feat(config,client): provide a per-registry envvar scheme to set autentication

Cargo.toml

@@ -4,14 +4,14 @@ resolver = "3"
 
 [workspace.package]
 edition = "2024"
-version = "0.16.0-rc.0"
+version = "0.16.0-rc.1"
 authors = ["The Wasmtime Project Developers"]
 license = "Apache-2.0 WITH LLVM-exception"
 
 [workspace.dependencies]
-wasm-pkg-client = { version = "0.16.0-rc.0", path = "crates/wasm-pkg-client" }
-wasm-pkg-common = { version = "0.16.0-rc.0", path = "crates/wasm-pkg-common" }
-wasm-pkg-core = { version = "0.16.0-rc.0", path = "crates/wasm-pkg-core" }
+wasm-pkg-client = { version = "0.16.0-rc.1", path = "crates/wasm-pkg-client" }
+wasm-pkg-common = { version = "0.16.0-rc.1", path = "crates/wasm-pkg-common" }
+wasm-pkg-core = { version = "0.16.0-rc.1", path = "crates/wasm-pkg-core" }
 
 anstream = "0.6"
 anstyle = "1.0"

crates/wasm-pkg-client/src/oci/mod.rs

@@ -114,6 +114,16 @@ impl OciBackend {
     }
 
     pub(crate) fn get_credentials(&self) -> Result<RegistryAuth, Error> {
+        // Detect `WKG_REGISTRY_<REGISTRY>_AUTH_<AUTH_SCHEME>` if present.
+        let auth_var_key = &registry_auth_env_var(&self.oci_registry, "BEARER");
+        if let Ok(token) = std::env::var(auth_var_key)
+            && !token.is_empty()
+        {
+            tracing::debug!(registry = %self.oci_registry, %auth_var_key, "Using detected authentication envvar key");
+            // Only `BEARER` AUTH_SCHEME for now
+            return Ok(RegistryAuth::Bearer(token));
+        }
+
         if let Some(BasicCredentials { username, password }) = &self.credentials {
             return Ok(RegistryAuth::Basic(
                 username.clone(),
@@ -176,6 +186,27 @@ pub(crate) fn oci_registry_error(err: OciDistributionError) -> Error {
     }
 }
 
+/// Returns the envvar used to provide credentials for a given registry and
+/// auth scheme: `WKG_REGISTRY_<REGISTRY>_AUTH_<AUTH_SCHEME>`
+/// * `<REGISTRY>` : defined by the resolution of [`wasm_pkg_common::config::Config`] and
+/// * `<AUTH_SCHEME>`: the auth mechanism (`BEARER` only support)
+///
+/// Any non-ASCII-alphanumeric characters (., -, :, /, ...) in the registry
+/// name are replaced by `_` and the whole string is upper-cased.
+// TODO(mkatychev): move this into `wasm_pkg_common::config::Config` once overlays are implemented,
+// this should be a generic-to-backend way of overriding configs.
+fn registry_auth_env_var(oci_registry: &str, scheme: &str) -> String {
+    let sanitized: String = oci_registry
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() { c } else { '_' })
+        .collect();
+    format!(
+        "WKG_REGISTRY_{}_AUTH_{}",
+        sanitized.to_ascii_uppercase(),
+        scheme.to_ascii_uppercase(),
+    )
+}
+
 fn get_docker_credential(registry: &str) -> Result<Option<RegistryAuth>, Error> {
     match docker_credential::get_credential(registry) {
         Ok(DockerCredential::UsernamePassword(username, password)) => {
@@ -203,3 +234,32 @@ fn get_docker_credential(registry: &str) -> Result<Option<RegistryAuth>, Error>
 
     Ok(None)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn auth_env_var_sanitizes_registry_name() {
+        assert_eq!(
+            registry_auth_env_var("example.com", "BEARER"),
+            "WKG_REGISTRY_EXAMPLE_COM_AUTH_BEARER"
+        );
+        assert_eq!(
+            registry_auth_env_var("ghcr.io", "BEARER"),
+            "WKG_REGISTRY_GHCR_IO_AUTH_BEARER"
+        );
+        assert_eq!(
+            registry_auth_env_var("localhost:1234", "BEARER"),
+            "WKG_REGISTRY_LOCALHOST_1234_AUTH_BEARER",
+        );
+    }
+
+    #[test]
+    fn auth_env_var_upcases_scheme() {
+        assert_eq!(
+            registry_auth_env_var("example.com", "bearer"),
+            "WKG_REGISTRY_EXAMPLE_COM_AUTH_BEARER"
+        );
+    }
+}