Merge pull request #249 from crazy-max/upd-dockerfile

Dockerfile: merge build stages

.github/workflows/build.yml

@@ -15,7 +15,7 @@ on:
 
 env:
   DESTDIR: ./bin
-  GO_VERSION: 1.23.6
+  GO_VERSION: 1.24.7
 
 jobs:
   validate:
@@ -29,7 +29,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -46,17 +46,17 @@ jobs:
         os:
           - ubuntu-24.04
           - ubuntu-22.04
+          - macOS-15-intel
           - macOS-15
           - macOS-14
-          - macOS-13
           - windows-2022
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
       -
@@ -73,7 +73,7 @@ jobs:
       -
         name: GPG conf
         if: ${{ !startsWith(matrix.os, 'windows-') }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         id: gpg
         with:
           script: |
@@ -139,7 +139,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       -
@@ -173,7 +173,7 @@ jobs:
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda  # v2.2.1
+        uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836  # v2.3.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -185,7 +185,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       -

.golangci.yml

@@ -1,31 +1,23 @@
+version: "2"
 run:
-  timeout: 10m
   modules-download-mode: vendor
 
 linters:
+  default: none
   enable:
-    - gofmt
     - govet
-    - depguard
-    - goimports
     - ineffassign
     - misspell
-    - unused
     - revive
     - staticcheck
-    - typecheck
+    - unused
-  disable-all: true
+  settings:
-
+    revive:
-linters-settings:
-  depguard:
       rules:
-      main:
+        - name: package-comments  # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#package-comments
-        deny:
+          disabled: true
-          - pkg: "io/ioutil"
-            desc: The io/ioutil package has been deprecated. See https://go.dev/doc/go1.16#ioutil
 
-issues:
+formatters:
-  exclude-rules:
+  enable:
-    - linters:
+    - gofmt
-        - revive
+    - goimports
-      text: "stutters"

Dockerfile

@@ -1,11 +1,11 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23.6
+ARG GO_VERSION=1.24.7
 ARG DEBIAN_VERSION=bookworm
 
-ARG XX_VERSION=1.6.1
+ARG XX_VERSION=1.7.0
-ARG OSXCROSS_VERSION=11.3-r7-debian
+ARG OSXCROSS_VERSION=11.3-r8-debian
-ARG GOLANGCI_LINT_VERSION=v1.64.5
+ARG GOLANGCI_LINT_VERSION=v2.5
 ARG DEBIAN_FRONTEND=noninteractive
 
 ARG PACKAGE=github.com/docker/docker-credential-helpers
@@ -99,21 +99,7 @@ FROM gobase AS version
 RUN --mount=target=. \
     echo -n "$(./hack/git-meta version)" | tee /tmp/.version ; echo -n "$(./hack/git-meta revision)" | tee /tmp/.revision
 
-FROM base AS build-linux
+FROM base AS build
-ARG PACKAGE
-RUN --mount=type=bind,target=. \
-    --mount=type=cache,target=/root/.cache \
-    --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
-    --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
-  set -ex
-  xx-go --wrap
-  make build-pass build-secretservice PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
-  xx-verify /out/docker-credential-pass
-  xx-verify /out/docker-credential-secretservice
-EOT
-
-FROM base AS build-darwin
 ARG PACKAGE
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache \
@@ -124,28 +110,26 @@ RUN --mount=type=bind,target=. \
   set -ex
   export MACOSX_VERSION_MIN=$(make print-MACOSX_DEPLOYMENT_TARGET)
   xx-go --wrap
+  case "$(xx-info os)" in
+    linux)
+      make build-pass build-secretservice PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
+      xx-verify /out/docker-credential-pass
+      xx-verify /out/docker-credential-secretservice
+      ;;
+    darwin)
       go install std
       make build-osxkeychain build-pass PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
       xx-verify /out/docker-credential-osxkeychain
       xx-verify /out/docker-credential-pass
-EOT
+      ;;
-
+    windows)
-FROM base AS build-windows
-ARG PACKAGE
-RUN --mount=type=bind,target=. \
-    --mount=type=cache,target=/root/.cache \
-    --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
-    --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
-  set -ex
-  xx-go --wrap
       make build-wincred PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
       mv /out/docker-credential-wincred /out/docker-credential-wincred.exe
       xx-verify /out/docker-credential-wincred.exe
+      ;;
+  esac
 EOT
 
-FROM build-$TARGETOS AS build
-
 FROM scratch AS binaries
 COPY --from=build /out /
 

deb/Dockerfile

@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23.6
+ARG GO_VERSION=1.24.7
 ARG DISTRO=ubuntu
-ARG SUITE=focal
+ARG SUITE=jammy
 
-FROM golang:${GO_VERSION}-bullseye AS golang
+FROM golang:${GO_VERSION}-bookworm AS golang
 
 FROM ${DISTRO}:${SUITE}
 

osxkeychain/osxkeychain.go

@@ -46,6 +46,17 @@ func (h Osxkeychain) Add(creds *credentials.Credentials) error {
 	item.SetLabel(credentials.CredsLabel)
 	item.SetAccount(creds.Username)
 	item.SetData([]byte(creds.Secret))
+	// Prior to v0.9, the credential helper was searching for credentials with
+	// the "dflt" authentication type (see [1]). Since v0.9.0, Get doesn't use
+	// that attribute anymore, and v0.9.0 - v0.9.2 were not setting it here
+	// either.
+	//
+	// In order to keep compatibility with older versions, we need to store
+	// credentials with this attribute set. This way, credentials stored with
+	// newer versions can be retrieved by older versions.
+	//
+	// [1]: https://github.com/docker/docker-credential-helpers/blob/v0.8.2/osxkeychain/osxkeychain.c#L66
+	item.SetAuthenticationType("dflt")
 	if err := splitServer(creds.ServerURL, item); err != nil {
 		return err
 	}

pass/pass_test.go

@@ -83,10 +83,10 @@ func TestPassHelperList(t *testing.T) {
 		t.Error(err)
 	}
 	for server, username := range credsList {
-		if !(strings.HasSuffix(server, "2376/v1") || strings.HasSuffix(server, "2375/v1")) {
+		if !strings.HasSuffix(server, "2376/v1") && !strings.HasSuffix(server, "2375/v1") {
 			t.Errorf("invalid url: %s", server)
 		}
-		if !(username == "foo" || username == "bar") {
+		if username != "foo" && username != "bar" {
 			t.Errorf("invalid username: %v", username)
 		}