Documentation
¶
Overview ¶
Package dockercredhelper wires glab into Docker as a credential helper: it installs the docker-credential-glab shim that Docker executes, and points Docker's config.json at that shim for a set of registry domains.
Index ¶
Constants ¶
const ( // FullName is the shim's file name, and is what Docker looks for in the // user's PATH. FullName = "docker-credential-glab" // ShortName is the short name of the credential helper, and is what a // Docker config's credHelpers object lists for a registry. ShortName = "glab" )
Variables ¶
This section is empty.
Functions ¶
func ConfigDir ¶
ConfigDir resolves the directory Docker reads config.json from, mirroring dockerconfig.Dir(): $DOCKER_CONFIG when set, otherwise ~/.docker. Honoring $DOCKER_CONFIG matters because writing to the wrong directory fails silently: the command reports success, but Docker reads a config.json with no credHelpers entry for the registry.
This is not dockerconfig.Dir() itself, because that function memoizes its result in a process-wide sync.Once the first time it's called: the first caller in the process would lock in a directory that later callers (for example, tests overriding $HOME) can't change.
func Locate ¶ added in v1.114.0
Locate resolves the glab binary on PATH. The shim shells out to it, and Install prefers to write the shim into the same directory, so a glab that PATH cannot resolve means the install can never work.
Exported separately from Install so a caller that does other work first, such as a token exchange, can fail on a missing glab before spending that work rather than after. Install calls it too, so a caller that skips the check is not left unguarded.
Types ¶
type ConflictError ¶
type ConflictError struct {
// Helpers maps a domain to the credential helper already configured for it.
Helpers map[string]string
// ConfigPath is the config.json holding those entries.
ConfigPath string
}
ConflictError reports domains that a different credential helper already claims. Register returns it having written nothing.
func (*ConflictError) Error ¶
func (e *ConflictError) Error() string
type Installation ¶ added in v1.119.0
type Installation struct {
Path string
// OnPath is false when Path's directory is absent from PATH, which happens
// only when no directory on PATH would accept the write. Docker resolves
// the shim by name through PATH, so until the user adds the directory the
// shim is inert and the caller has to say so.
OnPath bool
}
Installation reports where Install put the shim.
func Install ¶
func Install() (Installation, error)
Install writes the shim into the first directory that will accept it, preferring the one holding the glab binary, and returns where it landed. It is idempotent: re-running it overwrites the script and forces the mode, so a shim left by an older glab is brought up to date.
The preference order exists because glab's own directory is frequently not writable by the user running it: /usr/bin under the .deb and .rpm packages, or a read-only Nix store. That used to fail the whole command.
func (Installation) PathWarning ¶ added in v1.119.0
func (i Installation) PathWarning() string
PathWarning is what to tell the user when OnPath is false. It lives next to the field rather than in each caller so the commands that install the shim (`glab auth configure-docker` and `glab artifact-registry login --docker`) cannot drift apart on the remedy they name.
No leading icon and no trailing newline: those belong to how the caller formats a warning line.
type Registration ¶
type Registration struct {
Domain string
// ShadowedLogin is true when Docker's config.json already held a
// credential for Domain, which `docker login` writes. Docker consults
// credHelpers ahead of that entry, so the stored credential is now unused
// and the caller should say so.
ShadowedLogin bool
}
Registration reports the outcome of pointing Docker at glab for one domain.
func Register ¶
func Register(dir string, domains ...string) ([]Registration, error)
Register points Docker at the glab credential helper for each of domains, by writing credHelpers in dir's config.json. Callers resolve dir via ConfigDir unless they have a reason to use a different directory.
Every domain is checked before anything is written, and a domain already claimed by a different helper fails the whole call with a *ConflictError. Docker resolves credHelpers ahead of every other credential source and credHelpers holds one helper per domain, so overwriting an entry silently takes a registry away from whichever tool owns it — ecr-login, gcloud, a per-registry osxkeychain — and Save discards the old value irrecoverably.
func (Registration) ShadowedLoginWarning ¶ added in v1.114.0
func (r Registration) ShadowedLoginWarning() string
ShadowedLoginWarning is what to tell the user when ShadowedLogin is set. It lives next to the field rather than in each caller so the commands that register domains (`glab auth configure-docker` and `glab artifact-registry login --docker`) cannot drift apart on the remedy they name.
No leading icon and no trailing newline: those belong to how the caller formats a warning line.
Source Files