Support reading credentials from docker credential store

[shizhMSFT]

No description provided.

[tmds]

The .NET SDK's built-in container tooling uses https://github.com/mthalman/docker-creds-provider to obtain credentials from these stores.

The credentials are then used by this DelegatingHandler: https://github.com/dotnet/sdk/blob/main/src/Containers/Microsoft.NET.Build.Containers/AuthHandshakeMessageHandler.cs to set appropriate headers.

@shizhMSFT what do you think about adopting a similar implementation?

[shizhMSFT]

Thank @tmds for mentioning this SDK.

I took a look at https://github.com/mthalman/docker-creds-provider. It provides the functionality of reading credentials (i.e. the read path) by properly following the docker credential helper protocol. However, it does not provide any operations for write paths. In other words, we are unable to implement Login and Logout using this SDK.

[shizhMSFT]

I think we can start with this SDK by wrapping it. Then replace with our own implementation when we do need the write paths.

[tmds]

Also interesting in this context: the SDK implements the "insecure" option with this https://github.com/dotnet/sdk/blob/main/src/Containers/Microsoft.NET.Build.Containers/FallbackToHttpMessageHandler.cs.

https://github.com/dotnet/sdk/blob/main/src/Containers/Microsoft.NET.Build.Containers/Registry/DefaultRegistryAPI.cs is where these pieces are assembled into an HttpClient.

I see there is a HttpClientWithBasicAuth class in the OrasProject.Oras.Registry.Remote.Auth namespace.

If you are open to external contributions, I can look at implementing a "HttpClientWithRegistryAuth" based on how the SDK handles these things.