ssh issues with encrypted identity files on MacOS

[dtrifiro]

SSH on MacOS provides the UseKeychain option (man ssh_config) that makes it possible to decrypt encrypted ssh identity files on-the-fly by retrieving the passphrase from MacOS' keychain.

This works with git clone and other git cli commands, but fails when using certain dvc operations (dvc exp list, dvc get, ...) because the ssh vendor we use for git operations and for remote operations (asyncssh) does not support Apple keychain integration.

Using UseKeychain can result in authentication issues (unexpected CloneError or Permission Denied errors).

The solution is to decrypt the ssh key and add it to the ssh agent:

ssh-add --apple-load-keychain ~/.ssh/ed255

(note that --apple-load-keychain used to be -A)

By adding the key to the ssh-agent, asyncssh is able to properly use the (decrypted) key.

First noted by @shcheklein in treeverse/dvc#7702 (comment)_

[pmrowla]

reposting from treeverse/scmrepo#210 (comment)

Porting the apple openssh to asyncssh is non-trivial and probably not what we want. What we should be doing in dulwich is checking for unsupported configuration options in our asyncssh vendor (like UseKeychain which specifies using the apple keychain behavior) and then fallback to the default dulwich SSH vendor instead (which just calls system ssh via subprocess, and would use apple's openssh build and work as expected).

We default to using asyncssh since it removes a dependency on ssh, which is not always available in windows (or in containers)

[efiop]

@pmrowla Thank you for clarifying! That sounds very good.