Skip to content

Conversation

thaJeztah
Copy link
Member

The message returned by the API is a hardcoded message; the only real information currently returned by the API is whether or not the auth was successul;
https://github.com/moby/moby/blob/v2.0.0-beta.0/daemon/server/router/system/system_routes.go#L408-L421

- What I did

- How I did it

- How to verify it

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

@thaJeztah thaJeztah added this to the 29.0.0 milestone Sep 8, 2025
@codecov-commenter
Copy link

codecov-commenter commented Sep 8, 2025

Codecov Report

❌ Patch coverage is 65.00000% with 7 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
cli/command/registry/login.go 65.00% 7 Missing ⚠️

📢 Thoughts on this report? Let us know!

Signed-off-by: Sebastiaan van Stijn <[email protected]>
The message returned by the API is a hardcoded message; the only real
information currently returned by the API is whether or not the auth
was successul;
https://github.com/moby/moby/blob/v2.0.0-beta.0/daemon/server/router/system/system_routes.go#L408-L421

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
Copy link
Member Author

Flaky test, or did break something?

67.19 === Failed
67.19 === FAIL: cli/command/registry TestLoginWithCredStoreCreds (0.00s)
67.19     login_test.go:80: assertion failed: expected an error, got nil
67.19 
67.19 === FAIL: cli/command/registry TestRunLogin/expired_auth_from_store (0.00s)
67.19     login_test.go:309: assertion failed: expected an error, got nil
67.19 
67.19 === FAIL: cli/command/registry TestRunLogin (0.01s)

Comment on lines -179 to +174
if err := storeCredentials(dockerCLI.ConfigFile(), authConfig); err != nil {
return "", err
}

return response.Status, err
return storeCredentials(dockerCLI.ConfigFile(), authConfig)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah! The existing code shadowed the error; so this function would return when failing to store the credentials, but the error returned is the error from earlier?? return response.Status, err returns the err from response, err := dockerCLI.Client().RegistryLogin(ctx, authConfig), but even on failure, it would still try to store the credentials 🤔

I suspect that was a bug!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this may have been introduced in 6e4818e

Before that patch, loginWithCredStoreCreds would only try to login, but did not handle saving credentials.

func loginWithCredStoreCreds(ctx context.Context, dockerCli command.Cli, authConfig *registrytypes.AuthConfig) (registrytypes.AuthenticateOKBody, error) {
fmt.Fprintf(dockerCli.Out(), "Authenticating with existing credentials...\n")
cliClient := dockerCli.Client()
response, err := cliClient.RegistryLogin(ctx, *authConfig)
if err != nil {
if errdefs.IsUnauthorized(err) {
fmt.Fprintf(dockerCli.Err(), "Stored credentials invalid or expired\n")
} else {
fmt.Fprintf(dockerCli.Err(), "Login did not succeed, error: %s\n", err)
}
}
return response, err
}

So question is; was it intentional to save credentials even if they were invalid or expired? Or was the intent perhaps to remove / reset those credentials so that they wouldn't be used again?

if err := storeCredentials(dockerCLI.ConfigFile(), authConfig); err != nil {
return "", err
}

@thaJeztah thaJeztah marked this pull request as draft September 8, 2025 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants