Closed haoliangyu closed 6 months ago
I figure out that the notation login
is not necessary if the docker login
is already done. So the authentication issue is addressed, though I am still not clear on why notation login
will throw a credentials store error in this case.
Thanks @haoliangyu for reporting this issue. As you figured out, notation login
was not necessary if users authenticated with docker login
. notation login
requires a credential store to save the credentials securely. However, if there is no credential store installed, docker login
can save the password with base64 encoding in config file. See https://docs.docker.com/engine/reference/commandline/login/#default-behavior. notation login
does not support this behavior as it is not secure. We recommend using credential store to manage your credentials securely. I will review the notation authentication related document to see any improvements on authentication.
I am trying to use the
setup
action to install Notation CLI in a workflow to sing images in ECR. The workflow would look like thisI am trying to use the Notation CLI directly in bash, instead of using the
sing
action, to sign images because our actual push-and-sign logic is a bit complex. However, when it tries to run thenotation login
command, it fails with the messageNote that the
docker login
does succeed and I can verify that the docker configuration exists at~/.docker/config.json
. According to the notation documentation, it should resolve either the notation configuration or docker configuration. But it does not.I am not sure if it is a problem with the action or the Notation CLI itself. If this is not the appropriate place to ask, this issue can be moved.