Add support for registry v3 JWK thumbprint key ID format #401
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: evanebb <git@evanus.nl>
|
Thanks @evanebb for providing this PR. I can confirm this fixes the issues when upgrading from @cesanta do you want to take a look at this PR please? Until this gets merged, one might use the image I built which includes this change: docker pull ghcr.io/choopm/docker_auth
# or
docker pull ghcr.io/choopm/docker_auth:1.13.0-1-g914f526https://github.com/users/choopm/packages/container/package/docker_auth |
techknowlogick
approved these changes
May 15, 2025
This was referenced Jul 16, 2025
RaveNoX
pushed a commit
to deckhouse/3p-docker_auth
that referenced
this pull request
Aug 27, 2025
Signed-off-by: evanebb <git@evanus.nl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #386.
This is a fairly quick and dirty fix, feel free to burn this PR down :)
As mentioned in that issue, the v3 version of the registry no longer supports
libtrustkey IDs. There are multiple alternative options to choose from, but the simplest one to implement for this project is using the JWK thumbprint of the public key as the key ID instead.For every certificate present in the
rootcertbundlepassed to the registry, it'll add the public key to the trusted keys identified by the JWK thumbprint: https://github.com/distribution/distribution/blob/63d3892315c817c931b88779399a8e9142899a8e/registry/auth/token/accesscontroller.go#L346-L348So, if you pass this JWK thumbprint in the key ID header in the token, the registry can select the proper signing key using this thumbprint.
This PR allows configuring this through a new directive in the configuration file, namely
token.disable_legacy_key_id.If set to true, it will pass the JWK thumbprint in the key ID header instead of the
libtrustkey ID. It defaults to false for now, to avoid accidental breakage when updating setups using the v2 registry.