upload-oscontainer: Require ~/.docker/config.json or REGISTRY_AUTH_FILE
It's an annoying UX trap to leave unset because we do the
build only to fail to push.
Also drop the conditional for the uid - this code should *not*
be run as root ever.  (And if it is, then `sudo` is usually harmless)
@@ -78,9 +78,12 @@ osc_name_and_tag = "{}:{}".format(args.name, latest_build)
# every time we want to poll.
# TODO: Remove --from
digestfile = "tmp/oscontainer-digest"
-cosa_argv = []
-if os.getuid != 0:
- cosa_argv.extend(['sudo', '--preserve-env=container,REGISTRY_AUTH_FILE'])
+# We need to pass the auth file from the unpriv user to the root process
+cosa_argv = ['sudo', '--preserve-env=container,REGISTRY_AUTH_FILE']
+authfile = os.environ.get("REGISTRY_AUTH_FILE", os.path.expanduser('~/.docker/config.json'))
+if not os.path.isfile(authfile):
+ raise SystemExit(f"Missing {authfile}")
+os.environ['REGISTRY_AUTH_FILE'] = authfile
cosa_argv.extend(['/usr/lib/coreos-assembler/oscontainer.py', '--workdir=./tmp', 'build', f"--from={args.from_image}"])
for d in args.add_directory:
cosa_argv.append(f"--add-directory={d}")
