Add function to set custom auth scope in context#3662
Add function to set custom auth scope in context#3662crosbymichael merged 1 commit intocontainerd:masterfrom
Conversation
cpuguy83
force-pushed
the
set_custom_scopes_for_authorizer
branch
from
6c355f3 to
bebf8de
Compare
|
Build succeeded.
|
Codecov Report
@@ Coverage Diff @@
## master #3662 +/- ##
==========================================
+ Coverage 42.37% 42.44% +0.06%
==========================================
Files 127 127
Lines 14075 14078 +3
==========================================
+ Hits 5964 5975 +11
+ Misses 7211 7203 -8
Partials 900 900
Continue to review full report at Codecov.
|
|
Overall looks good, just a few naming nits. As for the For a little bit of background on why that weird type was added in the first place. The original intent was to prevent older version of Docker which did not check media types from accidentally pulling plugins and attempting to run them. The runtime errors when doing that were non-obvious. Those older versions are mostly out of use and combined with the small number of plugins, the (teeny-)tiny likelihood of it being an issue makes continuing that non-standard approach unnecessary. |
Currently auth.docker.io uses a custom auth scope for (docker) plugins `repository(plugin):<repo>:<perms>`. This makes it impossible to use containerd distribution tooling to fetch plugins without also supplying a totally custom authorizer. This changes allows clients to set the correct scope on the context. It's a little bit nasty but "works". I'm also a bit suspect of some a couple of these unexported context functrions. Before the primary one used `contextWithRepositoryScope` overwrites any scope value and there is another one that appends the scope value. With this change they both append... Signed-off-by: Brian Goff <[email protected]>
cpuguy83
force-pushed
the
set_custom_scopes_for_authorizer
branch
from
bebf8de to
e84a84a
Compare
|
Build succeeded.
|
|
LGTM |
4 participants
Currently auth.docker.io uses a custom auth scope for (docker) plugins
repository(plugin):<repo>:<perms>.This makes it impossible to use containerd distribution tooling to fetch
plugins without also supplying a totally custom authorizer.
This changes allows clients to set the correct scope on the context.
It's a little bit nasty but "works".
I'm also a bit suspect of some a couple of these unexported context
functrions. Before the primary one used
contextWithRepositoryScopeoverwrites any scope value and there is nother one that appends the
scope value.
With this change they both append...