feat: add support for gopass as a credential store by sudoforge · Pull Request #268 · docker/docker-credential-helpers

sudoforge · 2023-05-13T06:08:38Z

This change adds support for gopass as a credential store, based on
the pass implementation.

Closes #138
Closes #166

crazy-max

Thanks for your contrib, please check CI issues.

Also missing build-gopass make target in build-linux, build-darwin and build-windows stages in the Dockerfile.

codecov-commenter · 2023-05-28T00:22:45Z

Codecov Report

Attention: Patch coverage is 54.07407% with 62 lines in your changes missing coverage. Please review.

Project coverage is 52.41%. Comparing base (f9d3010) to head (5ae6a86).

Files with missing lines	Patch %	Lines
gopass/gopass.go	54.88%	42 Missing and 18 partials ⚠️
gopass/cmd/main.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #268      +/-   ##
==========================================
+ Coverage   52.08%   52.41%   +0.33%     
==========================================
  Files          13       15       +2     
  Lines         672      807     +135     
==========================================
+ Hits          350      423      +73     
- Misses        278      322      +44     
- Partials       44       62      +18

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

crazy-max · 2023-05-28T15:53:42Z

Thanks for your contrib, please check CI issues.

@sudoforge ^

sudoforge · 2023-05-28T16:17:59Z

Thanks for your contrib, please check CI issues.

@sudoforge ^

Yep, I'm aware of this and have a WIP solution that should resolve the build/test matrice failures.

sudoforge · 2025-04-11T23:53:32Z

Updated the pipeline to utilize the most recent release of gopass (1.15.15).

sudoforge · 2025-04-12T00:14:18Z

gopasspw/gopass:1.15.15 (as a library) requires go:1.23.2 at minimum. i updated go.mod to require 1.23.6, as it is the latest available release (and this is what's being used elsewhere in this repository - a767624).

if we'd prefer that i do not upgrade the required version of go, i could refactor this tree to use an older revision of the library.

also, yes, it added a few indirect dependencies. is there a particular reason we're vendoring deps?

sudoforge · 2025-04-12T00:47:28Z

The most recent push added backwards-compatibility for the pass helper (a key difference between the two is the secret schema: this tree base64-encodes the usernames in addition to the registry URLs).

sudoforge · 2025-04-12T01:26:16Z

The most recent pushes to my tree were me fighting with the build-deb pipeline. As of 9082d90, issues are fixed.

…elpers This change adds conditional expressions to restrict the execution of pipeline steps that consume secrets, such as uploading artifacts to remote stores, from being executed unless they are being executed in the context of the upstream `docker/docker-credential-helpers` repository. With this change, downstream, external contributors (users who have forked this repository, and have that fork on GitHub) can enable GitHub Actions in their fork, in order to iterate and validate their changes without waiting on the upstream maintainers. This is extremely helpful to all contributors, because the repository requires maintainer approval in order to execute pipelines, which is burdensome on the maintainers, and due to this restrictive gatekeeping, contributors have an excessively long feedback loop. Signed-off-by: sudoforge <no-reply@sudoforge.com>

This change adds support for `gopass` as a credential store, utilizing the upstream library. Closes: docker#138 Closes: docker#166 Signed-off-by: sudoforge <no-reply@sudoforge.com>

When listing by prefix, this should ensure the `/` is added at the end, otherwise URLs for subdomains, etc are also included in the results, leading to finding multiple logins, when in reality only one exists. As an example, logging in to Docker Hub via `docker login` results in the following entries in the gopass store: ``` gopass └── io.container.registries/ ├── aHR0cHM6Ly9pbmRleC5kb2NrZXIuaW8vdjEv/ │ └── dGVzdHVzZXIK ├── aHR0cHM6Ly9pbmRleC5kb2NrZXIuaW8vdjEvYWNjZXNzLXRva2Vu/ │ └── dGVzdHVzZXIK └── aHR0cHM6Ly9pbmRleC5kb2NrZXIuaW8vdjEvcmVmcmVzaC10b2tlbg==/ └── dGVzdHVzZXIK ``` Entries are created for: https://index.docker.io/v1/ https://index.docker.io/v1/access-token https://index.docker.io/v1/refresh-token% When listing these are seen as multiple logins, where in reality they are a single login (in the case above for `testuser`).

This patch drops the security package suite so that linux-libc-dev (a dependency of libc6-dev) is pulled in correctly.

sudoforge · 2026-08-10T01:17:02Z

My tree has been rebased on top of 6bcdedb.

Upstream currently has cross-compilation errors in //:Dockerfile (the linux-libc-dev package wasn't being installed due to a versioning conflict in the security package suite -- see this commit for more info).

This will be my last update. I am archiving my fork, and will (in the near future), be deleting my GitHub account. If you depend on my fork, please... well, fork it, open a PR to docker/docker-credential-helpers, and comment here so that I know to close mine.

Or, who knows. Maybe this will finally get merged.

sudoforge force-pushed the master branch 2 times, most recently from 540cce2 to f4090b4 Compare May 13, 2023 22:33

sudoforge force-pushed the master branch 3 times, most recently from 043a423 to fc40f5a Compare May 27, 2023 13:12

crazy-max reviewed May 27, 2023

View reviewed changes

Comment thread Dockerfile Outdated

crazy-max requested changes May 27, 2023

View reviewed changes

sudoforge force-pushed the master branch from fc40f5a to c77464e Compare May 28, 2023 00:19

sudoforge requested a review from crazy-max May 28, 2023 00:20