mindersec / minder / 42773127391

67%

Build Type

push

github

Committed by web-flow

Commit Message

fix(dockerhub): use Basic auth for registry token (#7083)

* fix(dockerhub): use Basic auth for registry token

The Sigstore verifier path sent the raw personal access token directly
as a Bearer token to Docker Hub's registry, which expects Basic auth
(namespace as username, token as password) exchanged for a short-lived
JWT. go-containerregistry's authn.Basic already performs this exchange
automatically -- no manual token-exchange code or proto change needed.

Uses the existing namespace field as the username, per Docker's
documented flow (personal tokens use the Docker ID; org tokens use the
org name as username). This is only correct when the token's type
matches the namespace being watched -- a personal token used against a
namespace other than its owner's Docker ID may still fail (how Docker
Hub handles a mismatched username was not confirmed against the live
registry). Tracking that as a known limitation rather than fixing it
here, since fixing it would need a new optional username field on
DockerHubProviderConfig that falls back to the namespace, which is a
separate design question.

Added a fake token-exchange registry (mimicking Docker's documented
flow) to test this without live credentials: confirms the new Basic
auth succeeds, confirms the old raw-Bearer approach is rejected
(reproducing the bug), and covers a wrong-username rejection and the
nil-credential anonymous fallback.

Fixes #7080

* Add optional Username field to DockerHubProviderConfig

Falls back to namespace when unset, so existing single-user configs
keep working unchanged. Needed for organization/team namespaces
(e.g. 'library') where the namespace itself isn't a valid login name.

Addresses Evan's review on #7083.

Coverage Stats

11 of 13 new or added lines in 1 file covered. (84.62%)

2 existing lines in 1 file now uncovered.

23983 of 35727 relevant lines covered (67.13%)

59.36 hits per line