#Are environment variables expanded within WithExec() commands (could be an apko issue)?

1 messages · Page 1 of 1 (latest)

idle gust
#

I have failed to get my apko Dagger module to successfully publish to ghcr.io. I have created a PAT token for experimenting, and I can successfully log into ghcr.io and publish using apko directly.

However, I always get an authentication failure when I run this within my Dagger module.

Code snippet:

ctr := dag.Container().From("cgr.dev/chainguard/apko")

if registry != "" && username != "" && password != nil {
    ctr = ctr.WithSecretVariable("REGISTRY_TOKEN", password).
        WithExec([]string{"login", registry, "-u", username, "-p", "$REGISTRY_TOKEN"})
    }

return ctr.
    WithWorkdir("apko").
    WithFile("apko.yaml", a.Cfg).
    WithExec(cmd).
    Stdout(ctx)

ℹ️            | publishing index tag ghcr.io/purpleclay/dagger-cli:0.10.3
Error: publishing image index: failed to publish: PUT https://ghcr.io/v2/purpleclay/dagger-cli/manifests/0.10.3: UNAUTHORIZED: unauthenticated: User cannot be authenticated with the token provided.

I currently pass in the registry details as parameters, with the password being a secret:

dagger call -m github.com/purpleclay/daggerverse/apko@v0.3.0 load --cfg apko.yaml publish --ref "ghcr.io/purpleclay/dagger-cli:0.10.3" --registry ghcr.io --username purpleclay --password env:GHCR_TOKEN

The issue appears with the WithExec command not picking up the environment variable. It feels like it is using the string $REGISTRY_TOKEN as a Raw value. Should I be wrapping this up as a script?

#

I tried using WithRegistryAuth but that makes no difference with apko.

fossil plinth
#

If you want to have expansion, you need to use sh

#

something like []string{"sh", "-c", "command goes here"}

#

but also, you should avoid having secrets used like that - ideally they should just be passed as env vars

idle gust
#

I'll try a few things. I am leaning towards injecting the secret as a file and then piping it into STDIN. Looking at the apko login command, it has the following flag --password-stdin

idle gust
#

In the end, I got it to work like this:

ctr = ctr.WithEnvVariable("REGISTRY", registry).
  WithEnvVariable("REGISTRY_USER", username).
  WithSecretVariable("REGISTRY_PASSWORD", password).
  WithExec([]string{"sh", "-c", "apko login $REGISTRY -u $REGISTRY_USER -p $REGISTRY_PASSWORD"})
#

Thanks for the advice @fossil plinth

rocky warren
#

@idle gust are you developing your own apko module from scratch, or starting from an existing one?