Function readSecretFromStdin

cli/command/registry/login.go:104–122

readSecretFromStdin reads the secret from r and returns it as a string. It trims terminal line-endings (LF, CRLF, or CR), which may be added when inputting interactively or piping input. The value is otherwise treated as opaque, preserving any other whitespace, including newlines, per [NIST SP 800-6

(r io.Reader)

// [NIST SP 800-63B §5.1.1.2]: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver
// [NIST SP 800-63B (revision 4) §3.1.1.2]: https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver
func readSecretFromStdin(r io.Reader) (string, error) {
	b, err := io.ReadAll(r)
	if err != nil {
		return "", err
	}
	if len(b) == 0 {
		return "", nil
	}

	for _, eol := range [][]byte{[]byte("\r\n"), []byte("\n"), []byte("\r")} {
		var ok bool
		b, ok = bytes.CutSuffix(b, eol)
		if ok {
			break
		}
	}

	return string(b), nil
}

func verifyLoginOptions(dockerCLI command.Streams, opts *loginOptions) error {
	if opts.password == "-" {