mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 10:35:51 +00:00
rcourtman
3355f7a671
Container update detection only ever negotiated anonymous pull tokens, so containers from registries that reject anonymous digest HEADs pinned a permanent "authentication required" badge (#1706). The agent already runs on the Docker host, so the checker now resolves the same credential store docker pull uses - config.json auths entries, credsStore/credHelpers credential helpers (docker-credential-<name> get), and Podman's auth.json - and presents the stored login: Basic auth on Bearer token negotiation and on the hardcoded Docker Hub / ghcr.io token endpoints, direct answers to Basic challenges, and the refresh-token grant for identity-token logins such as Azure ACR. Credentials never leave the host: they are only presented to the registry or its token endpoint, helper output stays out of reported check errors, and lookups are cached in memory for five minutes. Helper names are validated before exec, and a stale login falls back to the anonymous path so checks that used to work keep working. Set PULSE_DISABLE_REGISTRY_CREDENTIALS=true (--disable-registry-credentials) to keep detection anonymous-only. The agent-lifecycle and security-privacy subsystem contracts pin the host-local credential boundary.