Task skopeo-copy ignores $HOME/.docker/config.json with credentials

[guillermomolina]

As far as I could investigate, the secrets annotated with "tekton.dev/docker-#" are used to create the file $HOME/.docker/config.json with the credentials for each of the registries.

The Task buildah push correctly loads the credentials, but the Task skopeo-copy does seem to ignore it.

Expected Behavior

[prepare] 2023/10/27 10:25:21 Entrypoint initialization

[place-scripts] 2023/10/27 10:25:22 Decoded script /tekton/scripts/script-0-qbznn

[skopeo-copy] Getting image source signatures
[skopeo-copy] Copying blob sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[skopeo-copy] Copying config sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[skopeo-copy] Writing manifest to image destination

Actual Behavior

[prepare] 2023/10/27 10:25:21 Entrypoint initialization

[place-scripts] 2023/10/27 10:25:22 Decoded script /tekton/scripts/script-0-qbznn

[skopeo-copy] Getting image source signatures
[skopeo-copy] Copying blob sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[skopeo-copy] Copying config sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[skopeo-copy] time="2023-10-27T10:26:35Z" level=fatal msg="writing manifest: uploading manifest XXXXXX to hub.integracio.sys/base/YYYY/ZZZZZZZ: unauthorized: unauthorized to access repository: base/YYYY/ZZZZZZZ, action: push: unauthorized to access repository: base/YYYY/ZZZZZZZ, action: push"

Steps to Reproduce the Problem

apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-bot
secrets:
  - name: registry-credentials
---
apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
  annotations:
    tekton.dev/docker-0: https://hub.integracio.sys
type: kubernetes.io/basic-auth
stringData:
  username: ZZZZZ
  password: XXXXX
---
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  generateName: skopeo-copy-
spec:
  taskRef:
    name: skopeo-copy
  params:
    - name: srcImageURL
      value: docker://hub.integracio.sys/base/YYYY/ZZZZZZZ:JJJJJJ
    - name: destImageURL
      value: docker://hub.integracio.sys/base/YYYY/ZZZZZZZ:XXXXXX
    - name: srcTLSverify
      value: "false"
    - name: destTLSverify
      value: "false"
  serviceAccountName: build-bot
  workspaces:
    - name: images-url
      emptyDir: {}

Additional Info

It can be fixed with:

63:            skopeo copy "${sourceDest[@]}" --src-tls-verify="$(params.srcTLSverify)" --dest-tls-verify="$(params.destTLSverify)" --authfile ${HOME}/.docker/config.json

72:          skopeo copy "$(params.srcImageURL)" "$(params.destImageURL)" --src-tls-verify="$(params.srcTLSverify)" --dest-tls-verify="$(params.destTLSverify)" --authfile ${HOME}/.docker/config.json