Implement SSH upload-pack fetches

crates/storage/src/authentication.rs

@@ -15,7 +15,7 @@ use std::{
 
 use crate::{
     crypto::{KeyInfo, SecretProvider, SecretProviderError},
-    git::{GitCredential, GitCredentialProvider, GitError},
+    git::{GitCredential, GitCredentialProvider, GitError, SshPassphraseProvider},
     repository::SecretBytes,
     secret_store::{
         NativeSecretBackend, SecretCachePolicy, SecretProtectionPolicy, SecretReference,
@@ -441,6 +441,33 @@ impl<B: SecretStoreBackend, C: AuthenticationClock> GitCredentialProvider
     }
 }
 
+impl<B: SecretStoreBackend, C: AuthenticationClock> SshPassphraseProvider
+    for AuthenticationHandle<B, C>
+{
+    fn ssh_key_passphrase(
+        &self,
+        fingerprint: &crate::config::SshFingerprint,
+    ) -> Result<SecretBytes, GitError> {
+        let _operation =
+            self.shared
+                .operation()
+                .map_err(|_| GitError::SshKeyPassphraseUnavailable {
+                    fingerprint: fingerprint.clone(),
+                })?;
+        self.shared
+            .expire_if_needed()
+            .map_err(|_| GitError::SshKeyPassphraseUnavailable {
+                fingerprint: fingerprint.clone(),
+            })?;
+        self.shared
+            .with_active(self.generation, |_| ())
+            .map_err(|_| GitError::SshKeyPassphraseUnavailable {
+                fingerprint: fingerprint.clone(),
+            })?;
+        self.shared.store.ssh_key_passphrase(fingerprint)
+    }
+}
+
 impl<B: SecretStoreBackend, C: AuthenticationClock> Shared<B, C> {
     fn operation(&self) -> Result<std::sync::MutexGuard<'_, ()>, AuthenticationError> {
         self.operation