From e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b Mon Sep 17 00:00:00 2001
From: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:49:13 +0200
Subject: [PATCH] fix(registry): use the https://dhi.io credentials key

Docker Desktop stores Docker Hardened Images credentials under https://dhi.io, so return that as the server address of dhi.io credentials, as StagingIndexServer does for the staging registry.

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
---
 internal/registry/desktop.go      | 2 +-
 internal/registry/desktop_test.go | 4 ++--
 internal/registry/registry.go     | 2 ++
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/internal/registry/desktop.go b/internal/registry/desktop.go
index 718d08da8..043e67528 100644
--- a/internal/registry/desktop.go
+++ b/internal/registry/desktop.go
@@ -104,7 +104,7 @@ func (p *desktopAuthProvider) GetAuthConfig(registryHostname string) (clitypes.A
 	if session := p.sessionFor(registryHostname); session != nil {
 		if auth, ok := session.auth(); ok {
 			if registryHost(registryHostname) == DHIRegistryHost {
-				auth.ServerAddress = DHIRegistryHost
+				auth.ServerAddress = DHIIndexServer
 			}
 			return auth, nil
 		}
diff --git a/internal/registry/desktop_test.go b/internal/registry/desktop_test.go
index 5a4b39d8d..40c0c083f 100644
--- a/internal/registry/desktop_test.go
+++ b/internal/registry/desktop_test.go
@@ -214,14 +214,14 @@ func TestDesktopAuthProvider_OtherRegistriesUseFallback(t *testing.T) {
 }
 
 func TestDesktopAuthProvider_DHIUsesDockerHubSession(t *testing.T) {
-	for _, host := range []string{DHIRegistryHost, "https://" + DHIRegistryHost, "https://" + DHIRegistryHost + "/"} {
+	for _, host := range []string{DHIRegistryHost, DHIIndexServer, DHIIndexServer + "/"} {
 		t.Run(host, func(t *testing.T) {
 			hub := &fakeHub{session: hubSession("hubuser", testNow.Add(time.Hour))}
 			p := newTestProvider(hub, nil)
 			p.signInToStaging()
 
 			want := desktopCredentials()
-			want.ServerAddress = DHIRegistryHost
+			want.ServerAddress = DHIIndexServer
 			got, err := p.GetAuthConfig(host)
 			assert.NilError(t, err)
 			assert.DeepEqual(t, got, want)
diff --git a/internal/registry/registry.go b/internal/registry/registry.go
index 079e857c2..cccd7a565 100644
--- a/internal/registry/registry.go
+++ b/internal/registry/registry.go
@@ -45,6 +45,8 @@ const (
 	StagingIndexServer = "https://" + StagingRegistryHost + "/"
 	// DHIRegistryHost is the Docker Hardened Images registry.
 	DHIRegistryHost = "dhi.io"
+	// DHIIndexServer is the credentials key for DHIRegistryHost.
+	DHIIndexServer = "https://" + DHIRegistryHost
 )
 
 // GetAuthConfigKey special-cases using the full index address of the official