#Howto debug Publish() -- "invoke: input

1 messages · Page 1 of 1 (latest)

tepid cosmos
#

Can you please share your full code for the function and the full comand you're using to call it?

icy salmon
#

Yes

tepid cosmos
#

This is great, and how are you calling it?

icy salmon
#

Thanks:

dagger call publish --source=. --reg-user="robot$project+drone" --reg-token="secret"

#

It's a private repo so i have to hide all "private" stuff 🙂

tepid cosmos
#

Yeah for sure

One thing to note it looks like youre using string for regToken but you should be using dagger.Secret to make sure you dont accidentally leak your token

icy salmon
#

The goal is to self host CI+CD 🙂

With k3s+rancher,gitea,harbor,argocd,drone

#

There's a secret:

pubCt = pubCt.WithRegistryAuth(reg, regUser, dagger.Connect().SetSecret("registry-token", regToken))```
tepid cosmos
#

Its strange that the sha is 2332, is that just some dummy value or is the sha not being calculated correctly here?

registry.example.com/project/container:2332

sha, err := m.GitRev(ctx, source) if err != nil { return "", err }

#

Yes, but regToken should also be a type Secret

#

This way you dont need to SetSecret and the token will not be stored in the cache or anything like that

icy salmon
#

dummy value 🙂

tepid cosmos
#

Right now you're unintentionally leaking the secret when you call this function

icy salmon
#

ahh regToken the value, hmm I don't have "defaultSecret:" yet?

#

argument

tepid cosmos
#

But that is not the core issue, it seems the core issue is that your docker registry url is not correct it should be

my.registry.address:port/repositoryname:tag

where :port and :tag are optional

I think the /project is causing an issue

#

If your intent is to publish this to a private registry there is no way to have a default secret, so it must be passed in, I would not recommend hard coding a default token as a string because this leaks your credential which is not a recommended practice

I would use the value like this:

func (m *Backend) Publish(
    ctx context.Context,
    source *dagger.Directory,
    // Registry to use.
    // +default="registry.example.com"
    reg string,
    // +default="registry.example.com/project/backend"
    regImage string,
    // Registry API User
    // +default=""
    regUser string,
    // Registry API Token
    regToken dagger.Secret,
) (string, error) {

then

        pubCt = pubCt.WithRegistryAuth(reg, regUser, regToken)

lastly store the token as an env var and pass it like this

dagger call publish --source=. --reg-user="robot$project+drone" --reg-token=env:REGISTRY_TOKEN

here's some more info on secrets: https://docs.dagger.io/manuals/developer/secrets/

--

The way you are doing it works but your token is going to be sprinkled throughout the logs in plain text and be stored in the cache. This is not a recommended security practice.

Secrets | Dagger

Dagger allows you to utilize confidential information, such as passwords, API keys, SSH keys and so on, in your Dagger Modules and Dagger Functions, without exposing those secrets in plaintext logs, writing them into the filesystem of containers you're building, or inserting them into the cache.

icy salmon
#

ok, will change that

#

That's why I want a +defaultSecret="" 🙂

tepid cosmos
#

Yeah, that would be a great improvement but it doesn't exist yet.

I am curious how would you imagine adding this value in?

icy salmon
#

with --reg-token=env:REGISTRY_TOKEN

#

there's a +defaultPath="" i wan't defaultSecret like defaultPath 🙂

tepid cosmos
#

So the default would look in the environment, that makes sense, its important to note that right now dagger modules are designed to be secured in a sandbox that knows nothing about the host environment

things need to be passed in explicitly. We're working on opening up that sandbox where it makes sense, but its not so simple to find the right balance between convenience and security

icy salmon
tepid cosmos
#

No, I mean if defaultSecret existed, what would you put in as the default value?

icy salmon
#

ohh empty 🙂

#

Now that we have seen, no need for taht...... 🙂

tepid cosmos
#

Oh sorry I might be confused, what is the purpose of an empty default in your mind?

icy salmon
#

<-- dumpass 🙂

tepid cosmos
#

No way haha

icy salmon
#

having a *dagger.Secret as regToken requires now to put that secret as env, for cli usage there's no requirement to write env:SOME_ENV

#

else it gives env var "s3c5e$" not found

icy salmon
tepid cosmos
icy salmon
#

yes

#

my harbor is private, that project is private.

tepid cosmos
icy salmon
#

I believe I have something wrong with the token

#

Sadly not the password

icy salmon
#

Thanks @tepid cosmos I had 2 mistakes:

1.) GetEnv() function was returning an additional "\n" that got into the image string.
2.) My username had a "$" which wasn't shell escaped.

Fixed. Thanks 🙂

#

I'll publish the whole Pipeline once done with a little explanation on howto selfhost CI+CD with Dagger and other open source software.

tepid cosmos
#

That is awesome! cc @thin echo

thin echo