Add note about ghcr.io for HOMEBREW_DOCKER_REGISTRY_TOKEN #16794

azatoth · 2024-03-02T17:01:06Z

It's not clear that when using HOMEBREW_DOCKER_REGISTRY_TOKEN directly against ghcr.io that you should use your PAT base64-encoded as the bearer token.

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same change?
Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes? Here's an example.
Have you successfully run brew style with your changes locally?
Have you successfully run brew typecheck with your changes locally?
Have you successfully run brew tests with your changes locally?

MikeMcQuaid

Thanks @azatoth! Definitely think this needs changing, just let's riff off exactly what to.

MikeMcQuaid · 2024-03-04T09:20:36Z

Library/Homebrew/env_config.rb

+ Use this bearer token for authenticating with a Docker registry proxying GitHub Packages.
+ Preferred over `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN`.
+
+ *Note:* when authenticating against ghcr.io, \
+ the `HOMEBREW_DOCKER_REGISTRY_TOKEN` must be a base64 \
+ encoded GitHub Personal Access Token (PAT).


Not convinced this description makes that much sense after this? If you're "authenticating against ghcr.io" is this "a Docker registry proxying GitHub Packages"? It doesn't sound like it. Maybe the whole description needs a bigger overhaul?

Yea, this is related to the underlying issue I had, trying to access a private tap hosted on a private GitHub repo. And while optimally, there should be a way to be able to assign different tokens for different taps, at the moment this environment variable is the only way to address brew to authenticate again ghcr.io.

I wonder if this should default to HOMEBREW_GITHUB_API_TOKEN and/or read from the repository URL like #16649. Avoiding the user from having to manually run base64 seems ideal.

should default to HOMEBREW_GITHUB_API_TOKEN

While it's highly possibly it's the same token, conceptually it's wrong as the docker registry doesn't have anything to do with the API and vice versa. Wouldn't defaulting to HOMEBREW_GITHUB_PACKAGES_TOKEN be more logical (which in itself then might need to be promoted out from development towards more general use)?

and/or read from the repository URL

I assume it makes sense to allow it to read from the URL, even though having the token in the URL isn't something I personally would ever do.

Wouldn't defaulting to HOMEBREW_GITHUB_PACKAGES_TOKEN be more logical (which in itself then might need to be promoted out from development towards more general use)?

Yup, this would make sense!

default to HOMEBREW_GITHUB_API_TOKEN

Don't you mean HOMEBREW_GITHUB_PACKAGES_TOKEN?

No, that's another option we could use but if HOMEBREW_GITHUB_API_TOKEN is setup correctly we should be able to Base64 it and use it accordingly.

No, that's another option we could use but if HOMEBREW_GITHUB_API_TOKEN is setup correctly we should be able to Base64 it and use it accordingly.

I think I'm a bit confused, I thought the API token was for accessing the API and PACKAGES token to access packages in the event you would want to have different tokes with limited permissions in each

HOMEBREW_GITHUB_PACKAGES_TOKEN is currently only used for uploading packages.

default to HOMEBREW_GITHUB_API_TOKEN and do the Base64 internally inside of Homebrew

I decided to try this route;
I did rebase against master, but I don't know what your policy for PRs actually is in this regard.

Library/Homebrew/env_config.rb

Bo98 · 2024-03-05T04:11:36Z

(Prior discussion for context: https://github.com/orgs/Homebrew/discussions/5171)

MikeMcQuaid

Would like to see comments addressed or further discussion, thanks!

github-actions · 2024-04-09T00:11:59Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

azatoth · 2024-04-09T12:34:24Z

Would like to see comments addressed or further discussion, thanks!

I might have misunderstood you, but I thought I had addressed your comments, and I don't know what more I can say to further the issue.

It's not clear that when using HOMEBREW_DOCKER_REGISTRY_TOKEN directly against ghcr.io that you should use your PAT base64-encoded as the bearer token.

And adjusting the documentation to match

MikeMcQuaid

Great work @azatoth, almost done here!

MikeMcQuaid · 2024-04-10T12:28:15Z

Library/Homebrew/env_config.rb

+ description: <<~EOS,
+ Use this bearer token for authenticating with a Docker registry proxying GitHub Packages.
+ Preferred over `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN`.
+ EOS


Please put this all on one line again, thanks.

MikeMcQuaid · 2024-04-10T12:29:19Z

Library/Homebrew/env_config.rb

+ Use this bearer token for authenticating with a Docker registry proxying GitHub Packages.
+ Preferred over `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN`.
+ EOS
+ default_text: "`QQ==` unless `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN` is set.",


Suggested change

default_text: "`QQ==` unless `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN` is set.",

default_text: "`HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN` if set or `QQ==` otherwise.",

MikeMcQuaid · 2024-04-10T12:29:34Z

Library/Homebrew/env_config.rb

- "<https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api>" \
- "\n\n *Note:* Homebrew doesn't require permissions for any of the scopes, but some " \
- "developer commands may require additional permissions.",
+ description: <<~EOS,


Please put this all one one line too.

MikeMcQuaid · 2024-04-10T12:30:17Z

Library/Homebrew/env_config.rb

+ *Note:* If set, this token will also be used to authenticating against `ghcr.io` unless
+ `HOMEBREW_DOCKER_REGISTRY_TOKEN` or `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN` has been set.
+ In this case, the token will require the `packages` permission to be set.
+ `HOMEBREW_GITHUB_PACKAGES_TOKEN` is not used for this permission, but only for uploading packages.


Suggested change

`HOMEBREW_GITHUB_PACKAGES_TOKEN` is not used for this permission, but only for uploading packages.

Remove this and move to the HOMEBREW_GITHUB_PACKAGES_TOKEN description (if there is one).

MikeMcQuaid · 2024-04-10T12:30:23Z

Library/Homebrew/env_config.rb

+ *Note:* Homebrew doesn't require permissions for any of the scopes,
+ but some developer commands may require additional permissions.
+
+ *Note:* If set, this token will also be used to authenticating against `ghcr.io` unless


Love this, great work!

EricFromCanada · 2024-04-15T13:32:08Z

Library/Homebrew/env_config.rb

+ Use this personal access token for the GitHub API, for features such as `brew search`.
+ You can create one at <https://github.com/settings/tokens>.
+ If set, GitHub will allow you a greater number of API requests.
+ For more information, see: "<https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api>"


Suggested change

For more information, see: "<https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api>"

For more information, see: <https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api>

MikeMcQuaid reviewed Mar 4, 2024

View reviewed changes

azatoth requested a review from MikeMcQuaid March 4, 2024 10:19

MikeMcQuaid reviewed Mar 5, 2024

View reviewed changes

github-actions bot added the stale No recent activity label Apr 9, 2024

azatoth added 3 commits April 10, 2024 12:08

Add note about ghcr.io for HOMEBREW_DOCKER_REGISTRY_TOKEN

e154acc

It's not clear that when using HOMEBREW_DOCKER_REGISTRY_TOKEN directly against ghcr.io that you should use your PAT base64-encoded as the bearer token.

Rename EOF to EOS

0127d84

Rewrite so that brew automatically base64 encode the API token

55e9913

And adjusting the documentation to match

azatoth force-pushed the docker-registry-token-documentation branch from 76301fa to 55e9913 Compare April 10, 2024 10:09

MikeMcQuaid reviewed Apr 10, 2024

View reviewed changes

EricFromCanada reviewed Apr 15, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add note about ghcr.io for HOMEBREW_DOCKER_REGISTRY_TOKEN #16794

Add note about ghcr.io for HOMEBREW_DOCKER_REGISTRY_TOKEN #16794

azatoth commented Mar 2, 2024

MikeMcQuaid left a comment

MikeMcQuaid Mar 4, 2024

azatoth Mar 4, 2024

MikeMcQuaid Mar 4, 2024

azatoth Mar 4, 2024

MikeMcQuaid Mar 4, 2024

azatoth Apr 9, 2024

MikeMcQuaid Apr 9, 2024

azatoth Apr 9, 2024

MikeMcQuaid Apr 9, 2024

azatoth Apr 10, 2024

Bo98 commented Mar 5, 2024

MikeMcQuaid left a comment

github-actions bot commented Apr 9, 2024

azatoth commented Apr 9, 2024

MikeMcQuaid left a comment

MikeMcQuaid Apr 10, 2024

MikeMcQuaid Apr 10, 2024

MikeMcQuaid Apr 10, 2024

MikeMcQuaid Apr 10, 2024

MikeMcQuaid Apr 10, 2024

EricFromCanada Apr 15, 2024

	default_text: "`QQ==` unless `HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN` is set.",
	default_text: "`HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN` if set or `QQ==` otherwise.",

	For more information, see: "<https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api>"
	For more information, see: <https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api>

Add note about ghcr.io for HOMEBREW_DOCKER_REGISTRY_TOKEN #16794

Are you sure you want to change the base?

Add note about ghcr.io for HOMEBREW_DOCKER_REGISTRY_TOKEN #16794

Conversation

azatoth commented Mar 2, 2024

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Bo98 commented Mar 5, 2024

MikeMcQuaid left a comment

Choose a reason for hiding this comment

github-actions bot commented Apr 9, 2024

azatoth commented Apr 9, 2024

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment