Skip to content

build: bump Go to 1.27.2 and secrets-engine/client to v0.2.1 #14361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Benehiko wants to merge 2 commits into
base: main
Choose a base branch
from
+16 −85
Draft

build: bump Go to 1.27.2 and secrets-engine/client to v0.2.1 #14361

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8f63de0
build: bump Go to 1.27.2 and secrets-engine/client to v0.2.1
Benehiko Oct 19, 2026
ceac5c8
refactor(registry): read session expiry only from the stored claims
Benehiko Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .go-version
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.26.9
1.27.2
4 changes: 4 additions & 0 deletions AI_AGENT_DISCLOSURE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
*"This contribution was prepared by an AI agent acting on a human's behalf.
The human submitter may not have independently reviewed or tested the change."*

2026-10-19
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.

ARG GO_VERSION=1.26.9
ARG GO_VERSION=1.27.2
ARG XX_VERSION=1.9.0
ARG GOLANGCI_LINT_VERSION=v2.13.2
ARG ADDLICENSE_VERSION=v1.0.0
Expand Down
6 changes: 3 additions & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/docker/compose/v5

go 1.26.8
go 1.27.2

require (
github.com/DefangLabs/secret-detector v0.0.0-20260916192156-3e28d7ed64df
Expand All @@ -17,8 +17,8 @@ require (
github.com/docker/cli v29.9.1+incompatible
github.com/docker/cli-docs-tool v0.11.0
github.com/docker/go-units v0.5.0
github.com/docker/secrets-engine/client v0.2.0
github.com/docker/secrets-engine/x v0.8.3
github.com/docker/secrets-engine/client v0.2.1
github.com/docker/secrets-engine/x v0.8.4
github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203
github.com/fsnotify/fsevents v0.2.0
github.com/google/go-cmp v0.7.0
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,10 +90,10 @@ github.com/docker/go-metrics v0.1.0 h1:r76KPNpstz+IvQKSWpYegSkkyzex0V3A1ZGVx6bhG
github.com/docker/go-metrics v0.1.0/go.mod h1:PciI3sONtB051kXALN1JoIlpcu54E1FuPh+4DuqEzyw=
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
github.com/docker/secrets-engine/client v0.2.0 h1:69Q63N5VDbXbxPPgm0LjUtRJ4O41q4cQeFpUxsHZUJo=
github.com/docker/secrets-engine/client v0.2.0/go.mod h1:dL3y9wh+HVHMTInwOOmAmjai6oARC8T+se30RnWgrLs=
github.com/docker/secrets-engine/x v0.8.3 h1:0rt91D54Ah6vI96qbc0Qcaxbkd0n36QAkQm+2614FzA=
github.com/docker/secrets-engine/x v0.8.3/go.mod h1:+s6rb56pq1B376jzzkGqZreFJ3mUtkz+kaYlMuj7/Qs=
github.com/docker/secrets-engine/client v0.2.1 h1:j53uiQp2szKQF7GChnQ1U5vYoRtzoZvojRATEe4EIQ4=
github.com/docker/secrets-engine/client v0.2.1/go.mod h1:YtVX3nFlHzJEF10p2HWZ6grD0+wabbf6su7OCSFCWlE=
github.com/docker/secrets-engine/x v0.8.4 h1:pNFQXpYZilTp4TSOvnbSeanKL9l6Ea0beuR31VrCvnk=
github.com/docker/secrets-engine/x v0.8.4/go.mod h1:KfCMw2fLGea1qsQSTU5owkH8NfRbTBq0PMpXnrAeEZQ=
github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
Expand Down
33 changes: 3 additions & 30 deletions internal/registry/desktop.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,6 @@ package registry

import (
"context"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
"strings"
Expand All @@ -38,7 +36,7 @@ const (
// unexpected request delay by the secrets engine.
desktopLookupTimeout = 5 * time.Second
sessionExpirySkew = 30 * time.Second
// sessionTTL is how long a token without a readable expiry is reused.
// sessionTTL is how long a session without an expiry claim is reused.
sessionTTL = time.Minute
// retryInterval is how long Desktop is not asked again after a failed lookup.
retryInterval = time.Minute
Expand Down Expand Up @@ -200,8 +198,8 @@ func (s *desktopSession) fetch() (clitypes.AuthConfig, time.Time, error) {

now := s.now()
validUntil := now.Add(sessionTTL)
if expiresAt, ok := sessionExpiry(session); ok {
validUntil = expiresAt.Add(-sessionExpirySkew)
if exp := session.Claims.ExpiresAt; exp != nil {
validUntil = exp.Add(-sessionExpirySkew)
if !now.Before(validUntil) {
return clitypes.AuthConfig{}, time.Time{}, errSessionExpired
}
Expand All @@ -214,31 +212,6 @@ func (s *desktopSession) fetch() (clitypes.AuthConfig, time.Time, error) {
}, validUntil, nil
}

func sessionExpiry(session dockerhub.UserSession) (time.Time, bool) {
if exp := session.Claims.ExpiresAt; exp != nil {
return exp.Time, true
}
return jwtExpiry(session.AccessToken)
}

func jwtExpiry(token string) (time.Time, bool) {
parts := strings.Split(token, ".")
if len(parts) != 3 {
return time.Time{}, false
}
payload, err := base64.RawURLEncoding.DecodeString(parts[1])
if err != nil {
return time.Time{}, false
}
var claims struct {
ExpiresAt *dockerhub.NumericDate `json:"exp"`
}
if err := json.Unmarshal(payload, &claims); err != nil || claims.ExpiresAt == nil {
return time.Time{}, false
}
return claims.ExpiresAt.Time, true
}

func logDesktopFallback(name string, err error) {
if isSessionUnavailable(err) {
logrus.Debugf("no %s session available from Docker Desktop, using Docker CLI credentials: %v", name, err)
Expand Down
46 changes: 0 additions & 46 deletions internal/registry/desktop_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ package registry

import (
"context"
"encoding/base64"
"errors"
"fmt"
"sync"
Expand Down Expand Up @@ -452,51 +451,6 @@ func TestDesktopAuthProvider_RefetchesSessionWithoutExpiry(t *testing.T) {
assert.Equal(t, hub.sessionCalls.Load(), int32(2))
}

func fakeJWT(expiresAt time.Time) string {
enc := base64.RawURLEncoding.EncodeToString
return enc([]byte(`{"alg":"none"}`)) + "." + enc(fmt.Appendf(nil, `{"exp":%d}`, expiresAt.Unix())) + ".sig"
}

func TestDesktopAuthProvider_ExpiryFromTokenWhenClaimsLackIt(t *testing.T) {
t.Run("expired token falls back", func(t *testing.T) {
session := hubSession("hubuser", time.Time{})
session.AccessToken = fakeJWT(testNow.Add(-time.Minute))
p := newTestProvider(&fakeHub{session: session}, nil)

got, err := p.GetAuthConfig("docker.io")
assert.NilError(t, err)
assert.DeepEqual(t, got, cliCredentials("docker.io"))
})

t.Run("valid token is reused until it expires", func(t *testing.T) {
session := hubSession("hubuser", time.Time{})
session.AccessToken = fakeJWT(testNow.Add(10 * time.Minute))
hub := &fakeHub{session: session}
p := newTestProvider(hub, nil)

got, err := p.GetAuthConfig("docker.io")
assert.NilError(t, err)
assert.Equal(t, got.Password, session.AccessToken)

// Past sessionTTL, but the token's own expiry still applies.
p.clock.advance(sessionTTL + time.Minute)
_, err = p.GetAuthConfig("docker.io")
assert.NilError(t, err)
assert.Equal(t, hub.sessionCalls.Load(), int32(1))
})
}

func TestJWTExpiry(t *testing.T) {
exp, ok := jwtExpiry(fakeJWT(testNow))
assert.Assert(t, ok)
assert.Assert(t, exp.Equal(testNow))

for _, token := range []string{"", "opaque-token", "a.%%%.c", "a." + base64.RawURLEncoding.EncodeToString([]byte(`{}`)) + ".c"} {
_, ok := jwtExpiry(token)
assert.Assert(t, !ok, token)
}
}

func TestDesktopAuthProvider_ConcurrentLookupsShareOneFetch(t *testing.T) {
hub := &fakeHub{session: hubSession("hubuser", testNow.Add(time.Hour))}
p := newTestProvider(hub, nil)
Expand Down
Loading