container-registry: add secure registry infrastructure with TLS and auth

Add opt-in secure registry mode with auto-generated TLS certificates
and htpasswd authentication.

New BitBake variables:
  CONTAINER_REGISTRY_SECURE - Enable TLS (HTTPS) for local registry
  CONTAINER_REGISTRY_AUTH - Enable htpasswd auth (requires SECURE=1)
  CONTAINER_REGISTRY_USERNAME/PASSWORD - Credential configuration
  CONTAINER_REGISTRY_CERT_DAYS/CA_DAYS - Certificate validity
  CONTAINER_REGISTRY_CERT_SAN - Custom SAN entries

The bbclass validates conflicting settings (AUTH without SECURE) and
provides credential helper functions for skopeo push operations.

PKI infrastructure (CA + server cert with SAN) is auto-generated at
bitbake build time via openssl-native. The generated helper script
supports both TLS-only and TLS+auth modes.

The script now supports environment variable overrides for
CONTAINER_REGISTRY_STORAGE, CONTAINER_REGISTRY_URL, and
CONTAINER_REGISTRY_NAMESPACE, uses per-port PID files to allow
multiple instances, and auto-generates config files when running
from an overridden storage path.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 165 insertions, 1 deletions

diff --git a/classes/container-registry.bbclass b/classes/container-registry.bbclass
index b0a26365..30a95034 100644
--- a/classes/container-registry.bbclass
+++ b/classes/container-registry.bbclass
@@ -23,6 +23,8 @@
 #   CONTAINER_REGISTRY_TLS_VERIFY = "false"        # TLS verification
 #   CONTAINER_REGISTRY_TAG_STRATEGY = "timestamp latest"  # Tag generation
 #   CONTAINER_REGISTRY_STORAGE = "${TOPDIR}/container-registry"  # Persistent storage
+#   CONTAINER_REGISTRY_SECURE = "1"                # Enable TLS (HTTPS)
+#   CONTAINER_REGISTRY_AUTH = "1"                  # Enable htpasswd auth (requires SECURE=1)
 #
 # ===========================================================================
 
@@ -38,9 +40,153 @@ CONTAINER_REGISTRY_TAG_STRATEGY ?= "timestamp latest"
 #   CONTAINER_REGISTRY_STORAGE = "${TOPDIR}/../container-registry"
 CONTAINER_REGISTRY_STORAGE ?= "${TOPDIR}/container-registry"
 
+# Authentication configuration
+# Modes: "none" (default), "home", "authfile", "credsfile"
+#   none     - No authentication (local/anonymous registries)
+#   home     - Use ~/.docker/config.json (opt-in, like BB_USE_HOME_NPMRC)
+#   authfile - Explicit path to Docker-style config.json
+#   credsfile - Simple key=value credentials file
+CONTAINER_REGISTRY_AUTH_MODE ?= "none"
+
+# Path to Docker-style auth file (config.json format)
+# Used when AUTH_MODE = "authfile"
+CONTAINER_REGISTRY_AUTHFILE ?= ""
+
+# Path to simple credentials file (key=value format)
+# Used when AUTH_MODE = "credsfile"
+# File contains: CONTAINER_REGISTRY_USER + CONTAINER_REGISTRY_PASSWORD, or CONTAINER_REGISTRY_TOKEN
+CONTAINER_REGISTRY_CREDSFILE ?= ""
+
+# Insecure registry mode (HTTP, no TLS) - legacy compatibility
+CONTAINER_REGISTRY_INSECURE ?= "0"
+
+# Secure registry mode (opt-in)
+# When enabled, generates TLS certificates for HTTPS
+CONTAINER_REGISTRY_SECURE ?= "0"
+
+# Authentication mode (opt-in, requires SECURE=1)
+# When enabled, generates htpasswd credentials
+CONTAINER_REGISTRY_AUTH ?= "0"
+
+# Credentials for auth mode (password empty = auto-generate)
+CONTAINER_REGISTRY_USERNAME ?= "yocto"
+CONTAINER_REGISTRY_PASSWORD ?= ""
+
+# Certificate validity periods
+CONTAINER_REGISTRY_CERT_DAYS ?= "365"
+CONTAINER_REGISTRY_CA_DAYS ?= "3650"
+
+# Custom SAN entries (auto-includes localhost, 127.0.0.1, 10.0.2.2, registry host)
+CONTAINER_REGISTRY_CERT_SAN ?= ""
+
+# Path to CA certificate (auto-set in secure mode)
+CONTAINER_REGISTRY_CA_CERT ?= "${CONTAINER_REGISTRY_STORAGE}/pki/ca.crt"
+
 # Require skopeo-native for registry operations
 DEPENDS += "skopeo-native"
 
+# Validate conflicting settings at parse time
+python __anonymous() {
+    secure = d.getVar('CONTAINER_REGISTRY_SECURE') == '1'
+    insecure = d.getVar('CONTAINER_REGISTRY_INSECURE') == '1'
+    auth = d.getVar('CONTAINER_REGISTRY_AUTH') == '1'
+
+    if secure and insecure:
+        bb.fatal("CONTAINER_REGISTRY_SECURE and CONTAINER_REGISTRY_INSECURE cannot both be set to '1'. "
+                 "Use CONTAINER_REGISTRY_SECURE='1' for TLS, or CONTAINER_REGISTRY_INSECURE='1' for HTTP.")
+
+    if auth and not secure:
+        bb.warn("CONTAINER_REGISTRY_AUTH='1' requires CONTAINER_REGISTRY_SECURE='1'. "
+                "Authentication without TLS is insecure. Enabling SECURE mode automatically.")
+        d.setVar('CONTAINER_REGISTRY_SECURE', '1')
+}
+
+def _container_registry_parse_credsfile(filepath):
+    """Parse a simple key=value credentials file.
+
+    Returns dict with CONTAINER_REGISTRY_USER, CONTAINER_REGISTRY_PASSWORD,
+    and/or CONTAINER_REGISTRY_TOKEN.
+    """
+    creds = {}
+    with open(filepath, 'r') as f:
+        for line in f:
+            line = line.strip()
+            if not line or line.startswith('#'):
+                continue
+            if '=' in line:
+                key, value = line.split('=', 1)
+                key = key.strip()
+                value = value.strip()
+                # Remove quotes if present
+                if value.startswith('"') and value.endswith('"'):
+                    value = value[1:-1]
+                elif value.startswith("'") and value.endswith("'"):
+                    value = value[1:-1]
+                creds[key] = value
+    return creds
+
+def _container_registry_get_auth_args(d):
+    """Build skopeo authentication arguments based on auth mode."""
+    import os
+
+    auth_mode = d.getVar('CONTAINER_REGISTRY_AUTH_MODE') or 'none'
+    secure_mode = d.getVar('CONTAINER_REGISTRY_SECURE') == '1'
+
+    if auth_mode == 'none':
+        # In secure mode with no explicit auth, auto-use generated credentials
+        if secure_mode:
+            storage = d.getVar('CONTAINER_REGISTRY_STORAGE')
+            password_file = os.path.join(storage, 'auth', 'password')
+            if os.path.exists(password_file):
+                with open(password_file, 'r') as f:
+                    password = f.read().strip()
+                username = d.getVar('CONTAINER_REGISTRY_USERNAME') or 'yocto'
+                bb.note(f"Using auto-generated credentials for secure registry (user: {username})")
+                return ['--dest-creds', f'{username}:{password}']
+        return []
+
+    if auth_mode == 'home':
+        # Use ~/.docker/config.json (opt-in, like BB_USE_HOME_NPMRC)
+        home = os.environ.get('HOME', '')
+        authfile = os.path.join(home, '.docker', 'config.json')
+        if not os.path.exists(authfile):
+            bb.fatal(f"CONTAINER_REGISTRY_AUTH_MODE='home' but {authfile} not found. "
+                     f"Run 'docker login' or use 'authfile'/'credsfile' mode instead.")
+        bb.note(f"Using home Docker config for registry auth: {authfile}")
+        return ['--dest-authfile', authfile]
+
+    if auth_mode == 'authfile':
+        authfile = d.getVar('CONTAINER_REGISTRY_AUTHFILE')
+        if not authfile:
+            bb.fatal("CONTAINER_REGISTRY_AUTH_MODE='authfile' requires CONTAINER_REGISTRY_AUTHFILE")
+        if not os.path.exists(authfile):
+            bb.fatal(f"Auth file not found: {authfile}")
+        return ['--dest-authfile', authfile]
+
+    if auth_mode == 'credsfile':
+        credsfile = d.getVar('CONTAINER_REGISTRY_CREDSFILE')
+        if not credsfile:
+            bb.fatal("CONTAINER_REGISTRY_AUTH_MODE='credsfile' requires CONTAINER_REGISTRY_CREDSFILE")
+        if not os.path.exists(credsfile):
+            bb.fatal(f"Credentials file not found: {credsfile}")
+
+        creds = _container_registry_parse_credsfile(credsfile)
+
+        # Token takes precedence
+        if 'CONTAINER_REGISTRY_TOKEN' in creds:
+            return ['--dest-registry-token', creds['CONTAINER_REGISTRY_TOKEN']]
+
+        username = creds.get('CONTAINER_REGISTRY_USER')
+        password = creds.get('CONTAINER_REGISTRY_PASSWORD')
+        if username and password:
+            return ['--dest-creds', f'{username}:{password}']
+
+        bb.fatal("Credentials file must contain CONTAINER_REGISTRY_TOKEN or both "
+                 "CONTAINER_REGISTRY_USER and CONTAINER_REGISTRY_PASSWORD")
+
+    bb.fatal(f"Unknown CONTAINER_REGISTRY_AUTH_MODE: {auth_mode} "
+             "(use 'none', 'home', 'authfile', or 'credsfile')")
+
 def container_registry_generate_tags(d, image_name):
     """Generate tags based on CONTAINER_REGISTRY_TAG_STRATEGY.
 
@@ -159,12 +305,30 @@ def container_registry_push(d, oci_path, image_name, tags=None):
     pushed = []
     src = f"oci:{oci_path}"
 
+    secure_mode = d.getVar('CONTAINER_REGISTRY_SECURE') == '1'
+    storage = d.getVar('CONTAINER_REGISTRY_STORAGE')
+
     for tag in tags:
         dest = f"docker://{registry}/{namespace}/{image_name}:{tag}"
 
         cmd = [skopeo, 'copy']
-        if tls_verify == 'false':
+
+        # TLS handling: secure mode uses CA cert, insecure mode disables verification
+        if secure_mode:
+            pki_dir = os.path.join(storage, 'pki')
+            if os.path.exists(os.path.join(pki_dir, 'ca.crt')):
+                cmd.extend(['--dest-cert-dir', pki_dir])
+            else:
+                bb.warn(f"Secure mode enabled but CA cert not found at {pki_dir}/ca.crt")
+                bb.warn("Run 'container-registry.sh start' to generate PKI infrastructure")
+                cmd.append('--dest-tls-verify=false')
+        elif tls_verify == 'false':
             cmd.append('--dest-tls-verify=false')
+
+        # Add authentication arguments if configured
+        auth_args = _container_registry_get_auth_args(d)
+        cmd.extend(auth_args)
+
         cmd.extend([src, dest])
 
         bb.note(f"Pushing {image_name}:{tag} to {registry}/{namespace}/")