docker-credential-helpers VS pass-tomb

Docker supports a credential-helper module[0], which supports 4 different backends for fetching the docker registry credentials: osxkeychain, pass, wincred, and secretservice.

pass lets you use GPG-smartcards, and many of those (such as Yubikeys) will let you enforce touch-policies for signing/encruption.

As a combination of both these however, I must touch my Yubikey every time I pull a new docker image.

Another cool use-case is that I use the terraform-pass-provider to save secrets for my personal terraform project.

[0]: https://github.com/docker/docker-credential-helpers

# Finds the latest version $ wincred_version=$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/docker-credential-helpers/releases/latest) # Downloads and extracts the .exe $ sudo curl -fL \ "https://github.com/docker/docker-credential-helpers/releases/download/${wincred_version}/docker-credential-wincred-${wincred_version}-$(dpkg --print-architecture).zip" | zcat | sudo tee /usr/local/bin/docker-credential-wincred.exe >/dev/null # Assigns execution permission to it $ sudo chmod +x /usr/local/bin/docker-credential-wincred.exe

By itself, Passwordstore will not encrypt file names or directory names, which might not be a problem if no one else has access to the machine that hosts your git repo, but if that's not the case (even if it's a private repo on whatever platform), you might want to use either Tomb or git-crypt-remote to have full end-to-end encryption. There are even some tools that glue tomb and pass together (https://github.com/roddhjav/pass-tomb for one), though I'm not sure what's the situation is like when it comes to mobile integration with tomb/git-crypt-remote.

That can of course be fixed by using pass-tomb, but that isn’t implemented in mobile clients (at least not on iOS).

- https://pujol.io/blog/tomb-with-gpg-keys/ - https://github.com/roddhjav/pass-tomb

A plug-in called pass-tomb exists to fix this, but doesn’t work with mobile apps (a least not iOS)