fix: Docker auth config lookup portability #480
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AaronFriel
force-pushed
the
friel/auth-lookup
branch
from
a35850b to
c3b53f2
Compare
Does the PR have any schema changes?Looking good! No breaking changes found. |
AaronFriel
commented
Feb 3, 2023
| return "", nil, err | ||
| } | ||
|
|
||
| pushAuthConfig = types.AuthConfig(cliPushAuthConfig) |
There was a problem hiding this comment.
The concrete types that implement the interface providing GetAuthConfig perform the https:// fallback lookup, so we trust the library's behavior here.
Does the PR have any schema changes?Looking good! No breaking changes found. |
guineveresaenger
approved these changes
Feb 3, 2023
On various platforms, the Docker credentials store may return keys with URLs
with a scheme ("https://") prefixed on all entries, or hostnames only. An
exception to this is the legacy Docker index server, which appears as
"https://index.docker.io/v1/".
The push auth config is now selected by first resolving a valid ("non-legacy")
entry, which will be either a hostname aka registry name, or the
"https://index.docker.io/v1/" value. This value is then passed to
`GetAuthConfig`, using the Docker library's existing lookup fallback behavior to
handle URLs.
Two additional legacy names are handled, as discovered by reading the ORAS'
project's implementation with the same goal. See:
https://github.com/oras-project/oras-go/blob/v1.2.2/pkg/auth/docker/resolver.go#L79-L86
AaronFriel
force-pushed
the
friel/auth-lookup
branch
from
c3b53f2 to
5bd7cdd
Compare
Does the PR have any schema changes?Looking good! No breaking changes found. |
This was referenced Feb 9, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On various platforms, the Docker credentials store may return keys with URLs with a scheme ("https://") prefixed on all entries, or hostnames only. An exception to this is the legacy Docker index server, which appears as "https://index.docker.io/v1/".
The push auth config is now selected by first resolving a valid ("non-legacy") entry, which will be either a hostname aka registry name, or the "https://index.docker.io/v1/" value. This value is then passed to
GetAuthConfig, using the Docker library's existing lookup fallback behavior to handle URLs.Two additional legacy names are handled, as discovered by reading the ORAS' project's implementation with the same goal. See:
https://github.com/oras-project/oras-go/blob/v1.2.2/pkg/auth/docker/resolver.go#L79-L86