Could the use of private packages on ghcr.io Just Work using git credentials?

[lukewagner]

(Sorry for probably asking this nonsensically and with wrong terminology but...) We're attempting to use wkg to pull some WIT packages published to a private ghcr.io repo and hoping that it might Just Work using GitHub credentials (e.g. in .gitconfig). @squillace said that hypothetically this should work (on the ghcr.io side) and that maybe-possibly there is even some support for this already in this library, so I thought I'd ask here in case there was or it could be easily added. In the absence of this feature, to avoid creating extra steps for our devs (asking them to create new tokens and plug them into wkg.toml) we could just write a script to git clone the source registry and copy the WIT files manually, but that seems unfortunate :)

CC @sunfishcode for any extra details about what the exact workflow and commands are

[ricochet]

wkg supports using private registries via:

[registry."acme.registry.com".oci]
# The auth field can either be a username/password pair, or a base64 encoded `username:password` 
# string. If no auth is set, the `wkg` CLI (but not the libraries) will also attempt to load the
# credentials from the docker config.json. This field is also optional and if not set, anonymous
# auth will be used. If you're just pulling from a public registry, this is likely not required.
# If you're using a private registry and/or publishing, you'll almost certainly need to set this.
auth = { username = "open", password = "sesame" }

An alternative approach that is perhaps too opinionated to add here but is very nice to have is using docker credentials: https://github.com/wasmCloud/wash/blob/dac9e13827dcee53fdef131e9a06f691cf82eac8/crates/wash/src/oci.rs#L155

[dgohman-fastly]

Using an auth username/password works, but requires developers to generate an auth token, which is a minor hassle. And using docker credentials works, but only if you're already working with docker.

For my actual use case here, I'm planning to just put the WIT files in a regular git repo, which I can download using the git CLI, which will have already been configured with the needed creds.

[ricochet]

Hopefully you'll be able to leverage https://github.com/bytecodealliance/wit-deps which supports exactly that use-case. Munging git credentials as OCI credentials isn't the approach I'd recommend this project takes.

[lukewagner]

Could we somehow get the GitHub credentials from .gitconfig in addition to Docker?

[lukewagner]

Munging git credentials as OCI credentials isn't the approach I'd recommend this project takes.

Sorry, I don't understand most of the technical details here, but why's that? Intuitively, it seems like we'd expect a lot of wkg usage with GitHub repos, some of which will be private, so at a high-level, it seems surprising that if I have the permissions to read the source code that I wouldn't also be able to read the artifacts generated from that source code with the same credentials.

[ricochet]

Different scopes and different roles. Even github doesn't recommend using git credentials to authenticate: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry

If you want to use git for managing WIT definitions, then use a git client (not an oci client) like wit-deps.