ggcr

func Keychain ¶

func Keychain(identity string, ts oauth2.TokenSource) authn.Keychain

Keychain returns an authn.Keychain used to authorize requests to the cgr.dev registry using go-containerregistry.

It takes the identity UIDP to assume, and a token source to obtain the token to exchange.

This can be used with google.golang.org/api/idtoken.NewTokenSource to exchange ambient GCP credentials for Chainguard tokens:

ts, err := idtoken.NewTokenSource(ctx, "https://cgr.dev")
kc := ggcr.Keychain("my-identity", ts)

This keychain can then be used to pull images from the cgr.dev registry:

img, err := remote.Image("cgr.dev/my/image", remote.WithAuth(kc))