@VisibleForTesting
  Optional<Credential> retrieve(DockerConfig dockerConfig, Consumer<LogEvent> logger) {
    for (String registryAlias : RegistryAliasGroup.getAliasesGroup(registry)) {
      // First, find a credential helper from "credentialHelpers" and "credsStore" in order.
      DockerCredentialHelper dockerCredentialHelper =
          dockerConfig.getCredentialHelperFor(registryAlias);
      if (dockerCredentialHelper != null) {
        try {
          Path helperPath = dockerCredentialHelper.getCredentialHelper();
          logger.accept(LogEvent.info("trying " + helperPath + " for " + registryAlias));
          // Tries with the given registry alias (may be the original registry).
          return Optional.of(dockerCredentialHelper.retrieve());

        } catch (IOException
            | CredentialHelperUnhandledServerUrlException
            | CredentialHelperNotFoundException ex) {
          // Warns the user that the specified credential helper cannot be used.
          if (ex.getMessage() != null) {
            logger.accept(LogEvent.warn(ex.getMessage()));
            if (ex.getCause() != null && ex.getCause().getMessage() != null) {
              logger.accept(LogEvent.warn("  Caused by: " + ex.getCause().getMessage()));
            }
          }
        }
      }

      // Lastly, find defined auth.
      AuthTemplate auth = dockerConfig.getAuthFor(registryAlias);
      if (auth != null) {
        if (auth.getAuth() != null) {
          // 'auth' is a basic authentication token that should be parsed back into credentials
          String usernameColonPassword =
              new String(Base64.getDecoder().decode(auth.getAuth()), StandardCharsets.UTF_8);
          String username = usernameColonPassword.substring(0, usernameColonPassword.indexOf(":"));
          String password = usernameColonPassword.substring(usernameColonPassword.indexOf(":") + 1);
          logger.accept(
              LogEvent.info(
                  "Docker config auths section defines credentials for " + registryAlias));
          if (auth.getIdentityToken() != null
              // These username and password checks may be unnecessary, but doing so to restrict the
              // scope only to the Azure behavior to maintain maximum backward-compatibilty.
              && username.equals("00000000-0000-0000-0000-000000000000")
              && password.isEmpty()) {
            logger.accept(
                LogEvent.info("Using 'identityToken' in Docker config auth for " + registryAlias));
            return Optional.of(
                Credential.from(Credential.OAUTH2_TOKEN_USER_NAME, auth.getIdentityToken()));
          }
          return Optional.of(Credential.from(username, password));
        } else if (auth.getUsername() != null && auth.getPassword() != null) {
          logger.accept(
              LogEvent.info(
                  "Docker config auths section defines username and password for "
                      + registryAlias));
          return Optional.of(Credential.from(auth.getUsername(), auth.getPassword()));
        }
      }
    }
    return Optional.empty();
  }
Retrieves credentials for a registry alias from a {@link DockerConfig}.

@param dockerConfig the {@link DockerConfig} to retrieve from
@param logger a consumer for handling log events
@return the retrieved credentials, or {@code Optional#empty} if none are found
jib-core/src/main/java/com/google/cloud/tools/jib/registry/credentials/DockerConfigCredentialRetriever.java