Skip to content

Commit 27a6ad6

Browse files
imjasonhimjasonh
authored
Revert "authn: Add NewConfigKeychain to load a config from explicit path (#1603)" (#1664)
This reverts commit 1cb7e13.
1 parent 217318c commit 27a6ad6

File tree

2 files changed

+31
-119
lines changed

2 files changed

+31
-119
lines changed

‎pkg/authn/keychain.go‎

Lines changed: 27 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -48,27 +48,11 @@ type Keychain interface {
4848
// defaultKeychain implements Keychain with the semantics of the standard Docker
4949
// credential keychain.
5050
type defaultKeychain struct {
51-
once sync.Once
52-
cfg types.AuthConfig
53-
54-
configFilePath string
51+
mu sync.Mutex
5552
}
5653

5754
var (
58-
// DefaultKeychain implements Keychain by interpreting the Docker config file.
59-
// This matches the behavior of tools like `docker` and `podman`.
60-
//
61-
// This keychain looks for credentials configured in a few places, in order:
62-
//
63-
// 1. $HOME/.docker/config.json
64-
// 2. $DOCKER_CONFIG/config.json
65-
// 3. $XDG_RUNTIME_DIR/containers/auth.json (for compatibility with Podman)
66-
//
67-
// If a config file is found and can be parsed, Resolve will return credentials
68-
// configured by the file for the given registry.
69-
//
70-
// If no config file is found, Resolve returns Anonymous.
71-
// If a config file is found but can't be parsed, Resolve returns an error.
55+
// DefaultKeychain implements Keychain by interpreting the docker config file.
7256
DefaultKeychain = RefreshingKeychain(&defaultKeychain{}, 5*time.Minute)
7357
)
7458

@@ -78,16 +62,11 @@ const (
7862
DefaultAuthKey = "https://" + name.DefaultRegistry + "/v1/"
7963
)
8064

81-
// NewConfigKeychain implements Keychain by interpreting the Docker config file
82-
// at the specified file path.
83-
//
84-
// It acts like DefaultKeychain except that the exact path of the file can be specified,
85-
// instead of being dependent on environment variables and conventional file names.
86-
func NewConfigKeychain(filename string) Keychain {
87-
return &defaultKeychain{configFilePath: filename}
88-
}
65+
// Resolve implements Keychain.
66+
func (dk *defaultKeychain) Resolve(target Resource) (Authenticator, error) {
67+
dk.mu.Lock()
68+
defer dk.mu.Unlock()
8969

90-
func getDefaultConfigFile() (*configfile.ConfigFile, error) {
9170
// Podman users may have their container registry auth configured in a
9271
// different location, that Docker packages aren't aware of.
9372
// If the Docker config file isn't found, we'll fallback to look where
@@ -120,73 +99,39 @@ func getDefaultConfigFile() (*configfile.ConfigFile, error) {
12099
} else {
121100
f, err := os.Open(filepath.Join(os.Getenv("XDG_RUNTIME_DIR"), "containers/auth.json"))
122101
if err != nil {
123-
return nil, nil
102+
return Anonymous, nil
124103
}
125104
defer f.Close()
126105
cf, err = config.LoadFromReader(f)
127106
if err != nil {
128107
return nil, err
129108
}
130109
}
131-
return cf, nil
132-
}
133110

134-
func (dk *defaultKeychain) Resolve(target Resource) (Authenticator, error) {
135-
var err error
136-
var empty types.AuthConfig
137-
dk.once.Do(func() {
138-
var cf *configfile.ConfigFile
139-
if dk.configFilePath == "" {
140-
cf, err = getDefaultConfigFile()
141-
if err != nil {
142-
return
143-
}
144-
if cf == nil {
145-
dk.cfg = empty
146-
return
147-
}
148-
} else {
149-
var f *os.File
150-
f, err = os.Open(dk.configFilePath)
151-
if err != nil {
152-
return
153-
}
154-
defer f.Close()
155-
cf, err = config.LoadFromReader(f)
156-
if err != nil {
157-
return
158-
}
111+
// See:
112+
// https://github.com/google/ko/issues/90
113+
// https://github.com/moby/moby/blob/fc01c2b481097a6057bec3cd1ab2d7b4488c50c4/registry/config.go#L397-L404
114+
var cfg, empty types.AuthConfig
115+
for _, key := range []string{
116+
target.String(),
117+
target.RegistryStr(),
118+
} {
119+
if key == name.DefaultRegistry {
120+
key = DefaultAuthKey
159121
}
160122

161-
// See:
162-
// https://github.com/google/ko/issues/90
163-
// https://github.com/moby/moby/blob/fc01c2b481097a6057bec3cd1ab2d7b4488c50c4/registry/config.go#L397-L404
164-
for _, key := range []string{
165-
target.String(),
166-
target.RegistryStr(),
167-
} {
168-
if key == name.DefaultRegistry {
169-
key = DefaultAuthKey
170-
}
171-
172-
dk.cfg, err = cf.GetAuthConfig(key)
173-
if err != nil {
174-
return
175-
}
176-
// cf.GetAuthConfig automatically sets the ServerAddress attribute. Since
177-
// we don't make use of it, clear the value for a proper "is-empty" test.
178-
// See: https://github.com/google/go-containerregistry/issues/1510
179-
dk.cfg.ServerAddress = ""
180-
if dk.cfg != empty {
181-
break
182-
}
123+
cfg, err = cf.GetAuthConfig(key)
124+
if err != nil {
125+
return nil, err
126+
}
127+
// cf.GetAuthConfig automatically sets the ServerAddress attribute. Since
128+
// we don't make use of it, clear the value for a proper "is-empty" test.
129+
// See: https://github.com/google/go-containerregistry/issues/1510
130+
cfg.ServerAddress = ""
131+
if cfg != empty {
132+
break
183133
}
184-
})
185-
if err != nil {
186-
return nil, err
187134
}
188-
189-
cfg := dk.cfg
190135
if cfg == empty {
191136
return Anonymous, nil
192137
}

‎pkg/authn/keychain_test.go‎

Lines changed: 4 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ func TestPodmanConfig(t *testing.T) {
113113
// At first, $DOCKER_CONFIG is unset and $HOME/.docker/config.json isn't
114114
// found, but Podman auth is configured. This should return Podman's
115115
// auth.
116-
auth, err := NewConfigKeychain("").Resolve(testRegistry)
116+
auth, err := DefaultKeychain.Resolve(testRegistry)
117117
if err != nil {
118118
t.Fatalf("Resolve() = %v", err)
119119
}
@@ -140,7 +140,7 @@ func TestPodmanConfig(t *testing.T) {
140140
t.Fatalf("write %q: %v", cfg, err)
141141
}
142142
defer func() { os.Remove(cfg) }()
143-
auth, err = NewConfigKeychain("").Resolve(testRegistry)
143+
auth, err = DefaultKeychain.Resolve(testRegistry)
144144
if err != nil {
145145
t.Fatalf("Resolve() = %v", err)
146146
}
@@ -164,7 +164,7 @@ func TestPodmanConfig(t *testing.T) {
164164
cd := setupConfigFile(t, content)
165165
defer os.RemoveAll(filepath.Dir(cd))
166166

167-
auth, err = NewConfigKeychain("").Resolve(testRegistry)
167+
auth, err = DefaultKeychain.Resolve(testRegistry)
168168
if err != nil {
169169
t.Fatalf("Resolve() = %v", err)
170170
}
@@ -181,39 +181,6 @@ func TestPodmanConfig(t *testing.T) {
181181
}
182182
}
183183

184-
func TestAuthConfigPath(t *testing.T) {
185-
tmpdir := os.Getenv("TEST_TMPDIR")
186-
if tmpdir == "" {
187-
tmpdir = t.TempDir()
188-
}
189-
fresh++
190-
p := filepath.Join(tmpdir, fmt.Sprintf("%d", fresh))
191-
if err := os.MkdirAll(filepath.Join(p, "custom"), 0777); err != nil {
192-
t.Fatalf("mkdir %s/custom: %v", p, err)
193-
}
194-
cfg := filepath.Join(p, "cfg.xml")
195-
content := fmt.Sprintf(`{"auths": {"test.io": {"auth": %q}}}`, encode("foo", "bar"))
196-
if err := os.WriteFile(cfg, []byte(content), 0600); err != nil {
197-
t.Fatalf("write %q: %v", cfg, err)
198-
}
199-
200-
auth, err := NewConfigKeychain(cfg).Resolve(testRegistry)
201-
if err != nil {
202-
t.Fatalf("Resolve() = %v", err)
203-
}
204-
got, err := auth.Authorization()
205-
if err != nil {
206-
t.Fatal(err)
207-
}
208-
want := &AuthConfig{
209-
Username: "foo",
210-
Password: "bar",
211-
}
212-
if !reflect.DeepEqual(got, want) {
213-
t.Errorf("got %+v, want %+v", got, want)
214-
}
215-
}
216-
217184
func encode(user, pass string) string {
218185
delimited := fmt.Sprintf("%s:%s", user, pass)
219186
return base64.StdEncoding.EncodeToString([]byte(delimited))
@@ -310,7 +277,7 @@ func TestVariousPaths(t *testing.T) {
310277
// For some reason, these tempdirs don't get cleaned up.
311278
defer os.RemoveAll(filepath.Dir(cd))
312279

313-
auth, err := NewConfigKeychain("").Resolve(test.target)
280+
auth, err := DefaultKeychain.Resolve(test.target)
314281
if test.wantErr {
315282
if err == nil {
316283
t.Fatal("wanted err, got nil")

0 commit comments

Comments
 (0)