mirrors/at-container-registry
1
0
Fork 0
mirror of https://tangled.org/evan.jarrett.net/at-container-registry synced 2026-08-31 05:07:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix build pipeline. fix using wrong auth method when trying to push with app-password

Browse Source
This commit is contained in:
Evan Jarrett
2025-12-09 11:51:42 -06:00
parent 5dff759064
commit 02fabc4a41
2 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.tangled/workflows/release.yml
+6 -6
View File
@@ -24,21 +24,21 @@ steps:
- name: Build and push AppView image
command: |
buildah bud \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:${TANGLED_REF_NAME} \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:${TANGLED_REF_NAME} \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest \
--file ./Dockerfile.appview \
.
buildah push \
${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest
${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest
- name: Build and push Hold image
command: |
buildah bud \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:${TANGLED_REF_NAME} \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:${TANGLED_REF_NAME} \
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest \
--file ./Dockerfile.hold \
.
buildah push \
${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest
${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest
pkg/appview/middleware/registry.go
+20 -10
View File
@@ -404,24 +404,34 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name
}
// Get access token for PDS operations
// Try OAuth refresher first (for users who authorized via AppView OAuth)
// Fall back to Basic Auth token cache (for users who used app passwords)
// Use auth method from JWT to determine client type:
// - OAuth users: use session provider (DPoP-enabled)
// - App-password users: use Basic Auth token cache
var atprotoClient *atproto.Client
if nr.refresher != nil {
// Use session provider for locked OAuth sessions
if authMethod == token.AuthMethodOAuth && nr.refresher != nil {
// OAuth flow: use session provider for locked OAuth sessions
// This prevents DPoP nonce race conditions during concurrent layer uploads
slog.Debug("Creating ATProto client with OAuth session provider",
"component", "registry/middleware",
"did", did,
"authMethod", authMethod)
atprotoClient = atproto.NewClientWithSessionProvider(pdsEndpoint, did, nr.refresher)
}
// Fall back to Basic Auth token cache if OAuth not available
if atprotoClient == nil {
} else {
// App-password flow (or fallback): use Basic Auth token cache
accessToken, ok := auth.GetGlobalTokenCache().Get(did)
if !ok {
slog.Debug("No cached access token found (neither OAuth nor Basic Auth)", "component", "registry/middleware", "did", did)
slog.Debug("No cached access token found for app-password auth",
"component", "registry/middleware",
"did", did,
"authMethod", authMethod)
accessToken = "" // Will fail on manifest push, but let it try
} else {
slog.Debug("Using Basic Auth access token", "component", "registry/middleware", "did", did, "token_length", len(accessToken))
slog.Debug("Creating ATProto client with app-password",
"component", "registry/middleware",
"did", did,
"authMethod", authMethod,
"token_length", len(accessToken))
}
atprotoClient = atproto.NewClient(pdsEndpoint, did, accessToken)
}