From 1823e32ef029290b4aba78afa3218d155797d691 Mon Sep 17 00:00:00 2001 From: Juan Antonio Osorio Date: Thu, 30 Jul 2026 17:16:15 +0300 Subject: [PATCH] Delegate images keychain to toolhive-core --- go.mod | 10 ++--- go.sum | 20 ++++----- pkg/container/images/keychain.go | 69 +++----------------------------- 3 files changed, 20 insertions(+), 79 deletions(-) diff --git a/go.mod b/go.mod index a747a8345a..0fba4e10bc 100644 --- a/go.mod +++ b/go.mod @@ -49,7 +49,7 @@ require ( github.com/shirou/gopsutil/v4 v4.26.5 github.com/spf13/viper v1.21.0 github.com/stacklok/toolhive-catalog v0.20260727.0 - github.com/stacklok/toolhive-core v0.0.36 + github.com/stacklok/toolhive-core v0.0.37 github.com/stretchr/testify v1.11.1 github.com/swaggo/swag/v2 v2.0.0-rc5 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd @@ -57,8 +57,8 @@ require ( github.com/tidwall/gjson v1.18.0 github.com/xeipuuv/gojsonschema v1.2.0 github.com/zalando/go-keyring v0.2.8 - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 + go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 go.opentelemetry.io/otel/exporters/prometheus v0.66.0 go.opentelemetry.io/otel/sdk v1.44.0 go.opentelemetry.io/otel/sdk/metric v1.44.0 @@ -285,7 +285,7 @@ require ( go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // indirect go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect go.opentelemetry.io/otel/exporters/zipkin v1.21.0 // indirect go.opentelemetry.io/proto/otlp v1.10.0 go.uber.org/atomic v1.11.0 // indirect @@ -300,7 +300,7 @@ require ( golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.11 gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect diff --git a/go.sum b/go.sum index f2cc867ef3..6ea6337815 100644 --- a/go.sum +++ b/go.sum @@ -789,8 +789,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= github.com/stacklok/toolhive-catalog v0.20260727.0 h1:5vLZufM+T2BmDg2i2Aj5xxWqYG70vhXXq5REUQHizDo= github.com/stacklok/toolhive-catalog v0.20260727.0/go.mod h1:G33nbS4PplpBl7lk/hPiIYpsmBl5OATvpohpXJujSfg= -github.com/stacklok/toolhive-core v0.0.36 h1:qifLedS+1xjgKoix7cx0VeRXBO3+eosdt03XYGDNWy4= -github.com/stacklok/toolhive-core v0.0.36/go.mod h1:Ihwk7mfTvwqiMvfl18rfVa0oAZVOJFIDTLfJ6J7u088= +github.com/stacklok/toolhive-core v0.0.37 h1:+pWRm3zfxVFD/7XJ2mv4481bSFQJBmUFBEu0OMbZlYI= +github.com/stacklok/toolhive-core v0.0.37/go.mod h1:RosXVa2NLh4CmPvjtSXRO0kby3NdmGGB2Vwt18oGcIs= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE= @@ -915,12 +915,12 @@ go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= go.opentelemetry.io/otel/exporters/jaeger v1.17.0 h1:D7UpUy2Xc2wsi1Ras6V40q806WM07rqoCWzXu7Sqy+4= go.opentelemetry.io/otel/exporters/jaeger v1.17.0/go.mod h1:nPCqOnEH9rNLKqH/+rrUjiMzHJdV1BlpKcTwRTyKkKI= -go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY= -go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 h1:RuynHbfU8JUEw7DyONgkVYg2SVtsoF28y0LGIr69jgA= +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0/go.mod h1:qZF+/lBs71APw8mlnEZcqZHMzqrYrsFiJOv83lX1OGo= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 h1:lgh3PiVrRUWMLOVSkQicxzZll5NjF1r+AtsX1XRIHw0= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0/go.mod h1:5Cnhth3m/AgOeTgE3ex12pPmiu/gGtZit03kSzx9X7s= go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ= go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o= go.opentelemetry.io/otel/exporters/zipkin v1.21.0 h1:D+Gv6lSfrFBWmQYyxKjDd0Zuld9SRXpIrEsKZvE4DO4= @@ -1122,8 +1122,8 @@ google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgn google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I= google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8= google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 h1:PvEgGJf9C/1u5CHkInMg7UFYYUoiaQmW2LbtH0pjB78= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= diff --git a/pkg/container/images/keychain.go b/pkg/container/images/keychain.go index e0a4471168..c194c8c2db 100644 --- a/pkg/container/images/keychain.go +++ b/pkg/container/images/keychain.go @@ -4,73 +4,14 @@ package images import ( - "os" - "strings" - "github.com/google/go-containerregistry/pkg/authn" -) - -// envKeychain implements a keychain that reads credentials from environment variables -type envKeychain struct{} - -// Resolve implements the authn.Keychain interface -func (*envKeychain) Resolve(target authn.Resource) (authn.Authenticator, error) { - registry := target.RegistryStr() - - // Try registry-specific environment variables first - // Format: REGISTRY__USERNAME/PASSWORD, i.e., REGISTRY_DOCKER_IO_USERNAME - normalizedRegistry := strings.ToUpper(strings.ReplaceAll(registry, ".", "_")) - normalizedRegistry = strings.ReplaceAll(normalizedRegistry, "-", "_") - - username := os.Getenv("REGISTRY_" + normalizedRegistry + "_USERNAME") - password := os.Getenv("REGISTRY_" + normalizedRegistry + "_PASSWORD") - - // If registry-specific vars not found, try generic one REGISTRY_USERNAME/PASSWORD - if username == "" || password == "" { - username = os.Getenv("REGISTRY_USERNAME") - password = os.Getenv("REGISTRY_PASSWORD") - } - - if username != "" && password != "" { - return &authn.Basic{ - Username: username, - Password: password, - }, nil - } - return authn.Anonymous, nil -} - -// compositeKeychain combines multiple keychains and tries them in order -type compositeKeychain struct { - keychains []authn.Keychain -} - -// Resolve implements the authn.Keychain interface -func (c *compositeKeychain) Resolve(target authn.Resource) (authn.Authenticator, error) { - for _, keychain := range c.keychains { - auth, err := keychain.Resolve(target) - if err != nil { - continue - } - - // Check if we got actual credentials (not anonymous) - if auth != authn.Anonymous { - return auth, nil - } - } - - // If no keychain provided credentials, return anonymous - return authn.Anonymous, nil -} + coreimages "github.com/stacklok/toolhive-core/container/images" +) // NewCompositeKeychain creates a keychain that tries environment variables first, -// then falls back to the default keychain +// then falls back to the default keychain. +// Deprecated: use github.com/stacklok/toolhive-core/container/images.NewCompositeKeychain. func NewCompositeKeychain() authn.Keychain { - return &compositeKeychain{ - keychains: []authn.Keychain{ - &envKeychain{}, // Try environment variables first - authn.DefaultKeychain, // Then try default keychain (Docker config, etc.) - }, - } + return coreimages.NewCompositeKeychain() }