Skip to content

Remove credential file from spec #262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shizhMSFT merged 1 commit into from
Aug 3, 2022
Merged

Remove credential file from spec #262

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 1 addition & 8 deletions specs/registry-auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ Notation follows the [Docker Registry v2 authentication][oauth2] specification f

## Credential Store

As local credentials may be required to access the remote registries, they need to be stored and accessed securely. To achieve maximum security, credential helpers are preferred so that credentials are stored in the system key chain with better protection. If credential helpers are not available, notation will fall back to credential files with proper access control.
As local credentials may be required to access the remote registries, they need to be stored and accessed securely. To achieve maximum security, credential helpers are preferred so that credentials are stored in the system key chain with better protection. If credential helpers are not available, credentials SHOULD be provided to notation via command line parameters `--username` / `--password` or environment variables `NOTATION_USERNAME` / `NOTATION_PASSWORD`.
Copy link
Contributor

@binbin-li binbin-li Aug 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

username/password options are only supported in notation loging cmd now. Should we mention it here?

Copy link
Contributor

@dtzar dtzar Aug 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we need to clarify what is or is not supported.

Copy link
Contributor Author

@shizhMSFT shizhMSFT Aug 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

username/password options are also supported for notation sign, notation verify, and other commands which need registry accesses.


### Credential Helper

Expand All @@ -109,17 +109,10 @@ The credential store can be specified globally or per registry by setting the no
"registry.wabbit-networks.io": "wabbithelper",
"another.wabbit-networks.io": "foobar"
},
"credsFile": "/absolute/path/to/auth.json",
"credsStore": "whatever"
}
```

**Note** The absolute path to credential file `credsFile` is used to store extra metadata by credential helper drivers such as [docker/cli](https://github.com/docker/cli/blob/master/cli/config/credentials/native_store.go).

### Credential File

TODO: Define local credential experience without credential provider support (#206).

[RFC6749]: https://www.rfc-editor.org/rfc/rfc6749 "OAuth 2.0"
[RFC7617]: https://www.rfc-editor.org/rfc/rfc7617 "Basic Auth"
[token]: https://docs.docker.com/registry/spec/auth/jwt/ "Docker Token Authentication"
Expand Down