Fixes docker#333 Handle parallel calls to add with osxkeychain

When `docker login` is called in parallel, some of the calls fail with the
error `The specified item already exists in the keychain`.

This PR checks for this specific error in `osxkeychain.Add` and returns
ok. If one process loses the race in this case, the desired credentials
were saved by another process and we can ignore the error.

Signed-off-by: Justin Randell <[email protected]>

osxkeychain/osxkeychain.go

@@ -24,6 +24,10 @@ import (
 // when the credentials are not in the keychain.
 const errCredentialsNotFound = "The specified item could not be found in the keychain."
 
+// errCredentialsAlreadyExist is the specific error message returned by OS X
+// when the credentials are already in the keychain.
+const errCredentialsAlreadyExist = "The specified item already exists in the keychain."
+
 // errCredentialsNotFound is the specific error message returned by OS X
 // when environment does not allow showing dialog to unlock keychain.
 const errInteractionNotAllowed = "User interaction is not allowed."
@@ -54,7 +58,16 @@ func (h Osxkeychain) Add(creds *credentials.Credentials) error {
 	errMsg := C.keychain_add(s, label, username, secret)
 	if errMsg != nil {
 		defer C.free(unsafe.Pointer(errMsg))
-		return errors.New(C.GoString(errMsg))
+		switch goMsg := C.GoString(errMsg); goMsg {
+		case errCredentialsAlreadyExist:
+			// If docker login is called in parallel, we may try to
+			// save the same credentials twice. In that case, return
+			// ok, because although we lost the race, the desired
+			// credentials were saved by another process.
+			return nil
+		default:
+			return errors.New(goMsg)
+		}
 	}
 
 	return nil