Documentation
¶
Overview ¶
Package pkgregistry renders private package registry credentials into the tool config files a Dockerfile build reads through BuildKit secret mounts, so a token is never baked into an image layer or a build log.
Index ¶
Constants ¶
const ( EcosystemNPM = "npm" EcosystemPyPI = "pypi" EcosystemMaven = "maven" EcosystemNuGet = "nuget" EcosystemCargo = "cargo" EcosystemGo = "go" EcosystemRubyGems = "rubygems" )
Ecosystems a package registry credential can target.
const ( ScopeInstance = "instance" ScopeProject = "project" ScopeApp = "app" )
Scope kinds: how widely a package registry applies.
Variables ¶
var Ecosystems = []string{ EcosystemNPM, EcosystemPyPI, EcosystemMaven, EcosystemNuGet, EcosystemCargo, EcosystemGo, EcosystemRubyGems, }
Ecosystems lists every supported ecosystem in display order.
var SecretIDs = map[string]string{ EcosystemNPM: "npmrc", EcosystemPyPI: "pip_conf", EcosystemMaven: "maven_settings", EcosystemNuGet: "nuget_config", EcosystemCargo: "cargo_config", EcosystemGo: "netrc", EcosystemRubyGems: "bundle_config", }
SecretIDs maps an ecosystem to the BuildKit secret id its generated config is mounted under, the id a Dockerfile references.
Functions ¶
func IsEcosystem ¶
IsEcosystem reports whether e is a supported ecosystem.
func ValidateURL ¶
ValidateURL requires an http or https URL with no embedded credentials, which would otherwise leak through build args and logs.
Types ¶
type Entry ¶
type Entry struct {
Ecosystem string
URL string
Username string
Secret string
// ModulePatterns is a comma separated GOPRIVATE list (go only).
ModulePatterns string
}
Entry is one resolved package registry credential, secret included.
type Output ¶
Output is what a build receives: secret file contents by mount id, non-secret build args, and every string that must be masked in logs.
type Resolver ¶
type Resolver struct {
Store Source
Secrets SecretResolver
}
Resolver turns the registries in scope for one service into build inputs.
func (*Resolver) BuildSecrets ¶
BuildSecrets returns the secret mounts and build args for a service's Dockerfile build, narrowest scope first so an app can override a project or instance default. An empty Output means nothing applies.
Source Files