search

cnabio / signy

Go implementation for CNAB content trust verification using TUF, Notary, and in-toto
MIT License
31 stars 11 forks source link

Skip login for notary.docker.io if logged into index.docker.io #66

Closed radu-matei closed 4 years ago

radu-matei commented 4 years ago

You currently have to login to both index.docker.io and notary.docker.io when using Docker Hub and Notary, even if technically they share the same authentication.

Users should only login once if the registry comes with a default trust server, and the registry and trust server share authentication.

radu-matei commented 4 years ago

Tracked down the issue"

https://github.com/cnabio/signy/blob/7f6e308a9ede2e86a629ac5c2c8bb603f3d39e74/pkg/tuf/helpers.go#L242-L247

Essentially, we're comparing a complete URL (https://notary.docker.io) to a hostname (docker.notary.io), so this check never succeeds.