[sync feature] multiple credentials for github packages registry

[loicalbertin]

Hi 👋 !

I want to use Zot to mirror images stored in github packages registry.
These images are private and published in different organizations that do not allow me to use the same access token.

How could I configure Zot to use different access token for github packages registry?

For now my config is:

{
    "extensions": {
        "sync": {
            "enable": true,
            "credentialsFile": "/secret/regpasswd.json",
            "registries": [
                {
                    "urls": [
                        "https://ghcr.io"
                    ],
                    "content": [
                        {
                            "prefix": "**",
                            "destination": "/gh-images"
                        }
                    ],
                    "onDemand": true,
                    "tlsVerify": true
                }
            ]
        }
    }
}

and regpasswd.json:

{
    "ghcr.io": {
        "username": "uname on Organization 1",
        "password": "Personal Access Token for Organization 1"
    }
}

and I don't see how to specify different access tokens for ghcr.io.

🙇‍♂️

[rchincha]

@loicalbertin thanks for trying out zot and the feedback.

cc: @peusebiu

We will need a selector into regpasswd.json to pick the right creds regardless.
So content prefix along with the registry url could be that I suppose.
So regpasswd.json would become:

{
    "ghcr.io": {
       "/organization1": {
           "username": "uname on Organization 1",
           "password": "Personal Access Token for Organization 1"
       },
       "/organization2": {
           "username": "uname on Organization 2",
           "password": "Personal Access Token for Organization 2"
      },
   }
   ...
}

etc?

[loicalbertin]

Hi @rchincha,

Could you just confirm that your above snippet is an improvement proposal that does not work currently? (Otherwise I failed to make it work 😊)

If this is a proposal, it seems good to me and should solve my issue.
Just a remark, it may be interesting to implement a longest prefix matching to implement more complex use cases like:

{
    "ghcr.io": {
       "/organization1/": {
            // Matches all images under organization1
       },
       "/organization2/img": {
           // Matches only "img" for organization2
      },
      "/": {
           // Matches anything else in "ghcr.io"
       },
   }
   ...
}

What do you think?

[rchincha]

Yes, this is just a proposal.

Another option with possibly much higher overhead is to create a zot instance per upstream path.

[loicalbertin]

Another option with possibly much higher overhead is to create a zot instance per upstream path.

😕 I don't like this option...
Could be a temporary workaround but I don't think I should deploy and maintain several instances of Zot just because I can't express my needs in a config file...

That said, I also understand that having a breaking change in a conf file may be a pain for you...