feat: ECR credential integration into Finch

cmd/finch/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/runfinch/finch/pkg/command"
 	"github.com/runfinch/finch/pkg/config"
 	"github.com/runfinch/finch/pkg/dependency"
+	"github.com/runfinch/finch/pkg/dependency/credhelper"
 	"github.com/runfinch/finch/pkg/dependency/vmnet"
 	"github.com/runfinch/finch/pkg/disk"
 	"github.com/runfinch/finch/pkg/flog"
@@ -120,7 +121,11 @@ func virtualMachineCommands(
 	fs afero.Fs,
 	fc *config.Finch,
 ) *cobra.Command {
-	optionalDepGroups := []*dependency.Group{vmnet.NewDependencyGroup(ecc, lcc, fs, fp, logger)}
+	optionalDepGroups := []*dependency.Group{
+		vmnet.NewDependencyGroup(ecc, lcc, fs, fp, logger),
+		credhelper.NewDependencyGroup(ecc, fs, fp, logger, fc, system.NewStdLib().Env("USER"),
+			system.NewStdLib().Arch()),
+	}
 	return newVirtualMachineCommand(
 		lcc,
 		logger,

e2e/e2e.go

@@ -39,7 +39,11 @@ import (
 const InstalledTestSubject = "finch"
 
 // Installed indicates whether the tests are run against installed application.
-var Installed = flag.Bool("installed", false, "the flag to show whether the tests are run against installed application")
+// Registry indicates which container registry to pull from
+var (
+	Installed = flag.Bool("installed", false, "the flag to show whether the tests are run against installed application")
+	Registry  = flag.String("registry", "", "used when pulling from registry to test credential helper")
+)
 
 // CreateOption creates an option for running e2e tests.
 func CreateOption() (*option.Option, error) {

e2e/vm/cred_helper_test.go

@@ -0,0 +1,37 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package vm
+
+import (
+	"strings"
+
+	"github.com/onsi/ginkgo/v2"
+	"github.com/onsi/gomega"
+	"github.com/onsi/gomega/gexec"
+	"github.com/runfinch/common-tests/command"
+	"github.com/runfinch/common-tests/option"
+)
+
+var testCredHelper = func(o *option.Option, installed bool, registry string) {
+	ginkgo.Describe("Credential Helper", func() {
+		ginkgo.Describe("Credential Helper", func() {
+			ginkgo.It("should pull from container registry", func() {
+				resetVM(o, installed)
+				resetDisks(o, installed)
+				if registry == "" {
+					ginkgo.Skip("No Provided Container Registry Url")
+				}
+				writeFile(finchConfigFilePath, []byte("memory: 4GiB\ncredsHelper: ecr-login\ncpus: 6\nvmType: vz\nrosetta: false"))
+				cfgJSONPath := strings.ReplaceAll(finchConfigFilePath, "finch.yaml", "config.json")
+				writeFile(cfgJSONPath, []byte("{\"credsStore\":\"ecr-login\"}"))
+				initCmdSession := command.New(o, virtualMachineRootCmd, "init").WithTimeoutInSeconds(600).Run()
+				gomega.Expect(initCmdSession).Should(gexec.Exit(0))
+				registryURL := registry
+
+				command.New(o, "pull", registryURL).WithTimeoutInSeconds(600).Run()
+				gomega.Expect(command.Stdout(o, "images", "-q", registryURL)).NotTo(gomega.BeEmpty())
+			})
+		})
+	})
+}

e2e/vm/vm_test.go

@@ -52,6 +52,7 @@ func TestVM(t *testing.T) {
 		testVersion(o)
 		testVirtualizationFrameworkAndRosetta(o, *e2e.Installed)
 		testSupportBundle(o)
+		testCredHelper(o, *e2e.Installed, *e2e.Registry)
 	})
 
 	gomega.RegisterFailHandler(ginkgo.Fail)

pkg/config/config.go

@@ -33,8 +33,9 @@ type AdditionalDirectory struct {
 
 // Finch represents the configuration file for Finch CLI.
 type Finch struct {
-	CPUs   *int    `yaml:"cpus"`
-	Memory *string `yaml:"memory"`
+	CPUs        *int    `yaml:"cpus"`
+	Memory      *string `yaml:"memory"`
+	CredsHelper *string `yaml:"credsHelper,omitempty"`
 	// AdditionalDirectories are the work directories that are not supported by default. In macOS, only home directory is supported by default.
 	// For example, if you want to mount a directory into a container, and that directory is not under your home directory,
 	// then you'll need to specify this field to add that directory or any ascendant of it as a work directory.

pkg/config/nerdctl_config_applier.go

@@ -42,6 +42,17 @@ func NewNerdctlApplier(dialer fssh.Dialer, fs afero.Fs, privateKeyPath, hostUser
 	}
 }
 
+func addLinetoFilePath(fs afero.Fs, profileFilePath string, profStr string, cmd string) (string, error) {
+	if !strings.Contains(profStr, cmd) {
+		profBufWithCmd := fmt.Sprintf("%s\n%s", profStr, cmd)
+		if err := afero.WriteFile(fs, profileFilePath, []byte(profBufWithCmd), 0o644); err != nil {
+			return "", fmt.Errorf("failed to write to profile file: %w", err)
+		}
+		return profBufWithCmd, nil
+	}
+	return profStr, nil
+}
+
 // updateEnvironment adds variables to the user's shell's environment. Currently it uses ~/.bashrc because
 // Bash is the default shell and Bash will not load ~/.profile if ~/.bash_profile exists (which it does).
 // ~/.bash_profile sources ~/.bashrc, so ~/.bashrc is currently the best place to define additional variables.
@@ -56,18 +67,25 @@ func NewNerdctlApplier(dialer fssh.Dialer, fs afero.Fs, privateKeyPath, hostUser
 // [GNU docs for Bash]: https://www.gnu.org/software/bash/manual/html_node/Bash-Startup-Files.html
 //
 // [registry nerdctl docs]: https://github.com/containerd/nerdctl/blob/master/docs/registry.md
+
 func updateEnvironment(fs afero.Fs, user string) error {
+	cmdArr := [4]string{
+		fmt.Sprintf("export DOCKER_CONFIG=\"/Users/%s/.finch\"", user),
+		fmt.Sprintf("[ -L /usr/local/bin/docker-credential-ecr-login ] "+
+			"|| sudo ln -s /Users/%s/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/", user),
+		fmt.Sprintf("[ -L /root/.aws ] || sudo ln -fs  /Users/%s/.aws /root/.aws", user),
+	}
+
 	profileFilePath := fmt.Sprintf("/home/%s.linux/.bashrc", user)
 	profBuf, err := afero.ReadFile(fs, profileFilePath)
 	if err != nil {
 		return fmt.Errorf("failed to read config file: %w", err)
 	}
-
 	profStr := string(profBuf)
-	if !strings.Contains(profStr, "export DOCKER_CONFIG") {
-		profBufWithDockerCfg := fmt.Sprintf("%s\nexport DOCKER_CONFIG=\"/Users/%s/.finch\"\n", profStr, user)
-		if err := afero.WriteFile(fs, profileFilePath, []byte(profBufWithDockerCfg), 0o644); err != nil {
-			return fmt.Errorf("failed to write to profile file: %w", err)
+	for _, element := range cmdArr {
+		profStr, err = addLinetoFilePath(fs, profileFilePath, profStr, element)
+		if err != nil {
+			return err
 		}
 	}
 

pkg/config/nerdctl_config_applier_test.go

@@ -47,7 +47,11 @@ func Test_updateEnvironment(t *testing.T) {
 			postRunCheck: func(t *testing.T, fs afero.Fs) {
 				fileBytes, err := afero.ReadFile(fs, "/home/mock_user.linux/.bashrc")
 				require.NoError(t, err)
-				assert.Equal(t, []byte("\n"+`export DOCKER_CONFIG="/Users/mock_user/.finch"`+"\n"), fileBytes)
+				assert.Equal(t,
+					[]byte("\nexport DOCKER_CONFIG=\"/Users/mock_user/.finch\""+
+						"\n[ -L /usr/local/bin/docker-credential-ecr-login ] || sudo ln -s "+
+						"/Users/mock_user/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/"+
+						"\n"+"[ -L /root/.aws ] || sudo ln -fs  /Users/mock_user/.aws /root/.aws"), fileBytes)
 			},
 			want: nil,
 		},
@@ -60,15 +64,20 @@ func Test_updateEnvironment(t *testing.T) {
 					afero.WriteFile(
 						fs,
 						"/home/mock_user.linux/.bashrc",
-						[]byte(`export DOCKER_CONFIG="/Users/mock_user/.finch"`),
+						[]byte("export DOCKER_CONFIG=\"/Users/mock_user/.finch\""+"\n"+"[ -L /usr/local/bin/docker-credential-ecr-login ] "+
+							"|| sudo ln -s /Users/mock_user/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/"+
+							"\n"+"[ -L /root/.aws ] || sudo ln -fs  /Users/mock_user/.aws /root/.aws"),
 						0o644,
 					),
 				)
 			},
 			postRunCheck: func(t *testing.T, fs afero.Fs) {
 				fileBytes, err := afero.ReadFile(fs, "/home/mock_user.linux/.bashrc")
 				require.NoError(t, err)
-				assert.Equal(t, []byte(`export DOCKER_CONFIG="/Users/mock_user/.finch"`), fileBytes)
+				assert.Equal(t, []byte(`export DOCKER_CONFIG="/Users/mock_user/.finch"`+"\n"+
+					"[ -L /usr/local/bin/docker-credential-ecr-login ] "+
+					"|| sudo ln -s /Users/mock_user/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/"+
+					"\n"+"[ -L /root/.aws ] || sudo ln -fs  /Users/mock_user/.aws /root/.aws"), fileBytes)
 			},
 			want: nil,
 		},

pkg/dependency/credhelper/cred_helper.go

@@ -0,0 +1,70 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package credhelper for integrating credential helpers into Finch
+package credhelper
+
+import (
+	"fmt"
+
+	"github.com/spf13/afero"
+
+	"github.com/runfinch/finch/pkg/command"
+	"github.com/runfinch/finch/pkg/config"
+	"github.com/runfinch/finch/pkg/dependency"
+	"github.com/runfinch/finch/pkg/flog"
+	"github.com/runfinch/finch/pkg/path"
+)
+
+const (
+	description = "Installing Credential Helper"
+	errMsg      = "Failed to finish installing credential helper"
+)
+
+// NewDependencyGroup returns a dependency group that contains all the dependencies required to make credhelper work.
+func NewDependencyGroup(
+	execCmdCreator command.Creator,
+	fs afero.Fs,
+	fp path.Finch,
+	logger flog.Logger,
+	fc *config.Finch,
+	user string,
+	arch string,
+) *dependency.Group {
+	deps := newDeps(execCmdCreator, fs, fp, logger, fc, user, arch)
+	return dependency.NewGroup(deps, description, errMsg)
+}
+
+type helperConfig struct {
+	binaryName    string
+	credHelperURL string
+	hash          string
+	installFolder string
+	finchPath     string
+}
+
+func newDeps(
+	execCmdCreator command.Creator,
+	fs afero.Fs,
+	fp path.Finch,
+	logger flog.Logger,
+	fc *config.Finch,
+	user string,
+	arch string,
+) []dependency.Dependency {
+	var deps []dependency.Dependency
+
+	credHelperURL := fmt.Sprintf("https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com"+
+		"/0.7.0/linux-%s/docker-credential-ecr-login", arch)
+	installFolder := fmt.Sprintf("/Users/%s/.finch/cred-helpers/", user)
+	finchPath := fmt.Sprintf("/Users/%s/.finch/", user)
+	hc := helperConfig{
+		binaryName: "docker-credential-ecr-login", credHelperURL: credHelperURL,
+		hash: "sha256:ff14a4da40d28a2d2d81a12a7c9c36294ddf8e6439780c4ccbc96622991f3714", installFolder: installFolder,
+		finchPath: finchPath,
+	}
+	binaries := newCredHelperBinary(fp, fs, execCmdCreator, logger, fc, user, hc)
+	deps = append(deps, dependency.Dependency(binaries))
+
+	return deps
+}