Support reading Docker credentials from multiple sources

[applejag]

After some debugging in cue-lang/cue#4306 with the help from @mvdan, we found that CUE only looks at 1 of the common auth config files

I had the case that I had both ~/.docker/config.json file (from some non-docker tool that required credentials to be stored there, but those credentials were for a different host/registry) and /run/user/1000/containers/auth.json file (because I'm using Podman, and don't even have Docker installed), but CUE only looked at ~/.docker/config.json.

I tried running podman login ... but cue mod publish still failed, until I eventually tried this which made cue mod publish succeed:

podman login harbor.example.com --compat-auth-file ~/.docker/config.json

Over in ociauth package, CUE looks for multiple file locations, but it only takes auth from the first one it finds:

oci/ociregistry/ociauth/authfile.go

Lines 111 to 130 in 3adeb86

	for _, f := range configFileLocations {
	filename := f(getenv)
	if filename == "" {
	continue
	}
	data, err := os.ReadFile(filename)
	if err != nil {
	if os.IsNotExist(err) {
	continue
	}
	return nil, err
	}
	f, err := decodeConfigFile(data)
	if err != nil {
	return nil, fmt.Errorf("invalid config file %q: %v", filename, err)
	}
	return &ConfigFile{
	data: f,
	runner: runner,
	}, nil

So suggested change:

• keep looking at multiple files
• but merge the list of auths together

Meaning, if:

• ~/.config/docker.json contains:

  {
  	"auths": {
  		"foo.example.com": {
  			"auth": "*credentials from ~/.docker/config.json*"
  		},
  		"bar.example.com": {
  			"auth": "*credentials from ~/.docker/config.json*"
  		}
  	}
  }

• and $XDG_RUNTIME_DIR/containers/auth.json contains:

  {
  	"auths": {
  		"bar.example.com": {
  			"auth": "*credentials from $XDG_RUNTIME_DIR/containers/auth.json*"
  		},
  		"moo.example.com": {
  			"auth": "*credentials from $XDG_RUNTIME_DIR/containers/auth.json*"
  		}
  	}
  }

Then CUE reads both and its internal config becomes:

{
	"auths": {
		"foo.example.com": {
			"auth": "*credentials from ~/.docker/config.json*"
		},
		"bar.example.com": {
			"auth": "*credentials from ~/.docker/config.json*"
		},
		"moo.example.com": {
			"auth": "*credentials from $XDG_RUNTIME_DIR/containers/auth.json*"
		}
	}
}

Bonus would be if it could log a message to the user in cue mod publish explaining when it's getting credentials from a non-CUE config file like this

[mvdan]

Dangit, we raced each other again :) I raised cue-lang/cue#4307 nearly at the same time. I'll keep that open just to track pulling in the oci change once it's done here.

[applejag]

🏎️ 🏎️ 🏎️

The joy of live asynchronous communication :)

[mvdan]

Let me know if you want to work on this, before we race each other once again! I'll probably take a look next week otherwise.

[applejag]

Let me know if you want to work on this, before we race each other once again! I'll probably take a look next week otherwise.

haha that would be fun and sad! :D

I'm actually a little curious in tinkering with this, so I'll give it a go before I shut off my computer for today