Content of skopeo authfile

Incus
1

For debugging reasons I would like to see the content the authfile that is provided to skopeo.

Which path should be travelled to see what was in files as /var/lib/incus/images/incus_client_auth_2662719387?

2

For what it is worth: I do have valid credentials. Example given:

$ skopeo inspect docker://dhi.io/harbor-portal:2-debian-dev | jq .Name
"dhi.io/harbor-portal"
$
3

A single thread for the same problem is enough.

run as root and see if the same works.

EDIT: to be clear, that wasn’t a complaint — easier for me to follow one thread on the same failure, that’s all.

4

Travelled path, for me a long walk, you are welcome to speed run it.

a dry-run:

$ skopeo-trap yeah what ever ever --authfile=/etc/hosts
so far
$ cat /dev/shm/af_data 
-rw-r--r-- 1 root root 908 16 aug 11:50 /etc/hosts
$ head -n 1 /dev/shm/af_content 
127.0.0.1	localhost
$

What is inside skopeo-trap:

#!/bin/bash
if [ $# -lt 5 ] ; then
  echo "too few parameters" 1>&2
  exit 1
fi

IFS='=' read -r K V <<< $5

if [ $K == '--authfile' ] ; then
  cp -p $V   /dev/shm/af_content
  ls -l $V > /dev/shm/af_data
else
  echo "param5 $5" 1>&2
  exit 1
fi

echo "so far" 1>&2
exit 1

Preparation, as root

# cd /usr/bin/
# mv skopeo skopeo-aside
# ln -s /home/stappers/bin/skopeo-trap skopeo
# exit

Lure

$ incus launch harder:harbor-portal:2-debian-dev harbor
Launching harbor
Error: Failed instance creation: Failed getting remote \
  image info: Failed to run: skopeo --insecure-policy \
  inspect docker://dhi.io/harbor-portal:2-debian-dev --no-tags \
  --authfile=/var/lib/incus/images/incus_client_auth_3271860616: exit \
  status 1 (so far)
$

Cleanup, as root

# cd /usr/bin/
# rm skopeo
# mv skopeo-aside skopeo
# exit

Caught:

$ ls -l /dev/shm/af_*
-rw------- 1 root root 72 26 aug 15:48 /dev/shm/af_content
-rw-r--r-- 1 root root 90 26 aug 15:48 /dev/shm/af_data
$ sudo head /dev/shm/af_*
==> /dev/shm/af_content <==
{"auths":{"https://dhi.io":{"auth":"YWNjb3VudDpwJTQwc3N3MHJE"}}}
==> /dev/shm/af_data <==
-rw------- 1 root root 72 26 aug 15:48 /var/lib/incus/images/incus_client_auth_3271860616
$

Decoding, encoding and modified file.
Because my password contains @, not %40

$ echo YWNjb3VudDpwJTQwc3N3MHJE | base64 -d
account:p%40ssw0rD
$ echo -n account:p@ssw0rD | base64
YWNjb3VudDpwQHNzdzByRA==
$ cat /dev/shm/af_modified
{"auths":{"https://dhi.io":{"auth":"YWNjb3VudDpwQHNzdzByRA=="}}}
$

Running skopeo with modified authfile.

$ skopeo --insecure-policy inspect docker://dhi.io/harbor-portal:2-debian-dev --no-tags --authfile=/dev/shm/af_modified | jq .Name
"dhi.io/harbor-portal"
$

Yes, with the actual @ in the password, it works.

5

Does this mean in tools like “incus” or “incus-compose” we should base64 the result?

6

For what it is worth: an actual bugreport is pending.

7

Bugreport created: