Skip to content

fork distribution client v3 auth-challenge as an internal package (squashed)#2248

Merged
Subserial merged 7 commits intogoogle:mainfrom
thaJeztah:fork_registryclient_authchallenge_alt
Mar 31, 2026
Merged

fork distribution client v3 auth-challenge as an internal package (squashed)#2248
Subserial merged 7 commits intogoogle:mainfrom
thaJeztah:fork_registryclient_authchallenge_alt

Conversation

@thaJeztah
Copy link
Copy Markdown
Contributor


fork distribution client v3 auth-challenge as an internal package

This forks the distribution's registry client auth-challenge code v3.0.0;
distribution/distribution@9ed95e7

The client code has moved to an internal package in the distribution project,
and is used to handle WWW-Authenticate headers. It was written a long time
ago, and only handles RFC 2617 (superseded by RFC 9110). Possibly there's more
current implementations for this, but this would introduce new dependencies, so
we can keep the status quo for now, and fork this code as an internal package.

Keeping it internal, due to the known limitations mentioned above, and to avoid
it being used by others assuming it's a general-purpose implementation.

This is the result of the following steps:

# install filter-repo (https://github.com/newren/git-filter-repo/blob/main/INSTALL.md)
brew install git-filter-repo

# create a temporary clone of docker
cd ~/Projects
git clone https://github.com/distribution/distribution.git distribution_auth
cd distribution_auth

# switch to v3.0.0 (git-filter doesn't like multiple branches, so reset)
git reset --hard v3.0.0

# commit taken from
git rev-parse --verify HEAD
9ed95e7365224025ee89365e12cf128e1f1bf965

git filter-repo --analyze

# remove all code, except for 'internal/client/auth/challenge'
# rename to 'pkg/v1/remote/internal/authchallenge'
# include history of old location ('registry/client/auth/challenge')
git filter-repo \
  --force \
  --path 'internal/client/auth/challenge' \
  --path 'registry/client/auth/challenge' \
  --path-rename internal/client/auth/challenge:pkg/v1/remote/internal/authchallenge

# go to the target github.com/docker/docker repository
cd ~/go/src/github.com/google/go-containerregistry

# create a branch to work with
git checkout -b fork_registryclient_authchallenge

# add the temporary repository as an upstream and make sure it's up-to-date
git remote add distribution_auth ~/Projects/distribution_auth
git fetch distribution_auth

# merge the upstream code
git merge --allow-unrelated-histories --signoff -S distribution_auth/main

After adding the internal fork;

  • authchallenge: rename package and update imports
  • pkg/v1/remote/internal/authchallenge: make manager-code a test-util
    The Manager code is only used as part of tests; move it to _test files
    to have a clearer separation between "production" code and test-code.

@thaJeztah thaJeztah force-pushed the fork_registryclient_authchallenge_alt branch 3 times, most recently from 7af546f to 143dafe Compare March 28, 2026 13:29
@thaJeztah
Copy link
Copy Markdown
Contributor Author

OK; Didn't like Co-authored-by, so just a squash then 🤷

@thaJeztah thaJeztah force-pushed the fork_registryclient_authchallenge_alt branch 3 times, most recently from d2e564d to b2784e2 Compare March 28, 2026 16:39
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Mar 30, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.99%. Comparing base (8b3c303) to head (4caec6c).
⚠️ Report is 81 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (8b3c303) and HEAD (4caec6c). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (8b3c303) HEAD (4caec6c)
2 1
Additional details and impacted files
@@             Coverage Diff             @@
##             main    #2248       +/-   ##
===========================================
- Coverage   71.67%   52.99%   -18.68%     
===========================================
  Files         123      165       +42     
  Lines        9935    11197     +1262     
===========================================
- Hits         7121     5934     -1187     
- Misses       2115     4553     +2438     
- Partials      699      710       +11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

This forks the distribution's registry client auth-challenge code v3.0.0;
distribution/distribution@9ed95e7

The client code has moved to an internal package in the distribution project,
and is used to handle `WWW-Authenticate` headers. It was written a long time
ago, and only handles RFC 2617 (superseded by RFC 9110). Possibly there's more
current implementations for this, but this would introduce new dependencies, so
we can keep the status quo for now, and fork this code as an internal package.

Keeping it internal, due to the known limitations mentioned above, and to avoid
it being used by others assuming it's a general-purpose implementation.

This is the result of the following steps:

    # install filter-repo (https://github.com/newren/git-filter-repo/blob/main/INSTALL.md)
    brew install git-filter-repo

    # create a temporary clone of docker
    cd ~/Projects
    git clone https://github.com/distribution/distribution.git distribution_auth
    cd distribution_auth

    # switch to v3.0.0 (git-filter doesn't like multiple branches, so reset)
    git reset --hard v3.0.0

    # commit taken from
    git rev-parse --verify HEAD
    9ed95e7365224025ee89365e12cf128e1f1bf965

    git filter-repo --analyze

    # remove all code, except for 'internal/client/auth/challenge'
    # rename to 'pkg/v1/remote/internal/authchallenge'
    # include history of old location ('registry/client/auth/challenge')
    git filter-repo \
      --force \
      --path 'internal/client/auth/challenge' \
      --path 'registry/client/auth/challenge' \
      --path-rename internal/client/auth/challenge:pkg/v1/remote/internal/authchallenge

    # go to the target github.com/docker/docker repository
    cd ~/go/src/github.com/google/go-containerregistry

    # create a branch to work with
    git checkout -b fork_registryclient_authchallenge

    # add the temporary repository as an upstream and make sure it's up-to-date
    git remote add distribution_auth ~/Projects/distribution_auth
    git fetch distribution_auth

    # merge the upstream code
    git merge --allow-unrelated-histories --signoff -S distribution_auth/main

History was squashed:

- Refactor authorization challenges to its own package
  Split challenges into its own package. Avoids possible
  import cycle with challenges from client.
- Fix minor "Challanges" typo
- Fix gometalint errors
- Fix typo in NewSimpleManager() documentation
- Initial repo commit
- init
- format code with gofumpt

Move registry client internal

Our registry client is not currently in a good place to be used as the
reference OCI Distribution client implementation. But the registry proxy
currently depends on it. Make the registry client internal to the
distribution application to remove it from the API surface area (and any
implied compatibility promises) of distribution/v3@v3.0.0 without
breaking the proxy.

cleanup: move init funcs to the top of the source

We make sure they're not hiding at the bottom or in the middle
which makes debugging an utter nightmare!

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Manager code is only used as part of tests; move it to _test files
to have a clearer separation between "production" code and test-code.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
As this code is now only used as a test-utility;

- Make the zero-value of simpleManager usable
- Remove the constructor and interface definition
- Un-export fields and mutex.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- change normalizeURL to not mutate the input URL.
- move lowercasing into canonicalAddr.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah force-pushed the fork_registryclient_authchallenge_alt branch from b2784e2 to 4caec6c Compare March 31, 2026 14:42
@Subserial
Copy link
Copy Markdown
Contributor

Looks good, especially the Apache license preface.

@Subserial Subserial merged commit 19a36cd into google:main Mar 31, 2026
17 checks passed
@thaJeztah thaJeztah deleted the fork_registryclient_authchallenge_alt branch March 31, 2026 23:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants