Fix authentication priority: AWS-native -> docker login -> credHelpers -> credsStore

CHANGELOG.md

@@ -14,6 +14,7 @@ and **Merged pull requests**. Critical items to know are:
 The versions coincide with releases on pip. Only major versions will be released as tags on Github.
 
 ## [0.0.x](https://github.com/oras-project/oras-py/tree/main) (0.0.x)
+ - Properly prioritize auth methods (0.2.36)
  - fix 'authentication with ECR' to be an extra as intended (0.2.35)
  - Add support for authentication with ECR registries (0.2.34)
  - Add support for Docker credsStore and credHelpers

oras/auth/base.py

@@ -64,7 +64,7 @@ def logout(self, hostname: str):
     def _logout(self):
         pass
 
-    def _get_auth_from_creds_store(self, binary: str, hostname: str) -> str:
+    def _get_auth_from_creds_store(self, binary: str, hostname: str) -> str | None:
         try:
             proc = subprocess.run(
                 [binary, "get"],
@@ -73,14 +73,14 @@ def _get_auth_from_creds_store(self, binary: str, hostname: str) -> str:
                 stderr=subprocess.PIPE,
                 check=True,
             )
-        except FileNotFoundError as exc:
-            raise RuntimeError(
-                f"Credential helper '{binary}' not found in PATH"
-            ) from exc
+        except FileNotFoundError:
+            logger.warning(f"Credential helper '{binary}' not found in PATH")
+            return None
         except subprocess.CalledProcessError as exc:
-            raise RuntimeError(
+            logger.warning(
                 f"Credential helper '{binary}' failed: {exc.stderr.decode().strip()}"
-            ) from exc
+            )
+            return None
         payload = json.loads(proc.stdout)
         return auth_utils.get_basic_auth(payload["Username"], payload["Secret"])
 
@@ -102,19 +102,19 @@ def _load_auth(self, hostname: str) -> bool:
                 return False
             self._basic_auth = auth
             return True
-        # Check for credsStore:
-        if self._auth_config.get("credsStore"):
+        # Check for credHelper
+        if self._auth_config.get("credHelpers", {}).get(hostname):
             auth = self._get_auth_from_creds_store(
-                self._auth_config["credsStore"], hostname
+                self._auth_config["credHelpers"][hostname], hostname
             )
             if auth is not None:
                 self._basic_auth = auth
                 auths[hostname] = {"auth": auth}
                 return True
-        # Check for credHelper
-        if self._auth_config.get("credHelpers", {}).get(hostname):
+        # Check for credsStore:
+        if self._auth_config.get("credsStore"):
             auth = self._get_auth_from_creds_store(
-                self._auth_config["credHelpers"][hostname], hostname
+                self._auth_config["credsStore"], hostname
             )
             if auth is not None:
                 self._basic_auth = auth

oras/auth/ecr.py

@@ -3,23 +3,38 @@
 __license__ = "Apache-2.0"
 
 import re
+from typing import Optional
 
 import requests
 
 import oras.auth.utils as auth_utils
 from oras.auth.token import TokenAuth
 from oras.logger import logger
+from oras.types import container_type
 
 
 class EcrAuth(TokenAuth):
     """
     Auth backend for AWS ECR (Elastic Container Registry) using token-based authentication.
     """
 
+    AWS_ECR_PATTERN = re.compile(
+        r"(?P<account_id>\d{12})\.dkr\.ecr\.(?P<region>[^.]+)\.amazonaws\.com"
+    )
+    AWS_ECR_REALM_PATTERN = re.compile(
+        r"https://(?P<account_id>\d{12})\.dkr\.ecr\.(?P<region>[^.]+)\.amazonaws\.com/"
+    )
+
     def __init__(self):
         super().__init__()
         self._tokens = {}
 
+    def load_configs(
+        self, container: container_type, configs: Optional[list] = None
+    ) -> None:
+        if not self.AWS_ECR_PATTERN.fullmatch(container.registry):
+            super().load_configs(container, configs)
+
     def authenticate_request(
         self, original: requests.Response, headers: dict, refresh=False
     ):
@@ -46,7 +61,7 @@ def authenticate_request(
         token = self._tokens.get(h.realm)
         if not token or refresh:
             m = re.fullmatch(
-                r"https://(?P<account_id>\d{12})\.dkr\.ecr\.(?P<region>[^.]+)\.amazonaws\.com/",
+                self.AWS_ECR_REALM_PATTERN,
                 h.realm,
             )
             if not m:

oras/version.py

@@ -2,7 +2,7 @@
 __copyright__ = "Copyright The ORAS Authors."
 __license__ = "Apache-2.0"
 
-__version__ = "0.2.35"
+__version__ = "0.2.36"
 AUTHOR = "Vanessa Sochat"
 EMAIL = "vsoch@users.noreply.github.com"
 NAME = "oras"