file with spaces.txt
new file mode 100644
index 0000000..48d23cf
--- /dev/null
+++ b/internal/readpassword/passfile_test_files/file with spaces.txt
@@ -0,0 +1 @@
+mypassword
diff --git a/internal/readpassword/read.go b/internal/readpassword/read.go
index 0378e53..060100b 100644
--- a/internal/readpassword/read.go
+++ b/internal/readpassword/read.go
@@ -24,11 +24,11 @@ const (
 
 // Once tries to get a password from the user, either from the terminal, extpass
 // or stdin. Leave "prompt" empty to use the default "Password: " prompt.
-func Once(extpass string, passfile string, prompt string) []byte {
+func Once(extpass []string, passfile string, prompt string) []byte {
 	if passfile != "" {
 		return readPassFile(passfile)
 	}
-	if extpass != "" {
+	if len(extpass) != 0 {
 		return readPasswordExtpass(extpass)
 	}
 	if prompt == "" {
@@ -42,11 +42,11 @@ func Once(extpass string, passfile string, prompt string) []byte {
 
 // Twice is the same as Once but will prompt twice if we get the password from
 // the terminal.
-func Twice(extpass string, passfile string) []byte {
+func Twice(extpass []string, passfile string) []byte {
 	if passfile != "" {
 		return readPassFile(passfile)
 	}
-	if extpass != "" {
+	if len(extpass) != 0 {
 		return readPasswordExtpass(extpass)
 	}
 	if !terminal.IsTerminal(int(os.Stdin.Fd())) {
@@ -99,9 +99,14 @@ func readPasswordStdin(prompt string) []byte {
 // readPasswordExtpass executes the "extpass" program and returns the first line
 // of the output.
 // Exits on read error or empty result.
-func readPasswordExtpass(extpass string) []byte {
-	tlog.Info.Println("Reading password from extpass program")
-	parts := strings.Split(extpass, " ")
+func readPasswordExtpass(extpass []string) []byte {
+	var parts []string
+	if len(extpass) == 1 {
+		parts = strings.Split(extpass[0], " ")
+	} else {
+		parts = extpass
+	}
+	tlog.Info.Printf("Reading password from extpass program %q, arguments: %q\n", parts[0], parts[1:])
 	cmd := exec.Command(parts[0], parts[1:]...)
 	cmd.Stderr = os.Stderr
 	pipe, err := cmd.StdoutPipe()