Download GGUF, package as Docker Model and push it to Hub (docker#87)

* Use username + pass auth if DOCKER_USERNAME & DOCKER_PASSWORD are defined

* Added GHA to package and push a model

* Install certs

* Don't initialize client twice

Author: ilopezluna

pkg/distribution/distribution/client.go

@@ -36,6 +36,8 @@ type options struct {
 	logger        *logrus.Entry
 	transport     http.RoundTripper
 	userAgent     string
+	username      string
+	password      string
 }
 
 // WithStoreRootPath sets the store root path
@@ -74,6 +76,16 @@ func WithUserAgent(ua string) Option {
 	}
 }
 
+// WithRegistryAuth sets the registry authentication credentials
+func WithRegistryAuth(username, password string) Option {
+	return func(o *options) {
+		if username != "" && password != "" {
+			o.username = username
+			o.password = password
+		}
+	}
+}
+
 func defaultOptions() *options {
 	return &options{
 		logger:    logrus.NewEntry(logrus.StandardLogger()),
@@ -100,14 +112,22 @@ func NewClient(opts ...Option) (*Client, error) {
 		return nil, fmt.Errorf("initializing store: %w", err)
 	}
 
+	// Create registry client options
+	registryOpts := []registry.ClientOption{
+		registry.WithTransport(options.transport),
+		registry.WithUserAgent(options.userAgent),
+	}
+
+	// Add auth if credentials are provided
+	if options.username != "" && options.password != "" {
+		registryOpts = append(registryOpts, registry.WithAuthConfig(options.username, options.password))
+	}
+
 	options.logger.Infoln("Successfully initialized store")
 	return &Client{
-		store: s,
-		log:   options.logger,
-		registry: registry.NewClient(
-			registry.WithTransport(options.transport),
-			registry.WithUserAgent(options.userAgent),
-		),
+		store:    s,
+		log:      options.logger,
+		registry: registry.NewClient(registryOpts...),
 	}, nil
 }
 

pkg/distribution/registry/client.go

@@ -26,6 +26,7 @@ type Client struct {
 	transport http.RoundTripper
 	userAgent string
 	keychain  authn.Keychain
+	auth      authn.Authenticator
 }
 
 type ClientOption func(*Client)
@@ -46,6 +47,17 @@ func WithUserAgent(userAgent string) ClientOption {
 	}
 }
 
+func WithAuthConfig(username, password string) ClientOption {
+	return func(c *Client) {
+		if username != "" && password != "" {
+			c.auth = &authn.Basic{
+				Username: username,
+				Password: password,
+			}
+		}
+	}
+}
+
 func NewClient(opts ...ClientOption) *Client {
 	client := &Client{
 		transport: remote.DefaultTransport,
@@ -65,13 +77,22 @@ func (c *Client) Model(ctx context.Context, reference string) (types.ModelArtifa
 		return nil, NewReferenceError(reference, err)
 	}
 
-	// Return the artifact at the given reference
-	remoteImg, err := remote.Image(ref,
+	// Set up authentication options
+	authOpts := []remote.Option{
 		remote.WithContext(ctx),
-		remote.WithAuthFromKeychain(c.keychain),
 		remote.WithTransport(c.transport),
 		remote.WithUserAgent(c.userAgent),
-	)
+	}
+
+	// Use direct auth if provided, otherwise fall back to keychain
+	if c.auth != nil {
+		authOpts = append(authOpts, remote.WithAuth(c.auth))
+	} else {
+		authOpts = append(authOpts, remote.WithAuthFromKeychain(c.keychain))
+	}
+
+	// Return the artifact at the given reference
+	remoteImg, err := remote.Image(ref, authOpts...)
 	if err != nil {
 		errStr := err.Error()
 		if strings.Contains(errStr, "UNAUTHORIZED") {
@@ -93,6 +114,7 @@ type Target struct {
 	transport http.RoundTripper
 	userAgent string
 	keychain  authn.Keychain
+	auth      authn.Authenticator
 }
 
 func (c *Client) NewTarget(tag string) (*Target, error) {
@@ -105,20 +127,30 @@ func (c *Client) NewTarget(tag string) (*Target, error) {
 		transport: c.transport,
 		userAgent: c.userAgent,
 		keychain:  c.keychain,
+		auth:      c.auth,
 	}, nil
 }
 
 func (t *Target) Write(ctx context.Context, model types.ModelArtifact, progressWriter io.Writer) error {
 	pr := progress.NewProgressReporter(progressWriter, progress.PushMsg, nil)
 	defer pr.Wait()
 
-	if err := remote.Write(t.reference, model,
+	// Set up authentication options
+	authOpts := []remote.Option{
 		remote.WithContext(ctx),
-		remote.WithAuthFromKeychain(t.keychain),
 		remote.WithTransport(t.transport),
 		remote.WithUserAgent(t.userAgent),
 		remote.WithProgress(pr.Updates()),
-	); err != nil {
+	}
+
+	// Use direct auth if provided, otherwise fall back to keychain
+	if t.auth != nil {
+		authOpts = append(authOpts, remote.WithAuth(t.auth))
+	} else {
+		authOpts = append(authOpts, remote.WithAuthFromKeychain(t.keychain))
+	}
+
+	if err := remote.Write(t.reference, model, authOpts...); err != nil {
 		return fmt.Errorf("write to registry %q: %w", t.reference.String(), err)
 	}
 	return nil