[cloudsmith-iduffy]

Description

If you are logged out, or your SAML token has expired, docker pull of a public image from a Cloudsmith registry fails at the credential step:

$ docker pull docker.cloudsmith.io/acme/public/alpine:latest
Error: Unable to retrieve credentials. Provide credentials via the CLOUDSMITH_API_KEY environment variable, ...
error getting credentials - err: exit status 1, out: ``

The cause is the stdout of docker-credential-cloudsmith get. When no credential resolves, it exits 1 with nothing on stdout. Docker reads a helper's stdout and treats only credentials not found in native keychain as "no credential for this host". Any other output, including empty output, is a hard error. Docker then stops before it tries an anonymous pull. See errCredentialsNotFoundMessage in credentials/error.go and Get in client/client.go of docker/docker-credential-helpers.

With this change, the helper writes that exact string on stdout and exits 1. The guidance message stays on stderr. Docker continues without credentials:

$ docker pull docker.cloudsmith.io/acme/public/alpine:latest
Error: Unable to retrieve credentials. Provide credentials via the CLOUDSMITH_API_KEY environment variable, ...
Cannot connect to the Docker daemon at tcp://127.0.0.1:1. Is the docker daemon running?

(That run uses a temporary HOME and DOCKER_HOST=tcp://127.0.0.1:1, so the daemon error shows that Docker got past the credential step. Docker client 29.8.2.)

An empty or whitespace-only server URL on stdin now gives the protocol's no credentials server URL on stdout, not empty output. I also added type hints to _execute_get.

I checked the other actions. store and erase exit 0, and list prints {}. Docker accepts all of these, so I left them as they are. An unexpected exception inside get still exits 1 with empty stdout, so Docker reports a hard error. A real failure must not look like "no credential".

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

What changes for users and scripts:

• docker-credential-cloudsmith get (and cloudsmith credential-helper docker) now prints credentials not found in native keychain on stdout when it has no credential. A script that expects empty stdout on failure sees this line. The exit code stays 1.
• A pull from a private repository without a credential now fails with the 401 error of the registry, not with error getting credentials. This message tells the user less about the cause. To help, Docker connects the helper's stderr to its own stderr (ec.Stderr = os.Stderr in client/command.go), so the "Unable to retrieve credentials" guidance still shows in the terminal.
• A public pull without a credential now works, and the same guidance line shows on stderr.

Tests: I updated the protocol tests in cloudsmith_cli/cli/tests/commands/test_credential_helper.py for the not-found and blank-URL cases. The full unit suite passes.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused changes match Docker’s credential-helper protocol, preserve unexpected-error handling, and include corresponding test assertions.

No open issues 🎉

What changed in this PR

This PR fixes Docker credential-helper responses so missing credentials do not prevent anonymous pulls from public Cloudsmith registries.

Changes:

• Return Docker’s exact protocol messages for missing credentials and blank server URLs.
• Update protocol tests to assert the new stdout responses.
• Document the behavior change while retaining stderr guidance and exit codes.

File	Description
cloudsmith_cli/​credential_helpers/​docker/​runtime.py	Add protocol error strings and type hints for _execute_get.
cloudsmith_cli/​cli/​tests/​commands/​test_credential_helper.py	Update assertions for missing credentials and whitespace-only input.
CHANGELOG.md	Describe anonymous-pull support and private-repository failure behavior.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Docker credential-helper protocol error update.

No open issues 🎉

_{Review effort: Balanced}