From 1d01bb4681a88621a1e8b29f354e1abf56a8066e Mon Sep 17 00:00:00 2001 From: itowlson Date: Tue, 21 Oct 2025 13:47:21 +1300 Subject: [PATCH 1/2] Use registry host rather than URL for creds lookup Signed-off-by: itowlson --- crates/wasm-pkg-client/src/oci/mod.rs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/crates/wasm-pkg-client/src/oci/mod.rs b/crates/wasm-pkg-client/src/oci/mod.rs index 3ab4258..49b09f4 100644 --- a/crates/wasm-pkg-client/src/oci/mod.rs +++ b/crates/wasm-pkg-client/src/oci/mod.rs @@ -112,8 +112,7 @@ impl OciBackend { )); } - let server_url = format!("https://{}", self.oci_registry); - match docker_credential::get_credential(&server_url) { + match docker_credential::get_credential(&self.oci_registry) { Ok(DockerCredential::UsernamePassword(username, password)) => { return Ok(RegistryAuth::Basic(username, password)); } From 46acd2d719e5fa4b5b9783d29334557870c0be46 Mon Sep 17 00:00:00 2001 From: itowlson Date: Wed, 22 Oct 2025 12:43:16 +1300 Subject: [PATCH 2/2] Check both registry and schemeful URL for Docker creds Signed-off-by: itowlson --- crates/wasm-pkg-client/src/oci/mod.rs | 60 +++++++++++++++++---------- 1 file changed, 37 insertions(+), 23 deletions(-) diff --git a/crates/wasm-pkg-client/src/oci/mod.rs b/crates/wasm-pkg-client/src/oci/mod.rs index 49b09f4..cfca937 100644 --- a/crates/wasm-pkg-client/src/oci/mod.rs +++ b/crates/wasm-pkg-client/src/oci/mod.rs @@ -112,31 +112,17 @@ impl OciBackend { )); } - match docker_credential::get_credential(&self.oci_registry) { - Ok(DockerCredential::UsernamePassword(username, password)) => { - return Ok(RegistryAuth::Basic(username, password)); - } - Ok(DockerCredential::IdentityToken(_)) => { - return Err(Error::CredentialError(anyhow::anyhow!( - "identity tokens not supported" - ))); - } - Err(err) => { - if matches!( - err, - CredentialRetrievalError::ConfigNotFound - | CredentialRetrievalError::ConfigReadError - | CredentialRetrievalError::NoCredentialConfigured - | CredentialRetrievalError::HelperFailure { .. } - ) { - tracing::debug!("Failed to look up OCI credentials: {err}"); - } else { - tracing::warn!("Failed to look up OCI credentials: {err}"); - }; + match get_docker_credential(&self.oci_registry)? { + Some(c) => Ok(c), + None => { + tracing::debug!("Failed to look up OCI credentials by registry, trying server URL"); + let server_url = format!("https://{}", self.oci_registry); + match get_docker_credential(&server_url)? { + Some(c) => Ok(c), + None => Ok(RegistryAuth::Anonymous), + } } } - - Ok(RegistryAuth::Anonymous) } pub(crate) fn make_reference( @@ -164,3 +150,31 @@ pub(crate) fn oci_registry_error(err: OciDistributionError) -> Error { _ => Error::RegistryError(err.into()), } } + +fn get_docker_credential(registry: &str) -> Result, Error> { + match docker_credential::get_credential(registry) { + Ok(DockerCredential::UsernamePassword(username, password)) => { + return Ok(Some(RegistryAuth::Basic(username, password))); + } + Ok(DockerCredential::IdentityToken(_)) => { + return Err(Error::CredentialError(anyhow::anyhow!( + "identity tokens not supported" + ))); + } + Err(err) => { + if matches!( + err, + CredentialRetrievalError::ConfigNotFound + | CredentialRetrievalError::ConfigReadError + | CredentialRetrievalError::NoCredentialConfigured + | CredentialRetrievalError::HelperFailure { .. } + ) { + tracing::debug!("Failed to look up OCI credentials: {err}"); + } else { + tracing::warn!("Failed to look up OCI credentials: {err}"); + }; + } + } + + Ok(None) +}