Add authentication support for Amazon ECR

pom.xml

@@ -129,12 +129,12 @@
     <dependency>
       <groupId>org.apache.httpcomponents</groupId>
       <artifactId>httpclient</artifactId>
-      <version>4.5</version>
+      <version>4.5.5</version>
     </dependency>
     <dependency>
       <groupId>org.apache.httpcomponents</groupId>
       <artifactId>httpcore</artifactId>
-      <version>4.4.5</version>
+      <version>4.4.9</version>
     </dependency>
     <dependency>
       <groupId>com.github.jnr</groupId>
@@ -169,6 +169,7 @@
       <version>3.0.1</version>
       <scope>provided</scope>
     </dependency>
+
     <!-- TODO we should pull out the Google Cloud support to a new library -->
     <dependency>
       <groupId>com.google.auth</groupId>
@@ -183,6 +184,20 @@
       </exclusions>
     </dependency>
 
+    <!-- TODO we should pull out the Amazon Cloud support to a new library -->
+    <dependency>
+      <groupId>com.amazonaws</groupId>
+      <artifactId>aws-java-sdk-ecr</artifactId>
+      <version>1.11.313</version>
+      <optional>true</optional>
+      <exclusions>
+        <exclusion>
+          <groupId>software.amazon.ion</groupId>
+          <artifactId>ion-java</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+
     <!--test deps-->
     <dependency>
       <groupId>junit</groupId>

src/main/java/com/spotify/docker/client/auth/ecr/Authenticator.java

@@ -0,0 +1,95 @@
+/*-
+ * -\-\-
+ * docker-client
+ * --
+ * Copyright (C) 2016 - 2017 Spotify AB
+ * --
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * -/-/-
+ */
+
+package com.spotify.docker.client.auth.ecr;
+
+import com.spotify.docker.client.exceptions.DockerException;
+import com.spotify.docker.client.messages.RegistryAuth;
+
+import java.util.Objects;
+
+public interface Authenticator extends AutoCloseable {
+  public static interface Factory {
+    public Authenticator getAuthenticator();
+  }
+
+  public static class Authentication {
+    public final String username;
+    public final String password;
+    public final String registry;
+    public final long expiration;
+    public final boolean def;
+
+    public Authentication(
+        String username,
+        String password,
+        String registry,
+        long expiration,
+        boolean def) {
+      this.username   = username;
+      this.password   = password;
+      this.registry   = registry;
+      this.expiration = expiration;
+      this.def        = def;
+    }
+
+    public RegistryAuth toRegistryAuth() {
+      return RegistryAuth.builder()
+        .username(username)
+        .password(password)
+        .serverAddress(registry)
+        .build();
+    }
+
+    public int hashCode() {
+      return Objects.hash(
+        username,
+        password,
+        registry,
+        expiration,
+        def);
+    }
+
+    public boolean equals(Object other) {
+      boolean result;
+      if (this == other) {
+        result = true;
+      } else
+        if (other == null) {
+          result = false;
+        } else
+          if (other instanceof Authentication) {
+            Authentication that = (Authentication) other;
+            result = Objects.equals(username, that.username)
+              && Objects.equals(password, password)
+              && Objects.equals(registry, that.registry)
+              && expiration == that.expiration
+              && def == that.def;
+          } else { 
+            result = false;
+          }
+      return result;
+    }
+  }
+
+  public Authentication authenticate(String registry) throws DockerException;
+
+  public void close() throws DockerException;
+}

src/main/java/com/spotify/docker/client/auth/ecr/EcrAuthenticator.java

@@ -0,0 +1,92 @@
+/*-
+ * -\-\-
+ * docker-client
+ * --
+ * Copyright (C) 2016 - 2017 Spotify AB
+ * --
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * -/-/-
+ */
+
+package com.spotify.docker.client.auth.ecr;
+
+import com.amazonaws.services.ecr.AmazonECR;
+import com.amazonaws.services.ecr.model.AuthorizationData;
+import com.amazonaws.services.ecr.model.GetAuthorizationTokenRequest;
+import com.amazonaws.services.ecr.model.GetAuthorizationTokenResult;
+import com.amazonaws.util.Base64;
+import com.spotify.docker.client.exceptions.DockerException;
+
+import java.nio.charset.StandardCharsets;
+
+public class EcrAuthenticator implements Authenticator {
+  private final AmazonECR client;
+
+  public EcrAuthenticator(AmazonECR client) {
+    this.client = client;
+  }
+
+  @Override
+  public Authentication authenticate(String registry) throws DockerException {
+    GetAuthorizationTokenRequest request = new GetAuthorizationTokenRequest();
+    if (registry != null) {
+      request = request.withRegistryIds(registry);
+    }
+
+    AuthorizationData authorization;
+    try {
+      GetAuthorizationTokenResult response = client.getAuthorizationToken(request);
+      authorization = response.getAuthorizationData().get(0);
+    } catch (Exception e) { 
+      throw new DockerException("Failed to retrieve ECR credentials", e);
+    }
+
+    String auth = new String(
+        Base64.decode(authorization.getAuthorizationToken()),
+        StandardCharsets.UTF_8);
+    String[] authParts = auth.split(":", 2);
+    if (authParts.length < 2) {
+      // Never put credentials -- even encoded credentials -- in an Exception message.
+      throw new DockerException("Failed to parse ECR credentials");
+    }
+
+    String username = authParts[0];
+    String password = authParts[1];
+
+    String newregistry;
+    String endpoint = authorization.getProxyEndpoint();
+    if (endpoint.startsWith("https://")) {
+      newregistry = endpoint.substring("https://".length(), endpoint.length());
+    } else {
+      throw new DockerException("Failed to parse ECR endpoint: " + endpoint);
+    }
+
+    long expiration;
+    if (authorization.getExpiresAt() != null) {
+      expiration = authorization.getExpiresAt().getTime();
+    } else {
+      expiration =  -1L;
+    }
+
+    return new Authentication(username, password, newregistry, expiration, registry == null);
+  }
+
+  @Override
+  public void close() throws DockerException {
+    getClient().shutdown();
+  }
+
+  public AmazonECR getClient() {
+    return client;
+  }
+}

src/main/java/com/spotify/docker/client/auth/ecr/EcrAuthenticatorFactory.java

@@ -0,0 +1,43 @@
+/*-
+ * -\-\-
+ * docker-client
+ * --
+ * Copyright (C) 2016 - 2017 Spotify AB
+ * --
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * -/-/-
+ */
+
+package com.spotify.docker.client.auth.ecr;
+
+import com.amazonaws.auth.AWSCredentialsProvider;
+import com.amazonaws.services.ecr.AmazonECRClient;
+
+public class EcrAuthenticatorFactory implements Authenticator.Factory {
+  private final AWSCredentialsProvider provider;
+
+  public EcrAuthenticatorFactory(AWSCredentialsProvider provider) {
+    this.provider = provider;
+  }
+
+  @Override
+  public Authenticator getAuthenticator() {
+    return new EcrAuthenticator(AmazonECRClient.builder()
+      .withCredentials(getProvider())
+      .build());
+  }
+
+  private AWSCredentialsProvider getProvider() {
+    return provider;
+  }
+}