Skip to content

Commit ef11a08

Browse files
philwebbphilwebb
committed
Fix accidentally introduced Docker credential issues
Attempt to fix a few issues that were accidentally introduced by missing some code from the original pull-request. See gh-45269
1 parent 79f7529 commit ef11a08

File tree

4 files changed

+11
-46
lines changed

4 files changed

+11
-46
lines changed

‎spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/build/Builder.java

+2-10
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,8 @@ public void build(BuildRequest request) throws DockerEngineException, IOExceptio
145145
Assert.notNull(request, "'request' must not be null");
146146
this.log.start(request);
147147
validateBindings(request.getBindings());
148-
String domain = request.getBuilder().getDomain();
149148
PullPolicy pullPolicy = request.getPullPolicy();
150-
ImageFetcher imageFetcher = new ImageFetcher(domain, this.dockerConfiguration.builderRegistryAuthentication(),
149+
ImageFetcher imageFetcher = new ImageFetcher(this.dockerConfiguration.builderRegistryAuthentication(),
151150
pullPolicy, request.getImagePlatform());
152151
Image builderImage = imageFetcher.fetchImage(ImageType.BUILDER, request.getBuilder());
153152
BuilderMetadata builderMetadata = BuilderMetadata.fromImage(builderImage);
@@ -260,17 +259,14 @@ private static String authHeader(DockerRegistryAuthentication authentication, Im
260259
*/
261260
private class ImageFetcher {
262261

263-
private final String domain;
264-
265262
private final DockerRegistryAuthentication registryAuthentication;
266263

267264
private final PullPolicy pullPolicy;
268265

269266
private ImagePlatform defaultPlatform;
270267

271-
ImageFetcher(String domain, DockerRegistryAuthentication registryAuthentication, PullPolicy pullPolicy,
268+
ImageFetcher(DockerRegistryAuthentication registryAuthentication, PullPolicy pullPolicy,
272269
ImagePlatform platform) {
273-
this.domain = domain;
274270
this.registryAuthentication = registryAuthentication;
275271
this.pullPolicy = pullPolicy;
276272
this.defaultPlatform = platform;
@@ -279,10 +275,6 @@ private class ImageFetcher {
279275
Image fetchImage(ImageType type, ImageReference reference) throws IOException {
280276
Assert.notNull(type, "'type' must not be null");
281277
Assert.notNull(reference, "'reference' must not be null");
282-
String authHeader = authHeader(this.registryAuthentication, reference);
283-
Assert.state(authHeader == null || reference.getDomain().equals(this.domain),
284-
() -> String.format("%s '%s' must be pulled from the '%s' authenticated registry",
285-
StringUtils.capitalize(type.getDescription()), reference, this.domain));
286278
if (this.pullPolicy == PullPolicy.ALWAYS) {
287279
return checkPlatformMismatch(pullImage(reference, type), reference);
288280
}

‎spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/configuration/DockerRegistryConfigAuthentication.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ class DockerRegistryConfigAuthentication implements DockerRegistryAuthentication
4242

4343
private static final String INDEX_URL = "https://index.docker.io/v1/";
4444

45-
private static Map<String, Credential> credentialFromHelperCache = new ConcurrentHashMap<>();
45+
static Map<String, Credential> credentialFromHelperCache = new ConcurrentHashMap<>();
4646

4747
private final DockerRegistryAuthentication fallback;
4848

‎spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/test/java/org/springframework/boot/buildpack/platform/build/BuilderTests.java

-35
Original file line numberDiff line numberDiff line change
@@ -445,41 +445,6 @@ void buildWhenBuilderReturnsErrorThrowsException() throws Exception {
445445
.withMessage("Builder lifecycle 'creator' failed with status code 9");
446446
}
447447

448-
@Test
449-
void buildWhenDetectedRunImageInDifferentAuthenticatedRegistryThrowsException() throws Exception {
450-
TestPrintStream out = new TestPrintStream();
451-
DockerApi docker = mockDockerApi();
452-
Image builderImage = loadImage("image-with-run-image-different-registry.json");
453-
DockerRegistryAuthentication builderToken = DockerRegistryAuthentication.token("builder token");
454-
BuilderDockerConfiguration dockerConfiguration = new BuilderDockerConfiguration()
455-
.withBuilderRegistryAuthentication(builderToken);
456-
ImageReference builderImageReference = DEFAULT_BUILDER;
457-
given(docker.image().pull(eq(builderImageReference), any(), any(), regAuthEq(builderToken)))
458-
.willAnswer(withPulledImage(builderImage));
459-
Builder builder = new Builder(BuildLog.to(out), docker, dockerConfiguration);
460-
BuildRequest request = getTestRequest();
461-
assertThatIllegalStateException().isThrownBy(() -> builder.build(request))
462-
.withMessage(
463-
"Run image 'example.com/custom/run:latest' must be pulled from the 'docker.io' authenticated registry");
464-
}
465-
466-
@Test
467-
void buildWhenRequestedRunImageInDifferentAuthenticatedRegistryThrowsException() throws Exception {
468-
TestPrintStream out = new TestPrintStream();
469-
DockerApi docker = mockDockerApi();
470-
Image builderImage = loadImage("image.json");
471-
DockerRegistryAuthentication builderToken = DockerRegistryAuthentication.token("builder token");
472-
BuilderDockerConfiguration dockerConfiguration = new BuilderDockerConfiguration()
473-
.withBuilderRegistryAuthentication(builderToken);
474-
given(docker.image().pull(eq(DEFAULT_BUILDER), any(), any(), regAuthEq(builderToken)))
475-
.willAnswer(withPulledImage(builderImage));
476-
Builder builder = new Builder(BuildLog.to(out), docker, dockerConfiguration);
477-
BuildRequest request = getTestRequest().withRunImage(ImageReference.of("example.com/custom/run:latest"));
478-
assertThatIllegalStateException().isThrownBy(() -> builder.build(request))
479-
.withMessage(
480-
"Run image 'example.com/custom/run:latest' must be pulled from the 'docker.io' authenticated registry");
481-
}
482-
483448
@Test
484449
void buildWhenRequestedBuildpackNotInBuilderThrowsException() throws Exception {
485450
TestPrintStream out = new TestPrintStream();

‎spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/test/java/org/springframework/boot/buildpack/platform/docker/configuration/DockerRegistryConfigAuthenticationTests.java

+8
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.util.Map;
2626

2727
import com.fasterxml.jackson.core.type.TypeReference;
28+
import org.junit.jupiter.api.BeforeEach;
2829
import org.junit.jupiter.api.Test;
2930
import org.junit.jupiter.api.extension.ExtendWith;
3031

@@ -54,6 +55,11 @@ class DockerRegistryConfigAuthenticationTests {
5455

5556
private Map<String, CredentialHelper> credentialHelpers = new HashMap<>();
5657

58+
@BeforeEach
59+
void cleanup() {
60+
DockerRegistryConfigAuthentication.credentialFromHelperCache.clear();
61+
}
62+
5763
@WithResource(name = "config.json", content = """
5864
{
5965
"auths": {
@@ -310,6 +316,8 @@ void getAuthHeaderWhenEmptyCredHelperReturnsFallbackAndDoesNotUseCredStore(@Reso
310316
this.environment.put("DOCKER_CONFIG", directory.toString());
311317
ImageReference imageReference = ImageReference.of("gcr.io/ubuntu:latest");
312318
String authHeader = getAuthHeader(imageReference, DockerRegistryAuthentication.EMPTY_USER);
319+
// The Docker CLI appears to prioritize the credential helper over the
320+
// credential store, even when the helper is empty.
313321
assertThat(decode(authHeader)).hasSize(4)
314322
.containsEntry("serveraddress", "")
315323
.containsEntry("username", "")

0 commit comments

Comments
 (0)