fix(737): handle credentials resolution correctly by matthiasbruns · Pull Request #1191 · open-component-model/open-component-model

matthiasbruns · 2025-11-12T07:39:42Z

On-behalf-of: SAP matthias.bruns@sap.com

What this PR does / why we need it

During debugging issues with mounting .ocmconfig files into Docker containers, we had hard time finding the real root case for the issue.

In case we don’t find Docker a credential helper, but the config directs to a docker credential helper, we should fall back to a plain credential plugin / helper.

Which issue(s) this PR fixes

Contributes: open-component-model/ocm-project#737

#### What this PR does / why we need it Credentials error handling from #1191 #### Which issue(s) this PR fixes Contributes: open-component-model/ocm-project#737 --------- Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

jakobmoellerdev

could we add a test case for the fallback behavior somehow? apart from that lgtm

matthiasbruns · 2025-11-18T08:07:06Z

could we add a test case for the fallback behavior somehow? apart from that lgtm

I tried but I couldn't break Resolve directly - only the plugins or parsing parts of the credentials api

matthiasbruns · 2025-11-18T12:18:36Z

Had to update the credentials implementation to behave as expected

#1226

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

gitguardian · 2025-12-01T08:00:49Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
14926537	Triggered	Generic High Entropy Secret	`bfe04be`	cli/cmd/cmd_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

matthiasbruns · 2025-12-01T08:04:58Z

could we add a test case for the fallback behavior somehow? apart from that lgtm

https://github.com/open-component-model/open-component-model/pull/1191/files#diff-0da9123292653cbb68d92a1b0f69368f5f8b353010514676ca676ae2b4ee490bR1477

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

#### What this PR does / why we need it After the changes in #1191, the credential resolution is broken as we attempt to resolve credentials with the consumer identity returned for ctf from dockerconfig credential repository in the fallback logic to any consumer identity type of our credential resolution. This is a preliminary fix for the issue, unblocking us. A broader scoped issue will be created as follow up. #### Which issue(s) this PR fixes  Contributes to open-component-model/ocm-project#737 --------- Signed-off-by: Fabian Burth <fabian.burth@sap.com>

matthiasbruns requested a review from a team as a code owner November 12, 2025 07:39

github-actions Bot added kind/bugfix Bug size/s Small labels Nov 12, 2025

matthiasbruns marked this pull request as draft November 12, 2025 07:42

matthiasbruns mentioned this pull request Nov 14, 2025

feat: 737 add credentials error handling #1201

Merged

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch 2 times, most recently from c28d940 to b39efdd Compare November 16, 2025 09:39

matthiasbruns marked this pull request as ready for review November 16, 2025 09:46

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch 3 times, most recently from 4af4fcf to 26bbdb5 Compare November 16, 2025 09:59

github-actions Bot added the size/m Medium label Nov 16, 2025

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch from 30d1c05 to d7c359a Compare November 16, 2025 11:43

matthiasbruns commented Nov 16, 2025

View reviewed changes

Comment thread bindings/go/plugin/go.mod Outdated

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch 9 times, most recently from e86cfc6 to fa8567a Compare November 17, 2025 10:32

github-actions Bot added the component/github-actions Changes on GitHub Actions or within `.github/` directory label Nov 17, 2025

jakobmoellerdev reviewed Nov 17, 2025

View reviewed changes

fabianburth reviewed Nov 18, 2025

View reviewed changes

Comment thread bindings/go/repository/component/fallback/v1/repository.go Outdated

Comment thread bindings/go/repository/component/fallback/v1/repository.go

Comment thread cli/cmd/add/component-version/cmd.go

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch from 4cfd40a to 85f6568 Compare November 22, 2025 04:52

matthiasbruns added 9 commits December 1, 2025 08:35

fix: cli build

17e482f

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

chore: use new credentials version

61db039

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

chore: update to credentials v0.0.4

b8230ee

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

feat: update all bindings required for new credentials

3e9af2e

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

chore: manual rebase

a8c77c1

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

chore: upgrade constructor

eaa1f4f

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

fix: go.mod

13c4b52

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

feat: add docker tests

dbc0764

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

feat: docker not found test case

bfe04be

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch from 8f1b4c1 to bfe04be Compare December 1, 2025 08:00

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch 2 times, most recently from 48101a4 to 555e79a Compare December 1, 2025 08:04

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch 3 times, most recently from 6267a33 to beb5c32 Compare December 1, 2025 08:08

feat: add ErrUnknown test

3c091b0

On-behalf-of: SAP <matthias.bruns@sap.com> Signed-off-by: Matthias Bruns <git@matthiasbruns.com>

matthiasbruns force-pushed the feat/737_error_handling_credentials_plugin branch from beb5c32 to 3c091b0 Compare December 1, 2025 08:09

matthiasbruns requested review from fabianburth, jakobmoellerdev and morri-son December 1, 2025 08:13

Merge branch 'main' into feat/737_error_handling_credentials_plugin

fca109f

jakobmoellerdev approved these changes Dec 1, 2025

View reviewed changes

fabianburth approved these changes Dec 1, 2025

View reviewed changes

Merge branch 'main' into feat/737_error_handling_credentials_plugin

2bafb9d

piotrjanik reviewed Dec 1, 2025

View reviewed changes

Comment thread cli/cmd/sign/component-version/cmd.go

matthiasbruns merged commit 226148f into open-component-model:main Dec 1, 2025
21 checks passed

fabianburth mentioned this pull request Dec 2, 2025

fix(oci): make consumer identity for ctf return an error #1323

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(737): handle credentials resolution correctly#1191

fix(737): handle credentials resolution correctly#1191
matthiasbruns merged 29 commits into
open-component-model:mainfrom
matthiasbruns:feat/737_error_handling_credentials_plugin

matthiasbruns commented Nov 12, 2025

Uh oh!

Uh oh!

jakobmoellerdev left a comment

Uh oh!

matthiasbruns commented Nov 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matthiasbruns commented Nov 18, 2025

Uh oh!

gitguardian Bot commented Dec 1, 2025 •

edited

Loading

Uh oh!

matthiasbruns commented Dec 1, 2025

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

matthiasbruns commented Nov 12, 2025

What this PR does / why we need it

Which issue(s) this PR fixes

Uh oh!

Uh oh!

jakobmoellerdev left a comment

Choose a reason for hiding this comment

Uh oh!

matthiasbruns commented Nov 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matthiasbruns commented Nov 18, 2025

Uh oh!

gitguardian Bot commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

matthiasbruns commented Dec 1, 2025

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

gitguardian Bot commented Dec 1, 2025 •

edited

Loading