implement auth

Signed-off-by: Jason Hall <jason@chainguard.dev>

tests/testdata/auth_base64.txt

@@ -0,0 +1,34 @@
+# Test base64 encoded auth from Docker config
+
+# Create a test project
+-- Cargo.toml --
+[package]
+name = "auth-b64-test"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+-- src/main.rs --
+fn main() {
+    println!("Testing base64 auth");
+}
+
+# Create Docker config with base64 auth (testuser:testpass = dGVzdHVzZXI6dGVzdHBhc3M=)
+mkdir .docker
+-- .docker/config.json --
+{
+  "auths": {
+    "ghcr.io": {
+      "auth": "dGVzdHVzZXI6dGVzdHBhc3M="
+    }
+  }
+}
+
+# Set HOME to use our config
+env HOME=$WORK
+env RUST_LOG=debug
+
+# Try to build (will fail at registry, but auth should be resolved)
+! exec ./krust build --platform linux/amd64 --image ghcr.io/user/app:latest .
+stderr 'Resolving auth'
+stderr 'ghcr.io'

tests/testdata/auth_credential_helper.txt

@@ -0,0 +1,62 @@
+# Test credential helper execution
+
+# Create a mock credential helper that logs when it's called
+-- docker-credential-mock --
+#!/bin/sh
+# Mock credential helper that logs execution and returns test credentials
+
+# Log that we were called
+echo "MOCK_HELPER_CALLED" >&2
+
+case "$1" in
+  get)
+    # Read registry from stdin
+    read registry
+    echo "MOCK_HELPER_REGISTRY=$registry" >&2
+
+    # Return credentials
+    cat <<EOF
+{
+  "Username": "helper-user",
+  "Secret": "helper-pass"
+}
+EOF
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+-- Cargo.toml --
+[package]
+name = "cred-helper-test"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+-- src/main.rs --
+fn main() {
+    println!("Testing credential helper");
+}
+
+# Make the helper executable
+chmod +x docker-credential-mock
+
+# Create Docker config that uses our mock helper
+mkdir .docker
+-- .docker/config.json --
+{
+  "credHelpers": {
+    "mock.registry.io": "mock"
+  }
+}
+
+# Add current dir to PATH and set HOME
+env HOME=$WORK
+env PATH=$WORK:$PATH
+env RUST_LOG=debug
+
+# Try to push to mock.registry.io (will fail at network level, but should call helper)
+# Using --no-push to avoid actual network call
+! exec ./krust build --platform linux/amd64 --image mock.registry.io/test:latest .
+# Should see the helper being attempted
+stderr 'credential helper'

tests/testdata/auth_docker_config_basic.txt

@@ -0,0 +1,36 @@
+# Test basic auth from Docker config
+
+# Create a test project
+-- Cargo.toml --
+[package]
+name = "auth-basic-test"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+-- src/main.rs --
+fn main() {
+    println!("Testing basic auth");
+}
+
+# Create Docker config with username/password
+mkdir .docker
+-- .docker/config.json --
+{
+  "auths": {
+    "test.example.com": {
+      "username": "myuser",
+      "password": "mypass"
+    }
+  }
+}
+
+# Set HOME to use our config
+env HOME=$WORK
+env RUST_LOG=debug
+
+# Try to build and push (will fail at registry level, but auth should be resolved)
+# We can verify auth was read from config in debug logs
+! exec ./krust build --platform linux/amd64 --image test.example.com/app:latest .
+stderr 'Resolving auth'
+stderr 'test.example.com'