Allow for configurable `skopeo` credentials during pulling of the ROCK base image.
Metadata
Current evaluation
Configurable skopeo source credentials for ECR base-image pulls remain unimplemented and untriaged; the current Image class exposes no credential option.
Suggested action: needs triage
Reason: The report provides a concrete `toomanyrequests` failure and identifies `--src-creds` as the propagation mechanism; current `Image.from_docker_registry()` still passes only retry and architecture parameters, and no commit adds `src-creds`. The issue has no labels, assignee, or maintainer response, while credential source and secret-handling behavior still need design, so it remains valid but needs triage.
Evaluated by: mr-cal-bot
Impact:
55
Quick Win:
20
Complexity:
52
Confidence:
93
Actionability:
76
Issue body
### What needs to get done
[`rockcraft.oci.Image` class](https://github.com/canonical/rockcraft/blob/d09ad13493b8dc0cbb95db7285ef4a6d8a166f67/rockcraft/oci.py#L54) needs extending to add configurable credentials during the `skopeo copy` of the base image from Amazon ECR.
Will probably need adding the args as top-level `rockcraft` args themselves and transparently propagating the arguments down to the actual `skopeo copy` command using `--src-creds` as seen in [`man skopeo-copy`](https://manpages.ubuntu.com/manpages/mantic/man1/skopeo-copy.1.html).
### Why it needs to get done
Although ECR is considerably more lenient than DockeHub in terms of data pull limits for unverified requests, it still has them, leading to errors like these:
```python3
024-07-29 11:06:56.991 Execute process: ['/snap/rockcraft/1783/bin/skopeo', '--insecure-policy', '--override-arch', 'amd64', 'copy', '--retry-times', '5', 'docker://public.ecr.aws/ubuntu/ubuntu:22.04', 'oci:/root/images/ubuntu:22.04'], kwargs={}
2024-07-29 11:10:30.466 Failed to copy image: Command '['/snap/rockcraft/1783/bin/skopeo', '--insecure-policy', '--override-arch', 'amd64', 'copy', '--retry-times', '5', 'docker://public.ecr.aws/ubuntu/ubuntu:22.04', 'oci:/root/images/ubuntu:22.04']' returned non-zero exit status 1. (time="2024-07-29T11:07:28Z" level=warning msg="Failed, retrying in 1s ... (1/5). Error: initializing source docker://public.ecr.aws/ubuntu/ubuntu:22.04: reading manifest 22.04 in public.ecr.aws/ubuntu/ubuntu: toomanyrequests: Data limit exceeded"
```
Depending on the project being rock'd, these limits can be quite the nuisance.
The [`canonical/harbor-rocks` repo](https://github.com/canonical/harbor-rocks) for example defines rocks for 10 components x 3 versions x 2 architectures = 60 whole images, and it's virtually guaranteed that 2-3 of the build workflows will fail.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
55
Quick Win:
20
Complexity:
52
Confidence:
93
Actionability:
76
|
needs triage | Configurable skopeo source credentials for ECR base-image pulls remain unimplemented and untriaged; the current Image class exposes no credential option. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
16
Complexity:
50
Confidence:
70
Actionability:
80
|
needs triage | Feature request to add configurable skopeo credentials (--src-creds) for pulling base images from registries like ECR to avoid rate limits. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
20
Staleness:
85
Complexity:
55
Confidence:
70
Support Request:
10
|
needs triage | Feature request to add configurable skopeo credentials (via --src-creds) when pulling the ROCK base image from ECR, to work around registry rate limits. Open 763 days, no maintainer response, no labels; related issue #655 (configurable registry) also open and untriaged. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
20
Confidence:
85
Support Request:
10
|
needs triage | Request to add configurable skopeo credentials for pulling base images to bypass rate limits. Unlabeled, inactive for over two years, no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
80
Support Request:
10
|
needs triage | Request to add configurable skopeo credentials for pulling base images to bypass ECR rate limits. Unlabeled, inactive for nearly two years, and awaiting maintainer assessment. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
45
Confidence:
80
Support Request:
10
|
needs triage | Feature request to pass configurable skopeo credentials for base image pulls to avoid ECR rate limits. Untriaged, inactive for nearly two years, with no maintainer response or labels. |
Update history
No update history recorded yet.
Related work
-
Related To:
rockcraft#655
(confidence 100%)
The author explicitly links #655 as related in cause, while stating that configurable registry selection is functionally independent.
Related issues
No related issues found above the similarity threshold.