Add Authconfig commmand which generates the auth config

.github/workflows/ecr-auth.yaml

@@ -79,3 +79,46 @@ jobs:
         run: |
           # List the tags
           crane ls ${{ env.AWS_ACCOUNT }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/go-containerregistry-test
+
+  crane-authconfig-login:
+    runs-on: ubuntu-latest
+    env:
+      AWS_ACCOUNT: 479305788615
+      AWS_REGION: us-east-2
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v2
+        with:
+          go-version: 1.18
+          check-latest: true
+
+      - name: Install authconfig
+        working-directory: ./cmd/authconfig
+        run: go install .
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.6.1
+        with:
+          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT }}:role/federated-ecr-readonly
+          aws-region: ${{ env.AWS_REGION }}
+
+      - shell: bash
+        run: |
+          export REGISTRY_SERVER="${{ env.AWS_ACCOUNT }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com"
+          cat > $HOME/.docker/config.json <<EOF
+          {
+            "auths": {
+              "$REGISTRY_SERVER": $(authconfig --server $REGISTRY_SERVER)
+            }
+          }
+          EOF
+
+      - name: Install crane
+        working-directory: ./cmd/crane
+        run: go install .
+
+      - name: Test crane + ECR
+        run: |
+          # List the tags
+          crane ls ${{ env.AWS_ACCOUNT }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/go-containerregistry-test

cloudbuild.yaml

@@ -31,6 +31,10 @@ steps:
     cd ./cmd/krane
     ko publish --platform=all -B github.com/google/go-containerregistry/cmd/krane -t latest -t "$COMMIT_SHA" -t "$TAG_NAME"
     cd ../../
+    # ./cmd/authconfig is a separate module, so switch directories.
+    cd ./cmd/authconfig
+    ko publish --platform=all -B github.com/google/go-containerregistry/cmd/authconfig -t latest -t "$COMMIT_SHA" -t "$TAG_NAME"
+    cd ../../
 
     # Use the ko binary to build the crane-ish builder *debug* images.
     export KO_CONFIG_PATH=$(pwd)/.ko/debug/
@@ -40,6 +44,10 @@ steps:
     cd ./cmd/krane
     ko publish --platform=all -B github.com/google/go-containerregistry/cmd/krane -t "debug"
     cd ../../
+    # ./cmd/authconfig is a separate module, so switch directories.
+    cd ./cmd/authconfig
+    ko publish --platform=all -B github.com/google/go-containerregistry/cmd/authconfig -t "debug"
+    cd ../../
 
     # Tag-specific debug images are pushed to gcr.io/go-containerregistry/TOOL/debug:...
     KO_DOCKER_REPO=gcr.io/$PROJECT_ID/crane/debug  ko publish --platform=all --bare github.com/google/go-containerregistry/cmd/crane  -t latest -t "$COMMIT_SHA" -t "$TAG_NAME"
@@ -48,6 +56,11 @@ steps:
     cd ./cmd/krane
     KO_DOCKER_REPO=gcr.io/$PROJECT_ID/krane/debug ko publish --platform=all --bare github.com/google/go-containerregistry/cmd/krane -t latest -t "$COMMIT_SHA" -t "$TAG_NAME"
     cd ../../
+    # ./cmd/authconfig is a separate module, so switch directories.
+    export KO_CONFIG_PATH=$(pwd)/.ko/release/
+    cd ./cmd/authconfig
+    KO_DOCKER_REPO=gcr.io/$PROJECT_ID/authconfig/debug ko publish --platform=all --bare github.com/google/go-containerregistry/cmd/authconfig -t latest -t "$COMMIT_SHA" -t "$TAG_NAME"
+    cd ../../
 
 # Use the crane builder to get the digest for crane-ish.
 - name: gcr.io/$PROJECT_ID/crane
@@ -59,3 +72,5 @@ steps:
 - name: gcr.io/$PROJECT_ID/crane
   args: ['digest', 'gcr.io/$PROJECT_ID/krane']
 
+- name: gcr.io/$PROJECT_ID/crane
+  args: ['digest', 'gcr.io/$PROJECT_ID/authconfig']

cmd/authconfig/README.md

@@ -0,0 +1,19 @@
+# `authconfig`
+
+<img src="../../images/crane.png" width="40%">
+
+This tool generates the auth config which includes a credential for the given registry 
+server using the credential helpers provided by the cloud platforms (e.g., GKE, EKS, or AKS)
+Like [`krane`](../krane/README.md), this tool retrieves the credential by authenticating 
+with common "workload identity" mechanisms on such platforms.
+
+The following script provides the same functionality with `krane $REGISTRY_SERVER/$REPOSITORY/$IMAGE_NAME:$TAG`.
+```bash
+AUTH_CONFIG=$(authconfig --server $REGISTRY_SERVER)
+echo "{ \"auths\": {\"$REGISTRY_SERVER\":$AUTH_CONFIG}}" > docker_config.json
+DOCKER_CONFIG=docker_config.json crane $REGISTRY_SERVER/$REPOSITORY/$IMAGE_NAME:$TAG
+```
+
+Note that this tool can be utilized for avoiding the tight coupling between platform specific codes 
+- such as [ECR helper](https://github.com/awslabs/amazon-ecr-credential-helper) - and common 
+docker related codes.

cmd/authconfig/go.mod

@@ -0,0 +1,55 @@
+module github.com/google/go-containerregistry/cmd/authconfig
+
+go 1.17
+
+replace github.com/google/go-containerregistry => ../../
+
+require (
+	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220706184558-ce46abcd012b
+	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220327082430-c57b701bfc08
+	github.com/google/go-containerregistry v0.10.0
+)
+
+require (
+	cloud.google.com/go/compute v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go v46.4.0+incompatible // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.8 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.4 // indirect
+	github.com/Azure/go-autorest/autorest/azure/auth v0.5.2 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.1 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.0 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.16.7 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.15.13 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.8 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.14 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.17.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.13.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.11.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.16.9 // indirect
+	github.com/aws/smithy-go v1.12.0 // indirect
+	github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
+	github.com/dimchansky/utfbom v1.1.0 // indirect
+	github.com/docker/cli v20.10.17+incompatible // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
+	github.com/docker/docker v20.10.17+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.6.4 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/sirupsen/logrus v1.8.1 // indirect
+	golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 // indirect
+	golang.org/x/net v0.0.0-20220708220712-1185a9018129 // indirect
+	golang.org/x/oauth2 v0.0.0-20220630143837-2104d58473e0 // indirect
+	golang.org/x/sys v0.0.0-20220712014510-0a85c31ab51e // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
+)