[27.x backport]cli/config/credentials: skip saving config-file if credentials didn't change #5569
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… change
Before this change, the config-file was always updated, even if there
were no changes to save. This could cause issues when the config-file
already had credentials set and was read-only for the current user.
For example, on NixOS, this poses a problem because `config.json` is a
symlink to a write-protected file;
$ readlink ~/.docker/config.json
/home/username/.config/sops-nix/secrets/ghcr_auth
$ readlink -f ~/.docker/config.json
/run/user/1000/secrets.d/28/ghcr_auth
Which causes `docker login` to fail, even if no changes were to be made;
Error saving credentials: rename /home/derek/.docker/config.json2180380217 /home/username/.config/sops-nix/secrets/ghcr_auth: invalid cross-device link
This patch updates the code to only update the config file if changes
were detected. It there's nothing to save, it skips updating the file,
as well as skips printing the warning about credentials being stored
insecurely.
With this patch applied:
$ docker login -u yourname
Password:
WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/
Login Succeeded
$ docker login -u yourname
Password:
Login Succeeded
Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit d3f6867)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## 27.x #5569 +/- ##
=======================================
Coverage 58.65% 58.66%
=======================================
Files 345 345
Lines 29042 29047 +5
=======================================
+ Hits 17035 17040 +5
Misses 11036 11036
Partials 971 971 |
This function was names slightly confusing, as it returns a fakeStore, and it didn't do any constructing, so didn't provide value above just constructing the type. I'm planning to add more functionality to the fakeStore, but don't want to maintain a full-fledged constructor for all of that, so let's remove this utility. Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 0dd6f7f) Signed-off-by: Sebastiaan van Stijn <[email protected]>
Test case for d3f6867 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 3c78069) Signed-off-by: Sebastiaan van Stijn <[email protected]>
thaJeztah
force-pushed
the
27.x_backport_login_idempotent
branch
from
3f64900
to
6736be7
Compare
laurazard
approved these changes
Oct 22, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this change, the config-file was always updated, even if there were no changes to save. This could cause issues when the config-file already had credentials set and was read-only for the current user.
For example, on NixOS, this poses a problem because
config.jsonis a symlink to a write-protected file;Which causes
docker loginto fail, even if no changes were to be made;Error saving credentials: rename /home/derek/.docker/config.json2180380217 /home/username/.config/sops-nix/secrets/ghcr_auth: invalid cross-device linkThis patch updates the code to only update the config file if changes were detected. It there's nothing to save, it skips updating the file, as well as skips printing the warning about credentials being stored insecurely.
With this patch applied:
- How to verify it
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)