Credential library support for legacy auth config keys

[AaronFriel]

Regarding the initiative to create a general authentication library for registries (thanks to @shizhMSFT in #413), I encountered some legacy behavior in the Docker credential helper libraries and thought it should be documented to ensure ORAS supports it in this new library.

Credential helpers may return keys either of the form, e.g., https://ghcr.io or ghcr.io, or the original Docker index server URL https://index.docker.io/v1/. See, Docker issue: docker/docker-credential-helpers#256

To handle this, libraries implementing auth and intending to choose an auth configuration must:

1. Use a ToHostname routine to homogenize the input server name, removing the scheme and then path parts after the hostname. This function would take a name like https://ghcr.io/aaronfriel and return ghcr.io.

2. First attempt a direct lookup in the map (authConfigs["ghcr.io"]), and early return on success. Otherwise, iterate over the map and perform the ToHostname conversion on each of the keys, returning the first key that equals the input ("ghcr.io" == ToHostname(key)).

Example: https://github.com/docker/cli/blob/v20.10.23/cli/config/credentials/file_store.go#L33-L47

[Wwwsylvia]

Hi @AaronFriel, thanks for the information! Does this issue occur on both native store (desktop, pass, etc.) and config file store?

[AaronFriel]

I think so @Wwwsylvia, but this is primarily an advisory issue that we'll need to handle entries with and without https:// prefixes. On macOS, it looks like the credential store preferentially returns the https:// prefix as of Feb 6, 2023.

[wangxiaoxuan273]

I think so @Wwwsylvia, but this is primarily an advisory issue that we'll need to handle entries with and without https:// prefixes. On macOS, it looks like the credential store preferentially returns the https:// prefix as of Feb 6, 2023.

I tested on my mac today, it still prefixes https://.

[wangxiaoxuan273]

I have tested with oras-credential-go, we don't need the https prefix to retrieve the credentials from OSX keychain. The current implementation of oras-credential-go works fine.

[Wwwsylvia]

I have tested with oras-credential-go, we don't need the https prefix to retrieve the credentials from OSX keychain. The current implementation of oras-credential-go works fine.

Thanks @wangxiaoxuan273 for the testing!
It looks like adding https prefix is a osxkeychain-specific behaviour, and it has been handled by the docker-credential-helpers library so that we don't need to worry about that at the oras-credentials-go level.
For the https://index.docker.io/v1/ redirection, we support it in the Credential() function (See PR #45).

[shizhMSFT]

Closing this issue as it is handled by the osxkeychain helper as mentioned by @wangxiaoxuan273 and @Wwwsylvia.

[Wwwsylvia]

The issue still exists. See notaryproject/notation#801.

[Wwwsylvia]

Closing as #100 has been merged.