If you host your registry on a remote URL you currently cannot do authentication against it. The ocx command does not support passing any authentication. Some basic support for headers exists, but is not wired into the requests themselves.
Should:
- Allow basic auth
- Allow token auth
- Be able to load auth from registry itself, from command line, literal, env variable, or a file
- Add https checking + --insecure-skip-tls-verify
- Literal credentials are allowed anywhere, but env/file credentials are only allowed in global registry, not local per project registries (otherwise if attacker makes you clone a repo with a registry that contains a common variable, they would force you to send the variable to their server)
- If you add a registry with credentials, they are saved into the ocx.json file in the same form as you added them
Example commands:
`
ocx registry add --name acme http://registry.acme.com -g --auth-basic "admin:secret"
ocx registry add --name acme http://registry.acme.com -g --auth-token "sk-sdfklj"
`
Willing to do a PR
If you host your registry on a remote URL you currently cannot do authentication against it. The ocx command does not support passing any authentication. Some basic support for headers exists, but is not wired into the requests themselves.
Should:
Example commands:
`
ocx registry add --name acme http://registry.acme.com -g --auth-basic "admin:secret"
ocx registry add --name acme http://registry.acme.com -g --auth-token "sk-sdfklj"
`
Willing to do a PR