From c9d63b94dc5e652db5847380ecf5f9dba2871a55 Mon Sep 17 00:00:00 2001
From: Fahrzin Hemmati <fahhem@users.noreply.github.com>
Date: Sat, 25 Jan 2025 09:25:27 -0800
Subject: [PATCH] fix: handle not-logged-in public repos with credsStore (#731)

---
 .../docker-credential-devpod-esque                | 11 +++++++++++
 e2e/assertion/oci_pull_auth_tests.bats            | 15 ++++++++++++++-
 oci/defs.bzl                                      |  2 +-
 oci/private/authn.bzl                             |  5 +++++
 4 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100755 e2e/assertion/credential-helper/docker-credential-devpod-esque

diff --git a/e2e/assertion/credential-helper/docker-credential-devpod-esque b/e2e/assertion/credential-helper/docker-credential-devpod-esque
new file mode 100755
index 00000000..3f3557a4
--- /dev/null
+++ b/e2e/assertion/credential-helper/docker-credential-devpod-esque
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+read -r URL
+
+
+if [[ "$URL" != "localhost:1447" ]]; then 
+    echo "expected registry url to be localhost:1447";
+    exit 1
+fi
+
+echo "{\"ServerURL\": \"$URL\", \"Username\": \"\", \"Secret\": \"\"}"
+
diff --git a/e2e/assertion/oci_pull_auth_tests.bats b/e2e/assertion/oci_pull_auth_tests.bats
index 77def374..3bc00a2f 100644
--- a/e2e/assertion/oci_pull_auth_tests.bats
+++ b/e2e/assertion/oci_pull_auth_tests.bats
@@ -163,4 +163,17 @@ EOF
     update_assert '{"Authorization": ["Basic not_match"]}'
     run bazel build @empty_image//... $BAZEL_FLAGS
     assert_failure
-}
\ No newline at end of file
+}
+
+@test "empty username and password succeeds" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "credHelpers": {
+    "localhost:1447": "devpod-esque"
+  }
+}
+EOF
+    update_assert ''
+    run bazel build @empty_image//... $BAZEL_FLAGS
+    assert_success
+}
diff --git a/oci/defs.bzl b/oci/defs.bzl
index 924d1655..a156d81f 100644
--- a/oci/defs.bzl
+++ b/oci/defs.bzl
@@ -54,7 +54,7 @@ def _digest(name, **kwargs):
     jq(
         name = name + ".digest",
         args = ["--raw-output"],
-        srcs = ["_{}_index.json".format(name)],
+        srcs = ["{}_index.json".format(name)],
         filter = """.manifests[0].digest""",
         out = name + ".json.sha256",  # path chosen to match rules_docker for easy migration
         **kwargs
diff --git a/oci/private/authn.bzl b/oci/private/authn.bzl
index eb01388f..83933da1 100644
--- a/oci/private/authn.bzl
+++ b/oci/private/authn.bzl
@@ -126,6 +126,11 @@ exec "docker-credential-{}" get <<< "$1" """.format(helper_name),
 
     response = json.decode(result.stdout)
 
+    # If the username and secret are empty, the user does not have a login.
+    # Returning {} avoids sending invalid Basic auth headers that result in 401's
+    if response["Username"] == "" and response["Secret"] == "":
+        return {}
+
     return {
         "type": "basic",
         "login": response["Username"],