Documentation
¶
Overview ¶
Package dockercredhelper wires glab into Docker as a credential helper: it installs the docker-credential-glab shim that Docker executes, and points Docker's config.json at that shim for a set of registry domains.
Index ¶
Constants ¶
const ( // FullName is the shim's file name, and is what Docker looks for in the // user's PATH. FullName = "docker-credential-glab" // ShortName is the short name of the credential helper, and is what a // Docker config's credHelpers object lists for a registry. ShortName = "glab" )
Variables ¶
This section is empty.
Functions ¶
func ConfigDir ¶
ConfigDir resolves the directory Docker reads config.json from, mirroring dockerconfig.Dir(): $DOCKER_CONFIG when set, otherwise ~/.docker. Honoring $DOCKER_CONFIG matters because writing to the wrong directory fails silently: the command reports success, but Docker reads a config.json with no credHelpers entry for the registry.
This is not dockerconfig.Dir() itself, because that function memoizes its result in a process-wide sync.Once the first time it's called: the first caller in the process would lock in a directory that later callers (for example, tests overriding $HOME) can't change.
func Install ¶
Install writes the shim next to the glab binary found on PATH and returns its path. It is idempotent: re-running it overwrites the script and forces the mode, so a shim left by an older glab is brought up to date.
func Locate ¶ added in v1.114.0
Locate resolves the glab binary on PATH. Install writes the shim next to it, and the shim shells out to it, so a glab that PATH cannot resolve means the install can never work.
Exported separately from Install so a caller that does other work first, such as a token exchange, can fail on a missing glab before spending that work rather than after. Install calls it too, so a caller that skips the check is not left unguarded.
Types ¶
type ConflictError ¶
type ConflictError struct {
// Helpers maps a domain to the credential helper already configured for it.
Helpers map[string]string
// ConfigPath is the config.json holding those entries.
ConfigPath string
}
ConflictError reports domains that a different credential helper already claims. Register returns it having written nothing.
func (*ConflictError) Error ¶
func (e *ConflictError) Error() string
type Registration ¶
type Registration struct {
Domain string
// ShadowedLogin is true when Docker's config.json already held a
// credential for Domain, which `docker login` writes. Docker consults
// credHelpers ahead of that entry, so the stored credential is now unused
// and the caller should say so.
ShadowedLogin bool
}
Registration reports the outcome of pointing Docker at glab for one domain.
func Register ¶
func Register(dir string, domains ...string) ([]Registration, error)
Register points Docker at the glab credential helper for each of domains, by writing credHelpers in dir's config.json. Callers resolve dir via ConfigDir unless they have a reason to use a different directory.
Every domain is checked before anything is written, and a domain already claimed by a different helper fails the whole call with a *ConflictError. Docker resolves credHelpers ahead of every other credential source and credHelpers holds one helper per domain, so overwriting an entry silently takes a registry away from whichever tool owns it — ecr-login, gcloud, a per-registry osxkeychain — and Save discards the old value irrecoverably.
func (Registration) ShadowedLoginWarning ¶ added in v1.114.0
func (r Registration) ShadowedLoginWarning() string
ShadowedLoginWarning is what to tell the user when ShadowedLogin is set. It lives next to the field rather than in each caller so the commands that register domains (`glab auth configure-docker` and `glab artifact-registry login --docker`) cannot drift apart on the remedy they name.
No leading icon and no trailing newline: those belong to how the caller formats a warning line.
Source Files