images: support configured registry credentials for pulls

[chruffins]

tldr

Image pulls can now authenticate against configured remote registries (static credentials, AWS ECR short-lived tokens, or docker-config fallback) instead of only ~/.docker/config.json — pull-side generalization for ECR/Docker Hub/anything else, no push-path changes.

Summary

Today every remote pull (image create, manifest inspection, base-image mirroring for builds) authenticates through authn.DefaultKeychain, i.e. whatever lives in the Docker config of the user running hypeman. This adds a registries config section with per-host credential providers, composed into a keychain that is tried before the Docker config default.

registries:
  - host: docker.io
    kind: static
    username: myuser
    password: ${DOCKERHUB_TOKEN}   # ${VAR} expands from the environment
  - host: "*.dkr.ecr.us-east-1.amazonaws.com"
    kind: ecr
    # access_key_id / secret_access_key optional; default AWS credential chain otherwise
  - host: ghcr.io
    kind: docker-config

What changed

• lib/registryauth (new): config type + validation, host-glob matching (with docker.io/index.docker.io canonicalization), static provider, ecr provider (GetAuthorizationToken via aws-sdk-go-v2, tokens cached per region and refreshed 5m before expiry, region parsed from the registry host), and NewKeychain falling back to authn.DefaultKeychain for unmatched hosts — so unconfigured deployments behave exactly as before.
• lib/images: NewManager/newOCIClient/NewOCIClient take an optional keychain (nil = Docker config keychain); all remote calls (inspectManifest*, inspectDigestPlatform, pullToOCILayout*, MirrorBaseImage source pull) use it.
• lib/builds: Config.PullKeychain feeds base-image mirroring.
• cmd/api/config: registries section + validation at startup; documented in config.example.yaml and DEVELOPMENT.md.
• Test call sites updated for the new signatures; new unit tests cover matching, validation, static/env-expansion, ECR region parsing, token caching/refresh, and fall-through.

Test status

• lib/registryauth, lib/builds, lib/providers, lib/imageretention, cmd/api/config: pass.
• lib/images and lib/system: passed fully on a fresh run (including real pulls + erofs conversion after installing mkfs.erofs locally); later re-runs of the pull-dependent tests fail with Docker Hub TOOMANYREQUESTS because this machine pulls anonymously and exhausted the per-IP quota. Clean main fails identically in the same state, and CI authenticates to Docker Hub, so this is environmental.

Not in this PR

• Fleet credential rollout (ansible/config distribution) and any control-plane wiring — deployment follow-up.
• Outbound push to remote registries — separate work; nothing here constrains it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​aws/​aws-sdk-go-v2/​config@​v1.32.34
	github.com/​aws/​aws-sdk-go-v2/​credentials@​v1.19.33
	github.com/​aws/​aws-sdk-go-v2/​service/​ecr@​v1.60.3

View full report