feat: Support basic auth and bearer auth login to registry (#3310)

Signed-off-by: Tosone <i@tosone.cn>
sigstore · Nov 7, 2023 · 827f24e · 827f24e
1 parent 8ac891f
commit 827f24e
Show file tree

Hide file tree

Showing 21 changed files with 74 additions and 0 deletions.
diff --git a/cmd/cosign/cli/options/registry.go b/cmd/cosign/cli/options/registry.go
@@ -44,6 +44,7 @@ type RegistryOptions struct {
 	KubernetesKeychain bool
 	RefOpts            ReferenceOptions
 	Keychain           Keychain
+	AuthConfig         authn.AuthConfig
 
 	// RegistryClientOpts allows overriding the result of GetRegistryClientOpts.
 	RegistryClientOpts []remote.Option
@@ -62,6 +63,15 @@ func (o *RegistryOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&o.KubernetesKeychain, "k8s-keychain", false,
 		"whether to use the kubernetes keychain instead of the default keychain (supports workload identity).")
 
+	cmd.Flags().StringVar(&o.AuthConfig.Username, "registry-username", "",
+		"registry basic auth username")
+
+	cmd.Flags().StringVar(&o.AuthConfig.Password, "registry-password", "",
+		"registry basic auth password")
+
+	cmd.Flags().StringVar(&o.AuthConfig.RegistryToken, "registry-token", "",
+		"registry bearer auth token")
+
 	o.RefOpts.AddFlags(cmd)
 }
 
@@ -113,6 +123,10 @@ func (o *RegistryOptions) GetRegistryClientOpts(ctx context.Context) []remote.Op
 			github.Keychain,
 		)
 		opts = append(opts, remote.WithAuthFromKeychain(kc))
+	case o.AuthConfig.Username != "" && o.AuthConfig.Password != "":
+		opts = append(opts, remote.WithAuth(&authn.Basic{Username: o.AuthConfig.Username, Password: o.AuthConfig.Password}))
+	case o.AuthConfig.RegistryToken != "":
+		opts = append(opts, remote.WithAuth(&authn.Bearer{Token: o.AuthConfig.RegistryToken}))
 	default:
 		opts = append(opts, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 	}

diff --git a/doc/cosign_attach_attestation.md b/doc/cosign_attach_attestation.md
diff --git a/doc/cosign_attach_sbom.md b/doc/cosign_attach_sbom.md
diff --git a/doc/cosign_attach_signature.md b/doc/cosign_attach_signature.md
diff --git a/doc/cosign_attest.md b/doc/cosign_attest.md
diff --git a/doc/cosign_clean.md b/doc/cosign_clean.md
diff --git a/doc/cosign_copy.md b/doc/cosign_copy.md
diff --git a/doc/cosign_dockerfile_verify.md b/doc/cosign_dockerfile_verify.md
diff --git a/doc/cosign_download_attestation.md b/doc/cosign_download_attestation.md
diff --git a/doc/cosign_download_sbom.md b/doc/cosign_download_sbom.md
diff --git a/doc/cosign_download_signature.md b/doc/cosign_download_signature.md
diff --git a/doc/cosign_generate.md b/doc/cosign_generate.md
diff --git a/doc/cosign_load.md b/doc/cosign_load.md
diff --git a/doc/cosign_manifest_verify.md b/doc/cosign_manifest_verify.md
diff --git a/doc/cosign_sign.md b/doc/cosign_sign.md
diff --git a/doc/cosign_tree.md b/doc/cosign_tree.md
diff --git a/doc/cosign_triangulate.md b/doc/cosign_triangulate.md