Skip to content

Enable user and password update - #149

Merged
alicefr merged 3 commits into
bootc-dev:mainfrom
alicefr:update-password
Oct 13, 2026
Merged

alicefr merged 3 commits into
bootc-dev:mainfrom
alicefr:update-password

Conversation

@alicefr

@alicefr alicefr commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator

Add a new command to the registry update-credentials to update the user and password authentication for the registry.

Fixes: #148

}

cmd.Flags().StringVar(&registryUser, "registry-user", "", "Username for the authenticated registry")
cmd.Flags().StringVar(&registryPassword, "registry-password", "", "Password for the authenticated registry")

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will show the password in the terminal right? We should probably use a hidden field for passwords

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True, but it is an issue we already have in the setting of the password which we should fix

Comment thread internal/registry/registry.go Outdated

escaped := strings.ReplaceAll(htpasswdEntry, "'", "'\\''")
_, err = m.podman.ContainerExec(ctx, config.AuthRegistryContainerName, []string{
"/bin/sh", "-c", fmt.Sprintf("printf '%%s\\n' '%s' > /auth/htpasswd", escaped),

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can use backticks in Sprintf which should also help with escaping quotes

Comment thread internal/registry/registry.go Outdated

escaped := strings.ReplaceAll(htpasswdEntry, "'", "'\\''")
_, err = m.podman.ContainerExec(ctx, config.AuthRegistryContainerName, []string{
"/bin/sh", "-c", fmt.Sprintf("printf '%%s\\n' '%s' > /auth/htpasswd", escaped),

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

when restart the container entrypoint re-executes this leading to file being overwritten with initial credentials

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
Allow updating auth registry credentials by recreating
the container with new credentials.

We need to stop and recreate the container in order to update the
AUTH_HTPASSWD env variable. Otherwise, the password will be overwritten
at container restart.

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
Extend the auth registry integration test to verify credential
rotation with both user and password change, and add a
CreateAuthPod helper to reduce duplication.

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
@alicefr
alicefr merged commit be7df01 into bootc-dev:main Oct 13, 2026
13 of 14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Enable password update for the registry authentication

3 participants