refactor: remove curl fallback

.bazelrc

@@ -9,8 +9,11 @@ test --test_env=DOCKER_HOST
 # Disable bzlmod lockfile
 common --lockfile_mode=off
 
-# TODO(2.0): enable once we drop support for Bazel 5.
-# common --credential_helper=public.ecr.aws=%workspace%/examples/credential_helper/auth.sh
+# On bazel 6.4.0 these are needed to successfully fetch images.
+common:needs_credential_helpers --credential_helper=public.ecr.aws=%workspace%/examples/credential_helper/auth.sh
+common:needs_credential_helpers --credential_helper=index.docker.io=%workspace%/examples/credential_helper/auth.sh
+common:needs_credential_helpers --credential_helper=docker.elastic.co=%workspace%/examples/credential_helper/auth.sh
+common:needs_credential_helpers --credential_helper_cache_duration=0
 
 # Load any settings specific to the current user.
 # .bazelrc.user should appear in .gitignore so that settings are not shared with team members

.github/workflows/ci.yaml

@@ -103,6 +103,19 @@ jobs:
         if: matrix.bzlmodEnabled
         run: echo "bzlmod_flag=--enable_bzlmod" >> $GITHUB_OUTPUT
 
+      - name: Set credential helpers flag
+        # Add --config needs_credential_helpers to add additional credential helpers
+        # to fetch from registries with HTTP headers set by credential helpers.
+        id: set_credential_helper_flag
+        if: matrix.bazelversion == '6.4.0' && matrix.folder == '.'
+        run: echo "credential_helper_flag=--config=needs_credential_helpers" >> $GITHUB_OUTPUT
+
+      - name: Setup crane for credential helpers to use
+        uses: imjasonh/setup-crane@v0.3
+        if: matrix.bazelversion == '6.4.0' && matrix.folder == '.'
+        with:
+          version: "v0.19.1"
+
       - name: Configure Bazel version
         working-directory: ${{ matrix.folder }}
         run: echo "${{ matrix.bazelversion }}" > .bazelversion
@@ -146,4 +159,10 @@ jobs:
         env:
           # Bazelisk will download bazel to here, ensure it is cached between runs.
           XDG_CACHE_HOME: ~/.cache/bazel-repo
-        run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test ${{ steps.set_bzlmod_flag.outputs.bzlmod_flag }} //...
+        run: |
+          bazel \
+          --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc \
+          --bazelrc=.bazelrc  \
+          test //... \
+          ${{ steps.set_bzlmod_flag.outputs.bzlmod_flag }} \
+          ${{ steps.set_credential_helper_flag.outputs.credential_helper_flag }}

examples/credential_helper/auth.sh

@@ -1,14 +1,15 @@
 #!/usr/bin/env bash
 
 # Requirements 
-#   - curl
+#   - crane
 #   - jq
 #   - awk
 #  
 #  ./examples/credential_helper/auth.sh <<< '{"uri":"https://public.ecr.aws/token/?scope\u003drepository:lambda/python:pull\u0026service\u003dpublic.ecr.aws"}'
 #  ./examples/credential_helper/auth.sh <<< '{"uri":"https://public.ecr.aws/v2/lambda/python/manifests/3.11.2024.01.25.10"}'
+
 function log () {
-    echo "$1" >> /tmp/oci_auth.log
+    echo $@ >> "/tmp/oci_auth.log"
 }
 
 log ""
@@ -20,18 +21,39 @@ log "Payload: $input"
 uri=$(jq -r ".uri" <<< $input)
 log "URI: $uri"
 
-host="$(echo $uri | awk -F[/:] '{print $4}')"
+host="$(awk -F[/:] '{print $4}' <<< $uri)"
 log "Host: $host"
 
+
 if [[ $input == *"/token"* ]]; then
     log "Auth: None"
     echo "{}"
-    exit 0
+    exit 1
 fi
 
+repository=$(awk -F'^https?://|v2/|/manifests|/blobs' '{print $2 $3}' <<< "$uri")
+log "Repository: $repository"
+
+
+ACCEPTED_MEDIA_TYPES='[
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.oci.image.index.v1+json"
+]'
+
+
 # This will write the response to stdout in a format that Bazels credential helper protocol understands.
 # Since this is called by Bazel, users won't bee seeing output of this.
-curl -fsSL https://$host/token | jq '{headers:{"Authorization": [("Bearer " + .token)]}}'
+crane auth token "$repository" | 
+jq --argjson accept "$ACCEPTED_MEDIA_TYPES" \
+'{headers: {Authorization: [("Bearer " + .token)], Accept: [($accept | join(", "))], "Docker-Distribution-API-Version": ["registry/2.0"] }}'
+
+if [[ $? != 0 ]]; then 
+    log "Auth: Failed"
+    exit 1
+fi 
 log "Auth: Complete"
 
-# Alternatively you can call an external program such as `docker-credential-ecr-login` to perform the token exchange.
+
+# Alternatively you can call an external program such as `docker-credential-ecr-login` to perform the token exchange.

fetch.bzl

@@ -31,18 +31,18 @@ def fetch_images():
         ],
     )
 
-    # Pull an image from public ECR. 
+    # Pull an image from public ECR.
     # When --credential_helper is provided, see .bazelrc at workspace root, it will take precende over
-    # auth from oci_pull. However, pulling from public ECR works out of the box so this will never fail 
+    # auth from oci_pull. However, pulling from public ECR works out of the box so this will never fail
     # unless oci_pull's authentication mechanism breaks and --credential_helper is absent.
     oci_pull(
         name = "ecr_lambda_python",
         image = "public.ecr.aws/lambda/python",
         tag = "3.11.2024.01.25.10",
         platforms = [
             "linux/amd64",
-            "linux/arm64/v8"
-        ]
+            "linux/arm64/v8",
+        ],
     )
 
     # Show that the digest is optional.
@@ -172,7 +172,7 @@ def fetch_images():
         digest = "sha256:9a83bce5d337e7e19d789ee7f952d36d0d514c80987c3d76d90fd1afd2411a9a",
         platforms = [
             "linux/amd64",
-            "linux/arm64"
+            "linux/arm64",
         ],
     )
 
@@ -183,7 +183,7 @@ def fetch_images():
         digest = "sha256:8d38ffa8fad72f4bc2647644284c16491cc2d375602519a1f963f96ccc916276",
         platforms = [
             "linux/amd64",
-            "linux/arm64"
+            "linux/arm64",
         ],
     )
 
@@ -195,9 +195,12 @@ def fetch_images():
     )
 
     _DEB_TO_LAYER = """\
-alias(
+genrule(
     name = "layer",
-    actual = ":data.tar.xz",
+    srcs = [":data.tar.xz"],
+    outs = ["data.tar.zst"],
+    cmd = "$(BSDTAR_BIN) --zstd -cf $@ @$<",
+    toolchains = ["@bsd_tar_toolchains//:resolved_toolchain"],
     visibility = ["//visibility:public"],
 )
 """

oci/private/BUILD.bazel

@@ -51,7 +51,6 @@ bzl_library(
     ],
     deps = [
         "//oci/private:authn",
-        "//oci/private:download",
         "//oci/private:util",
         "@bazel_skylib//lib:dicts",
     ],
@@ -84,13 +83,6 @@ bzl_library(
     visibility = ["//oci:__subpackages__"],
 )
 
-bzl_library(
-    name = "download",
-    srcs = ["download.bzl"],
-    visibility = ["//oci:__subpackages__"],
-    deps = ["@bazel_skylib//lib:versions"],
-)
-
 bzl_library(
     name = "authn",
     srcs = ["authn.bzl"],