docker / docker/docker-credential-helpers

docker-credential-pass does not work at all

Open
#118 11 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
1.3k
Forks
195
Avg merge
1d 20h
Merged PRs (30d)
5

Description

I've followed the setup instructions for pass from #102
When I use docker login now:

~# docker login my.private.reg:5050
error getting credentials - err: exit status 1, out: `error fetching password during initialization: exit status 2: gpg: decryption failed: No secret key`
~# docker-credential-pass list
{"my.private.reg:5050":"dransfeld@company.org"}
~# pass show docker-credential-helpers/docker-pass-initialized-check
test123
~# docker login my.private.reg:5050
Username (dransfeld@company.org):
Password:
Error: Password Required

As you can see, first docker-credential-pass is unable to open the password store failing with gpg: decryption failed: No secret key, whereas pass show <some-entry> will prompt for the gpg key passphrase.

Even when gpg-agent(?) has cached the private key allowing to access the password store without the passphrase, docker login pre-fills my username, but I still have to enter the registry password.

I've verified my private key is present in GPG and has the same ID as ~/.password-store/.gpg-id
Also, I've verified pass has stored the correct password in docker-credential-helpers/bXkucHJpdmF0ZS5yZWc6NTA1MAo\=/dransfeld@company.org and the subfolder is the registry's base64-encoded URI.

My ~/.docker/config.json:

{
	"HttpHeaders": {
			"User-Agent": "Docker-Client/18.03.1-ce (linux)"
	},
	"credsStore": "pass"
}

docker-credential-pass version: 0.6.0
GPG version: 2.2.4-1ubuntu1.1
pass version: v1.7.1
Docker version: 18.03.1-ce
OS: Ubuntu 18.04 x64 server

Expected behavior
I expected no password prompt and a successful login to my.private.reg:5050 (or just the gpg passphrase prompt from pass) when running docker login

Observed behavior
No prompt for GPG passphrase, prompt for registry password

What's wrong with my setup?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure through docker login and docker-credential-pass, then compare its GPG behavior with the pass show command described in the report. Investigate the credential helper's interaction with the pass store and gpg-agent; done means credentials can be retrieved without an unexpected registry-password prompt or the behavior is documented as a setup issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go, linux
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.