Merge pull request #228 from thaJeztah/carry_openbsd_secretservice

secretservice: allow building on openbsd

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
     labels:
       - "dependencies"
       - "bot"

.github/workflows/build.yml

@@ -1,18 +1,12 @@
 name: build
 
-# Default to 'contents: read', which grants actions to read commits.
-#
-# If any permission is set, any permission not included in the list is
-# implicitly set to "none".
-#
-# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -24,7 +18,7 @@ on:
 
 env:
   DESTDIR: ./bin
-  GO_VERSION: 1.25.8
+  GO_VERSION: 1.25.9
 
 jobs:
   validate:
@@ -39,10 +33,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       -
         name: Run
         run: |
@@ -64,10 +58,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
       -
@@ -84,7 +78,7 @@ jobs:
       -
         name: GPG conf
         if: ${{ !startsWith(matrix.os, 'windows-') }}
-        uses: actions/github-script@v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: gpg
         with:
           script: |
@@ -101,7 +95,7 @@ jobs:
       -
         name: Import GPG key
         if: ${{ !startsWith(matrix.os, 'windows-') }}
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
           gpg_private_key: ${{ steps.gpg.outputs.key }}
           passphrase: ${{ steps.gpg.outputs.passphrase }}
@@ -119,7 +113,7 @@ jobs:
         shell: bash
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           files: ${{ env.DESTDIR }}/coverage.txt
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -130,10 +124,10 @@ jobs:
     steps:
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       -
         name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           targets: test
           set: |
@@ -141,7 +135,7 @@ jobs:
             *.cache-to=type=gha,scope=test,mode=max
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           files: ${{ env.DESTDIR }}//coverage.txt
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -155,15 +149,15 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       -
         name: Build
         run: |
@@ -181,7 +175,7 @@ jobs:
           find ${{ env.DESTDIR }} -type f -exec file -e ascii -e text -- {} +
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docker-credential-helpers
           path: ${{ env.DESTDIR }}/*
@@ -189,7 +183,7 @@ jobs:
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -202,7 +196,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       -

.github/workflows/zizmor.yml

@@ -0,0 +1,28 @@
+name: zizmor
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'main'
+    tags:
+      - 'v*'
+  pull_request:
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@d89fe92d808a15e2b2ed5cdb62db7c172c31410d # v1.6.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      min-severity: medium
+      min-confidence: medium
+      persona: pedantic

Dockerfile

@@ -1,12 +1,28 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.25.8
+# GO_VERSION sets the version of the golang base image to use.
-ARG DEBIAN_VERSION=bookworm
+# It must be a valid tag in the docker.io/library/golang image repository.
+ARG GO_VERSION=1.25.9
 
-ARG XX_VERSION=1.7.0
+# BASE_DEBIAN_DISTRO sets the golang base image debian variant to use.
+# It must be a valid variant in the docker.io/library/golang image repository.
+ARG BASE_DEBIAN_DISTRO=bookworm
+
+# XX_VERSION sets the version of the xx utility to use.
+# It must be a valid tag in the docker.io/tonistiigi/xx image repository.
+ARG XX_VERSION=1.9.0
+
+# OSXCROSS_VERSION sets the MacOSX cross toolchain to use.
+# It must be a valid tag in the docker.io/crazymax/osxcross image repository.
 ARG OSXCROSS_VERSION=11.3-r8-debian
-ARG GOLANGCI_LINT_VERSION=v2.8
 
+# GOLANGCI_LINT_VERSION sets the version of the golangci-lint image to use.
+# It must be a valid tag in the docker.io/golangci/golangci-lint image repository.
+ARG GOLANGCI_LINT_VERSION=v2.11
+
+# PACKAGE sets the package name to print in the "--version" output.
+# It sets the "github.com/docker/docker-credential-helpers/credentials.Package
+# variable at compile time.
 ARG PACKAGE=github.com/docker/docker-credential-helpers
 
 # xx is a helper for cross-compilation
@@ -15,7 +31,7 @@ FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 # osxcross contains the MacOSX cross toolchain for xx
 FROM crazymax/osxcross:${OSXCROSS_VERSION} AS osxcross
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-${DEBIAN_VERSION} AS gobase
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO} AS gobase
 COPY --from=xx / /
 RUN apt-get update && apt-get install -y --no-install-recommends clang dpkg-dev file git lld llvm make pkg-config rsync
 ENV GOFLAGS="-mod=vendor"

deb/Dockerfile

@@ -1,10 +1,17 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.25.8
+# GO_VERSION sets the version of the golang base image to use.
+# It must be a valid tag in the docker.io/library/golang image repository.
+ARG GO_VERSION=1.25.9
+
+# BASE_DEBIAN_DISTRO sets the golang base image debian variant to use.
+# It must be a valid variant in the docker.io/library/golang image repository.
+ARG BASE_DEBIAN_DISTRO=bookworm
+
 ARG DISTRO=ubuntu
 ARG SUITE=jammy
 
-FROM golang:${GO_VERSION}-bookworm AS golang
+FROM golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO} AS gobase
 
 FROM ${DISTRO}:${SUITE}
 RUN apt-get update && apt-get install -yy debhelper dh-make libsecret-1-dev
@@ -15,7 +22,7 @@ ENV GOPROXY=https://proxy.golang.org|direct
 ENV GO111MODULE=off
 ENV GOPATH=/build
 ENV PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
-COPY --from=golang /usr/local/go /usr/local/go
+COPY --from=gobase /usr/local/go /usr/local/go
 
 COPY Makefile .
 COPY credentials credentials

secretservice/secretservice.go

@@ -1,4 +1,4 @@
-//go:build linux && cgo
+//go:build (linux || openbsd) && cgo
 
 package secretservice
 

secretservice/secretservice_test.go

@@ -1,4 +1,4 @@
-//go:build linux && cgo
+//go:build (linux || openbsd) && cgo
 
 package secretservice
 

wincred/wincred.go

@@ -5,7 +5,6 @@ package wincred
 import (
 	"bytes"
 	"net/url"
-	"strings"
 
 	winc "github.com/danieljoos/wincred"
 	"github.com/docker/docker-credential-helpers/credentials"
@@ -54,9 +53,7 @@ func (h Wincred) Get(serverURL string) (string, string, error) {
 	}
 
 	for _, attr := range g.Attributes {
-		if strings.Compare(attr.Keyword, "label") == 0 &&
+		if attr.Keyword == "label" && bytes.Equal(attr.Value, []byte(credentials.CredsLabel)) {
-			bytes.Compare(attr.Value, []byte(credentials.CredsLabel)) == 0 {
-
 			return g.UserName, string(g.CredentialBlob), nil
 		}
 	}
@@ -75,11 +72,10 @@ func getTarget(serverURL string) (string, error) {
 	}
 
 	var targets []string
-	for i := range creds {
+	for _, cred := range creds {
-		attrs := creds[i].Attributes
+		for _, attr := range cred.Attributes {
-		for _, attr := range attrs {
 			if attr.Keyword == "label" && bytes.Equal(attr.Value, []byte(credentials.CredsLabel)) {
-				targets = append(targets, creds[i].TargetName)
+				targets = append(targets, cred.TargetName)
 			}
 		}
 	}
@@ -136,16 +132,14 @@ func (h Wincred) List() (map[string]string, error) {
 	}
 
 	resp := make(map[string]string)
-	for i := range creds {
-		attrs := creds[i].Attributes
-		for _, attr := range attrs {
-			if strings.Compare(attr.Keyword, "label") == 0 &&
-				bytes.Compare(attr.Value, []byte(credentials.CredsLabel)) == 0 {
 
-				resp[creds[i].TargetName] = creds[i].UserName
+	for _, cred := range creds {
+		for _, attr := range cred.Attributes {
+			if attr.Keyword == "label" && bytes.Equal(attr.Value, []byte(credentials.CredsLabel)) {
+				resp[cred.TargetName] = cred.UserName
+				break
 			}
 		}
-
 	}
 
 	return resp, nil