{"record":{"id":"956b0635ea9c4b0f","repo":"docker/cli","slug":"something-went-wrong-decoding-auth-config","errorCode":null,"errorMessage":"something went wrong decoding auth config","messagePattern":"something went wrong decoding auth config","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/config/configfile/file.go","lineNumber":310,"sourceCode":"\tbase64.StdEncoding.Encode(encoded, msg)\n\treturn string(encoded)\n}\n\n// decodeAuth decodes a base64 encoded string and returns username and password\nfunc decodeAuth(authStr string) (string, string, error) {\n\tif authStr == \"\" {\n\t\treturn \"\", \"\", nil\n\t}\n\n\tdecLen := base64.StdEncoding.DecodedLen(len(authStr))\n\tdecoded := make([]byte, decLen)\n\tauthByte := []byte(authStr)\n\tn, err := base64.StdEncoding.Decode(decoded, authByte)\n\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\tif n > decLen {\n\t\treturn \"\", \"\", errors.New(\"something went wrong decoding auth config\")\n\t}\n\tuserName, password, ok := strings.Cut(string(decoded), \":\")\n\tif !ok || userName == \"\" {\n\t\treturn \"\", \"\", errors.New(\"invalid auth configuration file\")\n\t}\n\treturn userName, strings.Trim(password, \"\\x00\"), nil\n}\n\n// GetCredentialsStore returns a new credentials store from the settings in the\n// configuration file\nfunc (c *ConfigFile) GetCredentialsStore(registryHostname string) credentials.Store {\n\tstore := credentials.NewFileStore(c)\n\n\tif helper := getConfiguredCredentialStore(c, getAuthConfigKey(registryHostname)); helper != \"\" {\n\t\tstore = newNativeStore(c, helper)\n\t}\n\n\tenvConfig := os.Getenv(DockerEnvConfigKey)","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/config/configfile/file.go#L292-L328","documentation":"Returned by decodeAuth as a defensive guard: after base64-decoding the auth string, if the number of decoded bytes exceeds the precomputed DecodedLen, something is inconsistent. In practice Go's base64 decoder cannot return more bytes than the computed length, so this branch is effectively unreachable for well-formed input and indicates memory/length bookkeeping corruption.","triggerScenarios":"Calling decodeAuth with a base64 string. The branch is a sanity assertion; it is not expected to fire under normal control flow. It could only appear alongside a base64 implementation bug or tampered buffers.","commonSituations":"Almost never seen in the wild. If reported, it usually points to a corrupted ~/.docker/config.json where the 'auth' field was hand-edited or truncated, or a custom credential helper returning malformed data.","solutions":["Log out and back in ('docker logout <registry>' then 'docker login') to regenerate the auth entry cleanly.","Inspect ~/.docker/config.json and replace any malformed base64 'auth' values for the affected registry.","If using a credential helper, verify it returns a standard base64 of 'username:password'."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"user, pass, err := decodeAuth(authStr)\nif err != nil {\n    // Treat as corrupt credential entry; prompt re-login rather than crashing.\n    log.Printf(\"auth decode failed for entry, will attempt re-login: %v\", err)\n    return relogin()\n}","preventionTips":["Regenerate auth entries with 'docker login' instead of hand-editing config.json.","Never truncate the base64 'auth' field.","Validate credential-helper output is standard base64 of 'user:pass'."],"tags":["config","auth","config-json","base64"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}