Skip to content

Authentication helper interface is incorrect #486

@jklukas

Description

@jklukas

@ianoc added support for authentication helper scripts (started in #343) but we don't document the intended interface for these scripts.

I assume that we are intending to follow the docker credential helper interface as described in https://github.com/docker/docker-credential-helpers?tab=readme-ov-file#development:

A credential helper can be any program that can read values from the standard input. We use the first argument in the command line to differentiate the kind of command to execute

The code here, however, is currently as follows:

.write_all(format!("GET {}\n", &auth_fail.service).as_bytes())

There are two separate problems here:

  • The current code pipes in "GET" as the first element on stdin, but the credential helper interface expects this as a command line argument
  • The current code pipes in "service" as the second element on stdin, which is taken from the previously seen auth challenge, which could be any arbitrary string as decided by the registry; per the docker credential helper spec, this is expected to be the server url

Should we update this to follow the broader credential helper spec, and document that as the interface here?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions