Document how to initialize docker-credentials-pass

[pasih]

Hi,

the README currently says:
"pass needs to be configured for docker-credential-pass to work properly. It must be initialized with a gpg2 key ID. Make sure your GPG key exists is in gpg2 keyring as pass uses gpg2 instead of the regular gpg."

However, I could not find any documentation whatsoever on the initialization. There doesn't seem to be a docker-credentials-pass init command? It would be helpful to actually document the steps how to initialize the pass store.

(I can create a pull request for README changes once I figure out how to actually do the initialization)

[Ayrat-Kh]

Hi. I`m sorry for my English. After spending some time, i was able to setup credential store and maybe my experience will help you.

I used ubuntu 18.04 and did all action as root user.

1. download "docker-credential-pass".
   wget https://github.com/docker/docker-credential-helpers/releases/download/v0.6.0/docker-credential-pass-v0.6.0-amd64.tar.gz

2. unpack tar -xf docker-credential-pass-v0.6.0-amd64.tar.gz

3. i couldn`t configure $PATH environment variable, so i copied unpacked file to /usr/bin directory.

4. check that docker-credential-pass work. To do this, run command docker-credential-pass. You should see: "Usage: docker-credential-pass <store|get|erase|list|version>".

5. install gpg and pass. apt install gpg pass

6. gpg --generate-key. Enter your name, mail, etc. You will get gpg-id like "5BB54DF1XXXXXXXXF87XXXXXXXXXXXXXX945A". Copy it to clipboard.

7. pass init (paste from clipboard)

8. pass insert docker-credential-helpers/docker-pass-initialized-check and set the next password "pass is initialized" (without quotes).

9. pass show docker-credential-helpers/docker-pass-initialized-check. You should see pass is initialized.

10. docker-credential-pass list. You should see {} or another data. You shouldn`t see error like "pass store is uninitialized".

11. nano ~/.docker/config.json. Set in root node the next line "credsStore": "pass" save ctrl+o.

12. after docker login and etc.

I'm not a guru on unux based OS and some actions can be done better. I hope someone will help my answer.

[nathanfiscus]

@pasih, here is what i did to get my docker client working with docker-credentials-pass. I have slight variations from what @Ayrat-Kh did.

1. Install pass

sudo apt-get install pass

2. Download, extract, make executable, and move docker-credential-pass

wget https://github.com/docker/docker-credential-helpers/releases/download/v0.6.0/docker-credential-pass-v0.6.0-amd64.tar.gz && tar -xf docker-credential-pass-v0.6.0-amd64.tar.gz && chmod +x docker-credential-pass && sudo mv docker-credential-pass /usr/local/bin/

3. Create a new gpg2 key.

gpg2 --gen-key

4. Follow prompts from gpg2 utility

5. Initialize pass using the newly created key

pass init "<Your Name>"

6. Add credsStore to your docker config. This can be done with sed if you don't already have credStore added to your config or you can manually add "credStore":"pass" to the config.json.

sed -i '0,/{/s/{/{\n\t"credsStore": "pass",/' ~/.docker/config.json

7. Login to docker

docker login

References:
https://hackernoon.com/getting-rid-of-docker-plain-text-credentials-88309e07640d
https://www.passwordstore.org/

[visualex]

Another slight variation, as I needed to use /dev/urandom
apparently I was running out of entropy and gpg2 --gen-key was hanging on the "generating random numbers .... " part

wget https://github.com/docker/docker-credential-helpers/releases/download/v0.6.0/docker-credential-pass-v0.6.0-amd64.tar.gz && tar -xf docker-credential-pass-v0.6.0-amd64.tar.gz && chmod +x docker-credential-pass && sudo mv docker-credential-pass /usr/local/bin/

yes | sudo apt install pass
yes | sudo apt install rng-tools
yes | sudo apt install rng-tools5
gpg-agent --daemon --use-standard-socket --pinentry-program /usr/bin/pinentry-curses
sudo rngd -r /dev/urandom
gpg2 --gen-key
pass init "Your Name"
sed -i '0,/{/s/{/{\n\t"credsStore": "pass",/' ~/.docker/config.json
docker login your-registry:5000

[CodingKoopa]

8. pass insert docker-credential-helpers/docker-pass-initialized-check and set the next password "pass is initialized" (without quotes).
9. pass show docker-credential-helpers/docker-pass-initialized-check. You should see pass is initialized.
10. docker-credential-pass list. You should see {} or another data. You shouldn`t see error like "pass store is uninitialized".

I had to follow these steps of @Ayrat-Kh's to get docker-credential-pass list to print anything other than "pass store is uninitialized". After doing this, though, I was able to rm ~/.password-store, run pass init $ID again, and have it as expected, without having to do steps 8-10 again.

[edingroot]

If the passphrase is not empty while generating gpg key, got following error message when running docker login your-registry:5000 with version v0.6.1.

Error saving credentials: error storing credentials - err: exit status 1, out: `error fetching password during initialization: exit status 2: gpg: cancelled by user
gpg: decryption failed: No secret key`

The error was thrown by pass_linux.go#L64 which the script is trying to run

pass show ~/.password-store/docker-pass-initialized-check

Caused by a prompt popped out for asking the passphrase, due to there is no input, error message
exit status 2: gpg: cancelled by user was caught.

Thus, entering passphrase by running the command above manually could temporally solve the problem.

[neomatrix369]

@nathanfiscus thanks for the steps mentioned #102 (comment), I didn't find it was very clear from the docs at
#102 - I did the extra step of downloading the docker-credentials-pass and it worked fine. I'm thinking docker-credentials-pass is the wrapper around pass so we need both of them present

👍 ❤️

[krisbalaa]

@nathanfiscus Excellent. Thanks for the steps. I would like to handle entering the passphrase through bash script for the following command.
pass show ~/.password-store/docker-pass-initialized-check
Is it possible?

[mkjmdski]

If you follow this guide and somehow you can't generate gpg key because gpg process is hanging, please install rng-tools and run its deamon by rngd -r /dev/urandom to generate enough random noise in your system to generate the key. You can observe your noise by cat /proc/sys/kernel/random/entropy_avail. Also using gnupg2 could help.