mirror of
https://github.com/docker/cli.git
synced 2026-11-06 13:10:41 -04:00
Alano Terblanche
a195d24d1f
RetrieveAuthTokenFromImage is exported and imported by other projects, so it keeps reading only the configuration file. The commands that pull and push call registryauth.EncodedAuth instead, which asks DOCKER_AUTH_CONFIG, then the Docker Desktop session, then the configuration file. This drops command.EncodedRegistryAuth from the public API. Each DockerCli owns its Docker Desktop sessions through RegistryAuthProvider, created on first use, instead of package-level sessions shared by every caller. A command.Cli without RegistryAuthProvider uses only its configuration file. The fallback reads the current configuration file, since Initialize replaces it. Remove the session fields and the constructors that only tests used, move the staging and dhi.io hostnames into internal/secretsengine, and use testing/synctest instead of a fake clock, so that the tests run in parallel. Only the DOCKER_AUTH_CONFIG test still sets the environment. Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
63 lines
1.8 KiB
Go
63 lines
1.8 KiB
Go
package registryauth
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/distribution/reference"
|
|
"github.com/docker/cli/cli/config/configfile"
|
|
configtypes "github.com/docker/cli/cli/config/types"
|
|
"github.com/docker/cli/internal/secretsengine"
|
|
"github.com/moby/moby/api/pkg/authconfig"
|
|
registrytypes "github.com/moby/moby/api/types/registry"
|
|
)
|
|
|
|
type configProvider interface {
|
|
ConfigFile() *configfile.ConfigFile
|
|
}
|
|
|
|
type authProvider interface {
|
|
RegistryAuthProvider() secretsengine.AuthProvider
|
|
}
|
|
|
|
type envAuthFunc func(registryHostname string) (configtypes.AuthConfig, bool)
|
|
|
|
func EncodedAuth(dockerCLI configProvider, image string) (string, error) {
|
|
var auth secretsengine.AuthProvider = dockerCLI.ConfigFile()
|
|
if p, ok := dockerCLI.(authProvider); ok {
|
|
auth = p.RegistryAuthProvider()
|
|
}
|
|
return encodedAuth(envAuthConfig, auth, image)
|
|
}
|
|
|
|
func encodedAuth(envAuth envAuthFunc, auth secretsengine.AuthProvider, image string) (string, error) {
|
|
registryRef, err := reference.ParseNormalizedNamed(image)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
domain := reference.Domain(registryRef)
|
|
authConfig, ok := envAuth(domain)
|
|
if !ok {
|
|
authConfig, err = auth.GetAuthConfig(domain)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
}
|
|
|
|
return authconfig.Encode(registrytypes.AuthConfig{
|
|
Username: authConfig.Username,
|
|
Password: authConfig.Password,
|
|
ServerAddress: authConfig.ServerAddress,
|
|
Auth: authConfig.Auth,
|
|
IdentityToken: authConfig.IdentityToken,
|
|
RegistryToken: authConfig.RegistryToken,
|
|
})
|
|
}
|
|
|
|
func envAuthConfig(registryHostname string) (configtypes.AuthConfig, bool) {
|
|
if os.Getenv(configfile.DockerEnvConfigKey) == "" {
|
|
return configtypes.AuthConfig{}, false
|
|
}
|
|
authConfig, err := configfile.New("").GetAuthConfig(registryHostname)
|
|
return authConfig, err == nil && authConfig.Username != ""
|
|
}
|