Spike: unified Remote interface over nebi server and OCI registry - #556
Draft
tylerpotts wants to merge 2 commits into
Draft
Spike: unified Remote interface over nebi server and OCI registry#556tylerpotts wants to merge 2 commits into
tylerpotts wants to merge 2 commits into
Conversation
Exploratory work for making servers and OCI registries peers. Adds internal/remote with the proposed Remote interface, OCIRemote and ServerRemote implementations, a shared conformance test that passes against both backends, and README.md with findings.
pmeier
reviewed
Sep 2, 2026
| // The server additionally supports an OIDC device flow (probed via | ||
| // GET /auth/device-config); that cannot be expressed as a static | ||
| // credential and is out of scope for the spike (see README). | ||
| return []AuthenticationCredentialType{ |
Member
There was a problem hiding this comment.
@tylerpotts Can you include the device flow in the scope? Maybe we need to split between static and "dynamic" auth.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exploration for #555: can one
Remoteinterface make nebi servers and OCI registries peers from a client's point of view?Verdict: yes, with adjustments. The proposed interface holds up once versions become string refs instead of
uint, methods take acontext.Context, and pull gains version addressing. Full findings ininternal/remote/README.md.What this adds
A self-contained spike package,
internal/remote, alongside the existing code (nothing else is touched):remote.go— theRemoteinterface, credential types, and typed error sentinels (ErrNotAuthenticated,ErrUnauthorized,ErrForbidden,ErrNotFound,ErrConflict)oci.go—OCIRemote, wrappinginternal/oci/orasserver.go—ServerRemote, wrappinginternal/cliclientconformance_test.go— one shared lifecycle script: discover auth schemes, reject bad credentials, authenticate, push a new workspace, list, pull latest and by ref, push conflict, push v2, typed not-found errorsREADME.md— the exploration reportDemonstration
The same conformance script passes unmodified against both backends:
Key findings (details in the README)
internal/ocihas no typed errors; mapping works only because oras errors survive the%wchainsoci.ListRepositories/ListTagsnever setPlainHTTP, so they can't reach plain-HTTP registries at all (bug worth fixing independently)ErrNotFoundcan't be promised uniformlySupportedAuthenticationis discovery on the server but can only be configuration for OCI; OIDC device flow composes with the interface but can't live insideAuthenticationCredentialDeliberately out of scope: wiring into
cmd/nebior/remote/*handlers, nebi-repo filtering in OCIList, Quay token auth, asset transfer.