integrate with ssh-agent

[andrewhsu]

Currently, the private keys used to sign images are on the disk as a file somewhere under ~/.docker/trust. Would be nice to leverage ssh-agent for accessing the keys. This would allow a docker push operation to proceed without prompting the user for the passphrase to access the private keys.

Some technical notes related to the topic:

• package agent to talk to ssh-agent over socket
• ssh-agent protocol

[cyli]

Also related, docker recently merged external credential stores for storing passwords: https://github.com/docker/docker/pull/20107/

I'm not sure this actually stores private key material but possibly key passwords can be kept in these external stores as well.

[endophage]

Not sure if the ssh agent is the right thing here but something like a gpg agent integration might be. SSH runs the risk of key enumeration by remote servers which might be relevant if somebody is using private repositories (public notary repositories enable all public keys to be discovered via the notary metadata).

https://blog.filippo.io/ssh-whoami-filippo-io/