func (r *sshrimpAgent) List() ([]*agent.Key, error) {
	unixNow := time.Now().Unix()
	before := int64(r.certificate.ValidBefore)
	if r.certificate.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before || before < 0) {
		err := r.providerConfig.Authenticate(r.token)
		if err != nil {
			return nil, err
		}
		cert, err := signer.SignCertificateAllRegions(r.signer.PublicKey(), r.token.IDToken, "", r.config)
		if err != nil {
			return nil, err
		}
		r.certificate = cert
	}
	var ids []*agent.Key
	ids = append(ids, &agent.Key{
		Format:  r.certificate.Type(),
		Blob:    r.certificate.Marshal(),
		Comment: r.certificate.KeyId,
	})
	return ids, nil
}
List returns the identities, but also signs the certificate using sshrimp-ca if expired.
package sshrimpagent
import (
	"crypto/rand"
	"errors"
	"time"
	"github.com/stoggi/aws-oidc/provider"
	"github.com/stoggi/sshrimp/internal/config"
	"github.com/stoggi/sshrimp/internal/signer"
	"golang.org/x/crypto/ssh"
	"golang.org/x/crypto/ssh/agent"
)
type sshrimpAgent struct {
	providerConfig provider.ProviderConfig
	signer         ssh.Signer
	certificate    *ssh.Certificate
	token          *provider.OAuth2Token
	config         *config.SSHrimp
}
func NewSSHrimpAgent(c *config.SSHrimp, signer ssh.Signer) agent.Agent {
	providerConfig := provider.ProviderConfig{
		ClientID:     c.Agent.ClientID,
		ClientSecret: c.Agent.ClientSecret,
		ProviderURL:  c.Agent.ProviderURL,
		PKCE:         true,
		Nonce:        true,
		AgentCommand: c.Agent.BrowserCommand,
	}
	return &sshrimpAgent{
		providerConfig: providerConfig,
		signer:         signer,
		certificate:    &ssh.Certificate{},
		token:          &provider.OAuth2Token{},
		config:         c,
	}
}
func (r *sshrimpAgent) RemoveAll() error {
	r.certificate = &ssh.Certificate{}
	r.token = &provider.OAuth2Token{}
	return nil
}
func (r *sshrimpAgent) Remove(key ssh.PublicKey) error {
	return r.RemoveAll()
}
func (r *sshrimpAgent) Lock(passphrase []byte) error {
	return errors.New("sshrimp-agent: locking not supported")
}
func (r *sshrimpAgent) Unlock(passphrase []byte) error {
	return errors.New("sshrimp-agent: unlocking not supported")
}