Skip to content

Commit d361341

Browse files
Use docker expiration string from auth config (#196)
Description of changes: Just checking the existence of the authorization string in Docker config is not sufficient to determine whether the user is logged into ECR public This PR will decode the expiration timestamp from the authorization string and compare it to the current UTC timestamp. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
1 parent 29a44ff commit d361341

File tree

1 file changed

+17
-1
lines changed

1 file changed

+17
-1
lines changed

scripts/lib/common.sh

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,5 +122,21 @@ k8s_controller_gen_version_equals() {
122122
# fi
123123
is_public_ecr_logged_in() {
124124
local public_ecr_url="public.ecr.aws"
125-
jq -e --arg url $public_ecr_url '.auths | has($url)' ~/.docker/config.json > /dev/null;
125+
126+
# Load the auth string
127+
# Base64 decode it
128+
# Parse it as <Username>:<B64 Payload>, and take only the payload
129+
# Base64 decode it
130+
# Read the "expiration" value
131+
local expiration_time=$(jq -r --arg url $public_ecr_url '.auths[$url].auth' ~/.docker/config.json | base64 -d | cut -d":" -f2 | base64 -d | jq -r ".expiration")
132+
133+
# If any part of this doesn't exist, the user isn't logged in
134+
[ -z "$expiration_time" ] && exit 1
135+
136+
local current_time=$(date +%s)
137+
138+
# If the credentials have expired, the user isn't logged in
139+
[ "$expiration_time" -lt "$current_time" ] && exit 1
140+
141+
exit 0
126142
}

0 commit comments

Comments
 (0)