From 3be647101825f671e1749c49d27c2fcb99e9521b Mon Sep 17 00:00:00 2001
From: Morten Siebuhr <sbhr@sbhr.dk>
Date: Fri, 7 Jun 2024 22:23:39 +0200
Subject: [PATCH] fix: Support global credsStore in docker config (#602)

---
 e2e/pull/test.bats    | 11 +++++++++++
 oci/private/authn.bzl |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/e2e/pull/test.bats b/e2e/pull/test.bats
index bf920f5c..77def374 100644
--- a/e2e/pull/test.bats
+++ b/e2e/pull/test.bats
@@ -91,6 +91,17 @@ EOF
     assert_success
 }
 
+@test "global credstore" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "credsStore": "oci"
+}
+EOF
+    update_assert '{"Authorization": ["Basic dGVzdGluZzpvY2k="]}'
+    run bazel build @empty_image//... $BAZEL_FLAGS
+    assert_success
+}
+
 @test "credstore misbehaves" {
     cat > "$DOCKER_CONFIG/config.json" <<EOF
 {
diff --git a/oci/private/authn.bzl b/oci/private/authn.bzl
index 8356caaa..8a2f5317 100644
--- a/oci/private/authn.bzl
+++ b/oci/private/authn.bzl
@@ -181,6 +181,10 @@ def _get_auth(rctx, state, registry):
                         "password": auth_val["password"],
                     }
 
+    # look for generic credentials-store all lookups for host-specific auth fails
+    if "credsStore" in config and len(pattern.keys()) == 0:
+        pattern = _fetch_auth_via_creds_helper(rctx, registry, config["credsStore"])
+
     # cache the result so that we don't do this again unnecessarily.
     state["auth"][registry] = pattern