Fix auth by wrapping keychain in a ResolvedKeychain

Prior to #1315, all keychains passed to NewMultiKeychain were resolved keychains, which prevented the credentials from becoming inaccessible after the lifecycle dropped privileges. Signed-off-by: Natalie Arellano <[email protected]>
buildpacks · Apr 10, 2024 · 2670257 · 2670257
1 parent 137225b
commit 2670257
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/auth/keychain.go b/auth/keychain.go
@@ -38,13 +38,15 @@ func DefaultKeychain(images ...string) (authn.Keychain, error) {
 		return nil, err
 	}
 
-	keychains := []authn.Keychain{envKeychain, authn.DefaultKeychain}
-
+	keychains := []authn.Keychain{
+		envKeychain,
+		NewResolvedKeychain(authn.DefaultKeychain, images...),
+	}
 	if vendorKeychainEnabled("amazon") {
-		keychains = append(keychains, amazonKeychain)
+		keychains = append(keychains, NewResolvedKeychain(amazonKeychain, images...))
 	}
 	if vendorKeychainEnabled("azure") {
-		keychains = append(keychains, azureKeychain)
+		keychains = append(keychains, NewResolvedKeychain(azureKeychain, images...))
 	}
 
 	return authn.NewMultiKeychain(