Skip to content

Conversation

@mtrmac
Copy link
Collaborator

@mtrmac mtrmac commented May 11, 2019

This was brought up sometime during the reviews, but was apparently lost.

Consider registries.conf:

[[registry]]
location = "example.com"
mirror = [
	{ location = "docker.io" },
	{ location = "registry.access.redhat.com" },
	{ location = "registry.redhat.io" },
	{ location = "registry.fedoraproject.org" },
]

Then

skopeo --registries-conf registries.conf copy --src-creds foo:bar docker://example.com/foo/bar dir:t

currently sends the foo:bar to every mirror that requires authentication, not just to example.com; that seems clearly undesirable.

So, clear SystemContext.DockerAuthConfig when using a mirror at a different registry than the one specified by the user; if the mirrors require credentials, they have to be set up in the auth file, e.g. by podman login.

@vrothberg @saschagrunert PTAL.

(#588 may be relevant for more discussion about DockerAuthConfig)

@saschagrunert
Copy link
Member

saschagrunert commented May 13, 2019

LGTM, but the CI seems to need a rebump. Maybe a test case in skopeo or a unit test here would be good to add.

@vrothberg
Copy link
Member

LGTM. I opened #627 to make CI pass again. ubuntu:artful (i.e., 17:10) hit EOL.

…registries

.. so that we don't send credentials intended for the primary endpoint to mirrors.

Signed-off-by: Miloslav Trmač <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants