feat: add support for gopass as a credential store

This change adds support for `gopass` as a credential store, based on
the `pass` implementation.

Closes: docker#138
Closes: docker#166
Signed-off-by: sudoforge <[email protected]>

Author: sudoforge

.github/workflows/build.yml

@@ -63,6 +63,12 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y dbus-x11 gnome-keyring libsecret-1-dev pass
+      -
+        name: Install gopass
+        env:
+          GOPASS_VERSION: v1.15.5
+        run: go install github.com/gopasspw/gopass@${{ env.GOPASS_VERSION }}
+
       -
         name: GPG conf
         if: ${{ matrix.os == 'ubuntu-20.04' }}
@@ -92,8 +98,20 @@ jobs:
         run: |
           if [ "${{ matrix.os }}" = "ubuntu-20.04" ]; then
             echo -e "trust\n5\ny" | gpg --batch --no-tty --command-fd 0 --edit-key 7D851EB72D73BDA0
+            # initialize password store for `pass`
             pass init 7D851EB72D73BDA0
           fi
+
+          # initialize password store for `gopass`
+          gopass config mounts.path /root/.gopass-password-store 1>/dev/null
+          gopass config core.autopush false 1>/dev/null
+          gopass config core.autosync false 1>/dev/null
+          gopass config core.exportkeys false 1>/dev/null
+          gopass config core.notifications false 1>/dev/null
+          gopass config core.color false 1>/dev/null
+          gopass config core.nopager true 1>/dev/null
+          gopass init --crypto gpgcli --storage fs 7D851EB72D73BDA0
+
           go test -short -v -coverprofile=./coverage.txt -covermode=atomic ./...
           go tool cover -func=./coverage.txt
         shell: bash

Dockerfile

@@ -5,6 +5,7 @@ ARG XX_VERSION=1.2.1
 ARG OSXCROSS_VERSION=11.3-r7-debian
 ARG GOLANGCI_LINT_VERSION=v1.51.1
 ARG DEBIAN_FRONTEND=noninteractive
+ARG GOPASS_VERSION=v1.15.5
 
 ARG PACKAGE=github.com/docker/docker-credential-helpers
 
@@ -68,12 +69,19 @@ RUN xx-apt-get install -y binutils gcc libc6-dev libgcc-10-dev libsecret-1-dev p
 
 FROM base AS test
 ARG DEBIAN_FRONTEND
+ARG GOPASS_VERSION
 RUN xx-apt-get install -y dbus-x11 gnome-keyring gpg-agent gpgconf libsecret-1-dev pass
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod \
+    GOFLAGS='' go install github.com/gopasspw/gopass@${GOPASS_VERSION}
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache \
     --mount=type=cache,target=/go/pkg/mod <<EOT
   set -e
+
   cp -r .github/workflows/fixtures /root/.gnupg
+  chmod 0400 /root/.gnupg
   gpg-connect-agent "RELOADAGENT" /bye
   gpg --import --batch --yes /root/.gnupg/7D851EB72D73BDA0.key
   gpg --update-trustdb
@@ -82,7 +90,20 @@ RUN --mount=type=bind,target=. \
   gpg-connect-agent "KEYINFO 3E2D1142AA59E08E16B7E2C64BA6DDC773B1A627" /bye
   gpg-connect-agent "PRESET_PASSPHRASE BA83FC8947213477F28ADC019F6564A956456163 -1 77697468207374757069642070617373706872617365" /bye
   gpg-connect-agent "KEYINFO BA83FC8947213477F28ADC019F6564A956456163" /bye
+
+  # initialize password store for `pass`
   pass init 7D851EB72D73BDA0
+
+  # initialize password store for `gopass`
+  gopass config mounts.path /root/.gopass-password-store 1>/dev/null
+  gopass config core.autopush false 1>/dev/null
+  gopass config core.autosync false 1>/dev/null
+  gopass config core.exportkeys false 1>/dev/null
+  gopass config core.notifications false 1>/dev/null
+  gopass config core.color false 1>/dev/null
+  gopass config core.nopager true 1>/dev/null
+  gopass init --crypto gpgcli --storage fs 7D851EB72D73BDA0
+
   gpg -k
 
   mkdir /out
@@ -106,7 +127,8 @@ RUN --mount=type=bind,target=. \
     --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
   set -ex
   xx-go --wrap
-  make build-pass build-secretservice PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+  make build-gopass build-pass build-secretservice PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+  xx-verify /out/docker-credential-gopass
   xx-verify /out/docker-credential-pass
   xx-verify /out/docker-credential-secretservice
 EOT
@@ -122,7 +144,8 @@ RUN --mount=type=bind,target=. \
   set -ex
   xx-go --wrap
   go install std
-  make build-osxkeychain build-pass PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+  make build-gopass build-osxkeychain build-pass PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+  xx-verify /out/docker-credential-gopass
   xx-verify /out/docker-credential-osxkeychain
   xx-verify /out/docker-credential-pass
 EOT
@@ -136,7 +159,9 @@ RUN --mount=type=bind,target=. \
     --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
   set -ex
   xx-go --wrap
-  make build-wincred PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+  make build-gopass build-wincred PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+  mv /out/docker-credential-gopass /out/docker-credential-gopass.exe
+  xx-verify /out/docker-credential-gopass.exe
   mv /out/docker-credential-wincred /out/docker-credential-wincred.exe
   xx-verify /out/docker-credential-wincred.exe
 EOT

Makefile

@@ -16,11 +16,12 @@ clean:
 	rm -rf bin
 
 .PHONY: build-%
-build-%: # build, can be one of build-osxkeychain build-pass build-secretservice build-wincred
+build-%: # build, can be one of build-gopass build-osxkeychain build-pass build-secretservice build-wincred
 	go build -trimpath -ldflags="$(GO_LDFLAGS) -X ${GO_PKG}/credentials.Name=docker-credential-$*" -o "$(DESTDIR)/docker-credential-$*" ./$*/cmd/
 
 # aliases for build-* targets
-.PHONY: osxkeychain secretservice pass wincred
+.PHONY: gopass osxkeychain secretservice pass wincred
+gopass: build-gopass
 osxkeychain: build-osxkeychain
 secretservice: build-secretservice
 pass: build-pass

README.md

@@ -77,15 +77,26 @@ You can see examples of each function in the [client](https://godoc.org/github.c
 
 ### Available programs
 
-1. osxkeychain: Provides a helper to use the OS X keychain as credentials store.
-2. secretservice: Provides a helper to use the D-Bus secret service as credentials store.
-3. wincred: Provides a helper to use Windows credentials manager as store.
-4. pass: Provides a helper to use `pass` as credentials store.
+- gopass: Provides a helper to use `gopass` as credentials store.
+- osxkeychain: Provides a helper to use the OS X keychain as credentials store.
+- pass: Provides a helper to use `pass` as credentials store.
+- secretservice: Provides a helper to use the D-Bus secret service as credentials store.
+- wincred: Provides a helper to use Windows credentials manager as store.
 
-#### Note
+#### Note regarding `gopass`
 
-`pass` needs to be configured for `docker-credential-pass` to work properly.
-It must be initialized with a `gpg2` key ID. Make sure your GPG key exists is in `gpg2` keyring as `pass` uses `gpg2` instead of the regular `gpg`.
+`gopass` requires manual intervention in order for `docker-credential-gopass` to
+work properly: a password store must be initialized. Please ensure to review the
+upstream [quick start guide][gopass-quick-start] for more information.
+
+[gopass-quick-start]: https://github.com/gopasspw/gopass#quick-start-guide
+
+#### Note regarding `pass`
+
+`pass` requires manual interview in order for `docker-credential-pass` to
+work properly. It must be initialized with a `gpg2` key ID. Make sure your GPG
+key exists is in `gpg2` keyring as `pass` uses `gpg2` instead of the regular
+`gpg`.
 
 ## Development
 

gopass/cmd/main.go

@@ -0,0 +1,10 @@
+package main
+
+import (
+	"github.com/docker/docker-credential-helpers/credentials"
+	"github.com/docker/docker-credential-helpers/gopass"
+)
+
+func main() {
+	credentials.Serve(gopass.Gopass{})
+}