cli/config/credentials: refactor DetectDefaultStore and add tests by thaJeztah · Pull Request #5568 · docker/cli

thaJeztah · 2024-10-21T20:48:14Z

Refactor the DetectDefaultStore to allow testing it cross-platform, and without the actual helpers installed.

This also makes a small change in the logic for detecting the preferred helper. Previously, it only detected the "helper" binary ("pass"), but would fall back to using plain-text if the pass credentials-helper was not installed.

With this patch, it falls back to the platform default (secretservice), before falling back to using no credentials helper (and storing unencrypted).

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

codecov-commenter · 2024-10-21T20:50:47Z

Codecov Report

❌ Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cli/config/credentials/default_store.go	87.50%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

laurazard

Left some nits/comments. I'm not super convinced about having the whole pass logic (check for both the pass binary and docker-credential-pass) outside of _linux.go.

Maybe we could have a separate checkForPreferredHelper func that we can override instead, or some other solution that allows to keep this code separate while still making it possible to test cross-platform?

laurazard · 2024-10-28T15:39:00Z

+func DetectDefaultStore(customStore string) string {
+	if customStore != "" {
 // use user-defined
- return store
+ return customStore
 	}


Sidenote, but
funcbork(foostring) string { iffoo!="" { returnfoo } ... }
is definitely something 😅 we should see if we could change this for the next major.

Right, so I the logic here was that if the config-file has a credentials-store configured, we accept it whatever it is, and consider it an option set by the user; when used, it may error, but that's intentional (you configured a helper, we tried using it, and it failed! intervention is needed).

But now the fun bit;
cli/cli/config/config.go
Lines 162 to 172 in 32ff200
funcLoadDefaultConfigFile(stderr io.Writer) *configfile.ConfigFile {
configFile, err:=load(Dir())
iferr!=nil {
// FIXME(thaJeztah): we should not proceed here to prevent overwriting existing (but malformed) config files; see https://github.com/docker/cli/issues/5075
_, _=fmt.Fprintln(stderr, "WARNING: Error", err)
}
if!configFile.ContainsAuth() {
configFile.CredentialsStore=credentials.DetectDefaultStore(configFile.CredentialsStore)
}
returnconfigFile
}
See what's wrong in the logic there? Hint:
cli/cli/config/config.go
Line 168 in 32ff200
if!configFile.ContainsAuth() {
That nice porcelain ContainsAuth() function checks if either a credentials-store is configured or per-registry helpers, or contains credentials;
cli/cli/config/configfile/file.go
Lines 90 to 94 in 32ff200
func (configFile*ConfigFile) ContainsAuth() bool {
returnconfigFile.CredentialsStore!=""||
len(configFile.CredentialHelpers) >0||
len(configFile.AuthConfigs) >0
}
I guess we could consider it an extra line of defence to never overwrite what's there, but definitely a bit iffy, and looks like it was there from the start moby/moby@cf721c2

laurazard · 2024-10-28T15:41:34Z

+	if preferred := findPreferredHelper(); preferred != "" {
+ return preferred
+	}
+	if defaultHelper == "" {
+ return ""
+	}
+	if _, err := exec.LookPath(remoteCredentialsPrefix + defaultHelper); err != nil {
+ return ""
+	}
+	return defaultHelper
+}


Why are we testing for defaultHelper's existence, but not preferred's?

Nevermind, I see that the test for the preferred helper is inside findPreferredHelper. I find this a bit hard to read, maybe because it mixes levels of abstraction. Maybe instead we could do something like
Suggested change
ifpreferred:=findPreferredHelper(); preferred!="" {
returnpreferred
}
ifdefaultHelper=="" {
return""
}
if_, err:=exec.LookPath(remoteCredentialsPrefix+defaultHelper); err!=nil {
return""
}
returndefaultHelper
}
ifpreferred:=findPreferredHelper(); preferred!="" {
returnpreferred
}
returnfindDefaultHelper()
}
funcfindDefaultHelper() string {
ifdefaultHelper=="" {
return""
}
if_, err:=exec.LookPath(remoteCredentialsPrefix+defaultHelper); err!=nil {
return""
}
returndefaultHelper
}

laurazard · 2024-10-28T15:44:54Z

+	// Note that the logic below is specific to detection needed for the
+	// "pass" credentials-helper on Linux (which is the only platform with
+	// a "preferred" and "default" helper. This logic may change if a similar
+	// order of preference is needed on other platforms.


The "detection" logic below is generic, right? It's only used for linux (because linux is the only platform with a preferred helper), but would work for any other platform all the same?

// a "preferred" and "default" helper. This logic may change if a similar// order of preference is needed on other platforms.
If this comment as a whole is about the preferred vs default helper order of preference, then I'd suggest placing it above, inside DetectDefaultStore near the operations regarding both the preferred and default helpers.

The "detection" logic below is generic, right? It's only used for linux (because linux is the only platform with a preferred helper), but would work for any other platform all the same?
AAAHH, this is about checking for both pass and docker-credential-pass. I wonder if we can make this clearer. Maybe separate this comment from the comment about the order (preferred vs default)? It was somewhat hard to figure out what this comment was about.

I realize you moved this here in order to make this easier to test cross-platform, but this is exactly the type of thing that would make sense to put in a _linux.go file and not leak to the rest of the code – otherwise, we need to have it here with a number of comments explaining why, while it's unnecessary for anyone worrying about any other platform to look at).

thaJeztah · 2024-10-28T22:29:29Z

Thanks for reviewing! I fixed the typo; will have a look at the other bits tomorrow.

I guess we could generalize the for a credentials helper to have a "prerequisites check" (for docker-credentials-pass that would be "check if the pass binary is found". Other helpers would then have an empty func for that.

Perhaps ultimately, the credentials-helpers themselves could have some check (docker-credential-foo --check), but not sure if we want to go that route 😅

laurazard · 2024-10-30T10:39:34Z

Perhaps ultimately, the credentials-helpers themselves could have some check (docker-credential-foo --check), but not sure if we want to go that route

Honestly that sounds like the most sane idea to me – the CLI can't be expected to account for all the different credential helpers and their requirements, they should do it themselves. Maybe even something like the metadata we have for plugins, credential-helpers could have a similar thing that would include if they are "ready" to be used or not, and some error message.

Or the API could just be exit_code == 0 means it's fine, otherwise it's not and it prints some error message.

Refactor the DetectDefaultStore to allow testing it cross-platform, and without the actual helpers installed. This also makes a small change in the logic for detecting the preferred helper. Previously, it only detected the "helper" binary ("pass"), but would fall back to using plain-text if the pass credentials-helper was not installed. With this patch, it falls back to the platform default (secretservice), before falling back to using no credentials helper (and storing unencrypted). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah · 2026-05-08T12:05:59Z

I can move this one to 29.5.1 - it's been pending for some time, so not urgent

thaJeztah added status/2-code-review kind/refactor PR's that refactor, or clean-up code area/authentication labels Oct 21, 2024

thaJeztah added this to the 28.0.0 milestone Oct 21, 2024

thaJeztah self-assigned this Oct 21, 2024

thaJeztah requested a review from laurazard October 24, 2024 16:54

laurazard reviewed Oct 28, 2024
View reviewed changes

thaJeztah force-pushed the refactor_DetectDefaultStore branch from e8e05fd to 555aba2Compare October 28, 2024 22:26

thaJeztah modified the milestones: 28.0.0, 28.0.5 Mar 31, 2025

thaJeztah modified the milestones: 28.1.1, 28.1.2Apr 23, 2025

thaJeztah modified the milestones: 28.1.2, 28.2.0, 29.0.0 May 15, 2025

thaJeztah modified the milestones: 29.0.0, 29.2.0 Jan 13, 2026

thaJeztah modified the milestones: 29.2.0, 29.2.1, 29.2.2Jan 26, 2026

thaJeztah modified the milestones: 29.2.2, 29.3.1 Mar 2, 2026

thaJeztah modified the milestones: 29.4.0, 29.4.1 Apr 3, 2026

thaJeztah removed this from the 29.4.1 milestone Apr 20, 2026

thaJeztah added this to the 29.4.2 milestone Apr 20, 2026

vvoland modified the milestones: 29.4.2, 29.4.3, 29.5.0 May 1, 2026

thaJeztah force-pushed the refactor_DetectDefaultStore branch 2 times, most recently from d6d5f2b to 4ce9681Compare May 7, 2026 15:21

thaJeztah mentioned this pull request May 7, 2026
cli/config/credentials: DetectDefaultStore: update GoDoc #6966
Merged

vvoland reviewed May 8, 2026
View reviewed changes

Comment threadcli/config/credentials/default_store_test.go Outdated

thaJeztah force-pushed the refactor_DetectDefaultStore branch from 4ce9681 to a378b19Compare May 8, 2026 11:59

thaJeztah force-pushed the refactor_DetectDefaultStore branch from a378b19 to b3d49efCompare May 8, 2026 12:03

thaJeztah modified the milestones: 29.5.0, 29.5.1 May 8, 2026

vvoland modified the milestones: 29.5.1, 29.5.2 May 18, 2026

thaJeztah modified the milestones: 29.5.2, 29.5.3 May 20, 2026

vvoland modified the milestones: 29.5.3, 29.6.0 Jun 3, 2026

thaJeztah modified the milestones: 29.6.0, 29.6.1 Jun 12, 2026

vvoland modified the milestones: 29.6.1, 29.7.0 Jun 30, 2026

vvoland modified the milestones: 29.7.0, 29.8.0 Jul 30, 2026

	funcLoadDefaultConfigFile(stderr io.Writer) *configfile.ConfigFile {
	configFile, err:=load(Dir())
	iferr!=nil {
	// FIXME(thaJeztah): we should not proceed here to prevent overwriting existing (but malformed) config files; see https://github.com/docker/cli/issues/5075
	_, _=fmt.Fprintln(stderr, "WARNING: Error", err)
	}
	if!configFile.ContainsAuth() {
	configFile.CredentialsStore=credentials.DetectDefaultStore(configFile.CredentialsStore)
	}
	returnconfigFile
	}

	func (configFile*ConfigFile) ContainsAuth() bool {
	returnconfigFile.CredentialsStore!=""\|\|
	len(configFile.CredentialHelpers) >0\|\|
	len(configFile.AuthConfigs) >0
	}

-ifpreferred:=findPreferredHelper(); preferred!="" {
-returnpreferred
-	}
-ifdefaultHelper=="" {
-return""
-	}
-if_, err:=exec.LookPath(remoteCredentialsPrefix+defaultHelper); err!=nil {
-return""
-	}
-returndefaultHelper
-}
+ifpreferred:=findPreferredHelper(); preferred!="" {
+returnpreferred
+	}
+returnfindDefaultHelper()
+}
+funcfindDefaultHelper() string {
+ifdefaultHelper=="" {
+return""
+	}
+if_, err:=exec.LookPath(remoteCredentialsPrefix+defaultHelper); err!=nil {
+return""
+	}
+returndefaultHelper
+}

Uh oh!

Conversation

thaJeztah commented Oct 21, 2024

Uh oh!

codecov-commenter commented Oct 21, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

laurazard left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Oct 28, 2024

Uh oh!

laurazard commented Oct 30, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

thaJeztah commented May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Oct 21, 2024•
edited
Loading

laurazard commented Oct 30, 2024•
edited
Loading