docker-credential-helpers icon indicating copy to clipboard operation
docker-credential-helpers copied to clipboard

`StoreExample` in client package uses full URL, which seems to disagree with other implementations

Open apparentlymart opened this issue 3 months ago • 0 comments

The client package includes an example of how to use client.Store:

https://github.com/docker/docker-credential-helpers/blob/b7a754b9ffdf0e99e63ca384435bdacf4bc83e6b/client/client_test.go#L95-L105

The ServerURL field is set to a URL including a scheme here, which on the surface seems correct for a field named ServerURL. However, in practice it seems like existing callers like docker login set this field to include just a hostname instead, such as "registry.example.com".

I notice that at least some of the actual credential helper implementations in this repository use registryurl.Parse, which normalizes this difference away a little by turning a bare hostname into a schemeless URL:

https://github.com/docker/docker-credential-helpers/blob/b7a754b9ffdf0e99e63ca384435bdacf4bc83e6b/registryurl/parse.go#L9-L37

...but others, such as the pass helper, just take whatever they are given and use it without any normalization:

https://github.com/docker/docker-credential-helpers/blob/b7a754b9ffdf0e99e63ca384435bdacf4bc83e6b/pass/pass.go#L193-L197

...so in order to interop with other implementations I presumably need to exactly match the way they would populate this field.

My main hope in opening this issue is to confirm that I've correctly understood that the code example for Store and the documentation in the main README of this repository are both incorrect and that the actual credential helper protocol (as expected by existing real implementations) is to send just a plain hostname wherever a "server URL" is expected.

Is that correct, or is the situation more subtle than that? 🤔

Given that many implementations just take "ServerURL" verbatim and use it as a key, I assume the caller is also responsible for normalizing the hostname for case-insensitive comparison, such as by using idna.Profile.ToUnicode on one of the four IDNA profiles. Is there any established convention for exactly what normalization is to be used here?

Thanks!

apparentlymart avatar Nov 26 '25 01:11 apparentlymart