Add Docker Auth Wrapper to check for auth entries for all Docker Hub domains

Author: jcarter3

internal/ocidocker/dockerhub.go

@@ -1,9 +1,22 @@
 package ocidocker
 
-var DockerHubHosts = map[string]struct{}{
-	"":                        {},
-	"docker.io":               {},
-	"index.docker.io":         {},
-	"registry-1.docker.io":    {},
-	"registry.hub.docker.com": {},
-}
+import (
+	"sync"
+)
+
+var (
+	DockerHubHosts = map[string]byte{
+		"index.docker.io":         0,
+		"registry-1.docker.io":    1,
+		"docker.io":               2,
+		"registry.hub.docker.com": 3,
+		"":                        4,
+	}
+	DockerHubHostsSorted = sync.OnceValue(func() []string {
+		sorted := make([]string, len(DockerHubHosts))
+		for host, rank := range DockerHubHosts {
+			sorted[rank] = host
+		}
+		return sorted
+	})
+)

internal/ocidocker/dockerhub_test.go

@@ -0,0 +1,12 @@
+package ocidocker
+
+import "testing"
+
+func TestHostsSorted(t *testing.T) {
+	sorted := DockerHubHostsSorted()
+	for i, host := range sorted {
+		if i != int(DockerHubHosts[host]) {
+			t.Errorf("host %s not sorted", host)
+		}
+	}
+}

ociauth/auth.go

@@ -293,7 +293,7 @@ func (r *registry) setAuthorizationFromChallenge(ctx context.Context, req *http.
 // the outer context is cancelled, but we'll ignore that. We probably shouldn't.
 func (r *registry) init() error {
 	inner := func() error {
-		info, err := r.config.EntryForRegistry(r.host)
+		info, err := dockerWrapper{r.config}.EntryForRegistry(r.host)
 		if err != nil {
 			return fmt.Errorf("cannot acquire auth info for registry %q: %v", r.host, err)
 		}

ociauth/docker.go

@@ -0,0 +1,31 @@
+package ociauth
+
+import (
+	"github.com/docker/oci/internal/ocidocker"
+)
+
+// DockerWrapper is an ociauth.Config implementation that wraps an underlying ociauth.Config in order to check
+// credentials for every Docker Hub domain when credentials for any Hub domain are requested.
+type dockerWrapper struct {
+	Config
+}
+
+// EntryForRegistry returns credentials for a given host.
+func (w dockerWrapper) EntryForRegistry(host string) (ConfigEntry, error) {
+	var zero ConfigEntry // "EntryForRegistry" doesn't return an error on a miss - it just returns an empty object (so we create this to have something to trivially compare against for our fallback)
+	if entry, err := w.Config.EntryForRegistry(host); err == nil && entry != zero {
+		return entry, err
+	} else if _, ok := ocidocker.DockerHubHosts[host]; ok {
+		for _, dockerHubHost := range ocidocker.DockerHubHostsSorted() {
+			if dockerHubHost == "" {
+				continue
+			}
+			if entry, err = w.Config.EntryForRegistry(dockerHubHost); err == nil && entry != zero {
+				return entry, err
+			}
+		}
+		return entry, err
+	} else {
+		return entry, err
+	}
+}