Repository: containers/image
Pull request #1114 (2021-01-08 23:55:37)

Update $HOME-dependant tests for c/storage, and c/storage itself
This:
- Finally fixes pkg/docker/config tests on non-Linux systems like macOS, after a long time
- Modifies various tests not to assume that changing $HOME changes the value of `homedir.Get()`, mostly by splitting the tested code into a wrapper+internal helper, and testing only the internal helper with an explicit home directory parameter
- Afterwards, updates c/storage like #1113 to a recent version, where `pkg/homedir` only evaluates $HOME once.

i.e. this updates c/storage like #1113 without breaking tests.


Patch:
diff --git a/docker/lookaside.go b/docker/lookaside.go
index 06d616d0..84a0fa4e 100644
--- a/docker/lookaside.go
+++ b/docker/lookaside.go
@@ -96,10 +96,16 @@ func SignatureStorageBaseURL(sys *types.SystemContext, ref types.ImageReference,
 
 // registriesDirPath returns a path to registries.d
 func registriesDirPath(sys *types.SystemContext) string {
+	return registriesDirPathWithHomeDir(sys, homedir.Get())
+}
+
+// registriesDirPathWithHomeDir is an internal implementation detail of registriesDirPath,
+// it exists only to allow testing it with an artificial home directory.
+func registriesDirPathWithHomeDir(sys *types.SystemContext, homeDir string) string {
 	if sys != nil && sys.RegistriesDirPath != "" {
 		return sys.RegistriesDirPath
 	}
-	userRegistriesDirPath := filepath.Join(homedir.Get(), userRegistriesDir)
+	userRegistriesDirPath := filepath.Join(homeDir, userRegistriesDir)
 	if _, err := os.Stat(userRegistriesDirPath); err == nil {
 		return userRegistriesDirPath
 	}
diff --git a/go.mod b/go.mod
index 03cc6b60..74c35486 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/BurntSushi/toml v0.3.1
 	github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b
 	github.com/containers/ocicrypt v1.0.3
-	github.com/containers/storage v1.23.7
+	github.com/containers/storage v1.24.5
 	github.com/docker/distribution v2.7.1+incompatible
 	github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
 	github.com/docker/docker-credential-helpers v0.6.3
@@ -18,7 +18,7 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/gorilla/mux v1.7.4 // indirect
 	github.com/imdario/mergo v0.3.11
-	github.com/klauspost/compress v1.11.3
+	github.com/klauspost/compress v1.11.5
 	github.com/klauspost/pgzip v1.2.5
 	github.com/manifoldco/promptui v0.8.0
 	github.com/morikuni/aec v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 9c0cf68b..815e2474 100644
--- a/go.sum
+++ b/go.sum
@@ -7,10 +7,12 @@ github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5 h1:ygIc8M6trr62pF5DucadTWGdEB4mEyvzi0e2nbcmcyA=
 github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
+github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
 github.com/Microsoft/hcsshim v0.8.7 h1:ptnOoufxGSzauVTsdE+wMYnCWA301PdoN4xg5oRdZpg=
 github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
 github.com/Microsoft/hcsshim v0.8.9 h1:VrfodqvztU8YSOvygU+DN1BGaSGxmrNfqOv5oOuX2Bk=
 github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
+github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=
 github.com/VividCortex/ewma v1.1.1 h1:MnEK4VOv6n0RSY4vtRe3h11qjxL3+t0B8yOL8iMXdcM=
 github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -28,11 +30,13 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
 github.com/cilium/ebpf v0.0.0-20200507155900-a9f01edf17e3/go.mod h1:XT+cAw5wfvsodedcijoh1l9cf7v1x9FlFB/3VmF/O8s=
 github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f h1:tSNMc+rJDfmYntojat8lljbt1mgKNpTxUZJsSzJ9Y1s=
 github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
+github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
 github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v1.0.0/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
 github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
@@ -88,10 +92,13 @@ github.com/containers/storage v1.23.6 h1:3rcZ1KTNv8q7SkZ75gcrFGYqTeiuI04Zg7m9X1s
 github.com/containers/storage v1.23.6/go.mod h1:haFs0HRowKwyzvWEx9EgI3WsL8XCSnBDb5f8P5CAxJY=
 github.com/containers/storage v1.23.7 h1:43ImvG/npvQSZXRjaudVvKISIuZSfI6qvtSNQQSGO/A=
 github.com/containers/storage v1.23.7/go.mod h1:cUT2zHjtx+WlVri30obWmM2gpqpi8jfPsmIzP1TVpEI=
+github.com/containers/storage v1.24.5 h1:BusfdU0rCS2/Daa/DPw+0iLfGRlYA7UVF7D0el3N7Vk=
+github.com/containers/storage v1.24.5/go.mod h1:YC+2pY8SkfEAcZkwycxYbpK8EiRbx5soPPwz9dxe4IQ=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
 github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -198,6 +205,8 @@ github.com/klauspost/compress v1.11.1/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYs
 github.com/klauspost/compress v1.11.2/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.3 h1:dB4Bn0tN3wdCzQxnS8r06kV74qN/TAfaIS0bVE8h3jc=
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.11.5 h1:xNCE0uE6yvTPRS+0wGNMHPo3NIpwnk6aluQZ6R6kRcc=
+github.com/klauspost/compress v1.11.5/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/pgzip v1.2.3 h1:Ce2to9wvs/cuJ2b86/CKQoTYr9VHfpanYosZ0UBJqdw=
 github.com/klauspost/pgzip v1.2.3/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/klauspost/pgzip v1.2.4 h1:TQ7CNpYKovDOmqzRHKxJh0BeaBI7UdQZYc6p7pMQh1A=
@@ -270,6 +279,7 @@ github.com/opencontainers/runc v1.0.0-rc92 h1:+IczUKCRzDzFDnw99O/PAqrcBBCoRp9xN3
 github.com/opencontainers/runc v1.0.0-rc92/go.mod h1:X1zlU4p7wOlX4+WRCz+hvlRv8phdL7UqbYD+vQwNMmE=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700 h1:eNUVfm/RFLIi1G7flU5/ZRTHvd4kcVuzfRnL6OFlzCI=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.3-0.20200520003142-237cc4f519e2 h1:9mv9SC7GWmRWE0J/+oD8w3GsN2KYGKtg6uwLN7hfP5E=
 github.com/opencontainers/runtime-spec v1.0.3-0.20200520003142-237cc4f519e2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.3-0.20200728170252-4d89ac9fbff6 h1:NhsM2gc769rVWDqJvapK37r+7+CBXI8xHhnfnt8uQsg=
@@ -285,6 +295,7 @@ github.com/opencontainers/selinux v1.5.2 h1:F6DgIsjgBIcDksLW4D5RG9bXok6oqZ3nvMwj
 github.com/opencontainers/selinux v1.5.2/go.mod h1:yTcKuYAh6R95iDpefGLQaPaRwJFwyzAJufJyiTt7s0g=
 github.com/opencontainers/selinux v1.6.0 h1:+bIAS/Za3q5FTwWym4fTB0vObnfCf3G/NC7K6Jx62mY=
 github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
+github.com/opencontainers/selinux v1.8.0 h1:+77ba4ar4jsCbL1GLbFL8fFM57w6suPfSS9PDLDY7KM=
 github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
 github.com/ostreedev/ostree-go v0.0.0-20190702140239-759a8c1ac913 h1:TnbXhKzrTOyuvWrjI8W6pcoI9XPbLHFXCdN2dtUw7Rw=
 github.com/ostreedev/ostree-go v0.0.0-20190702140239-759a8c1ac913/go.mod h1:J6OG6YJVEWopen4avK3VNQSnALmmjvniMmni/YFYAwc=
@@ -347,9 +358,11 @@ github.com/ulikunitz/xz v0.5.7 h1:YvTNdFzX6+W5m9msiYg/zpkSURPPtOlzbqYjrFn7Yt4=
 github.com/ulikunitz/xz v0.5.7/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.8 h1:ERv8V6GKqVi23rgu5cj9pVfVzJbOqAY2Ntl88O6c2nQ=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.9 h1:RsKRIA2MO8x56wkkcd3LbtcE/uMszhb6DpRf+3uwa3I=
 github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/vbatts/tar-split v0.11.1 h1:0Odu65rhcZ3JZaPHxl7tCI3V/C/Q9Zf82UFravl02dE=
 github.com/vbatts/tar-split v0.11.1/go.mod h1:LEuURwDEiWjRjwu46yU3KVGuUdVv/dcnpcEPSzR8z6g=
 github.com/vbauerster/mpb/v5 v5.0.3 h1:Ldt/azOkbThTk2loi6FrBd/3fhxGFQ24MxFAS88PoNY=
@@ -366,6 +379,7 @@ github.com/vbauerster/mpb/v5 v5.2.4 h1:PLP8vv75RcEgxGoJVtKaRD2FHSxEmIV/u4ZuOrfO8
 github.com/vbauerster/mpb/v5 v5.2.4/go.mod h1:K4iCHQp5sWnmAgEn+uW1sAxSilctb4JPAGXx49jV+Aw=
 github.com/vbauerster/mpb/v5 v5.3.0 h1:vgrEJjUzHaSZKDRRxul5Oh4C72Yy/5VEMb0em+9M0mQ=
 github.com/vbauerster/mpb/v5 v5.3.0/go.mod h1:4yTkvAb8Cm4eylAp6t0JRq6pXDkFJ4krUlDqWYkakAs=
+github.com/vbauerster/mpb/v5 v5.4.0 h1:n8JPunifvQvh6P1D1HAl2Ur9YcmKT1tpoUuiea5mlmg=
 github.com/vbauerster/mpb/v5 v5.4.0/go.mod h1:fi4wVo7BVQ22QcvFObm+VwliQXlV1eBT8JDaKXR4JGI=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
@@ -435,11 +449,13 @@ golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191127021746-63cb32ae39b2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527 h1:uYVVQ9WP/Ds2ROhcaGPeIdVq0RIXVLwsHlnvJ+cT1So=
@@ -462,6 +478,9 @@ golang.org/x/sys v0.0.0-20200810151505-1b9f1253b3ed h1:WBkVNH1zd9jg/dK4HCM4lNANn
 golang.org/x/sys v0.0.0-20200810151505-1b9f1253b3ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009 h1:W0lCpv29Hv0UaM1LXb9QlBHLNP8UFfcKjblhVCWftOM=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3 h1:kzM6+9dur93BcC2kVlYl34cHU+TYZLanmpSJHVMmL64=
+golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201218084310-7d0127a74742 h1:+CBz4km/0KPU3RGTwARGh/noP3bEwtHcq+0YcBQM2JQ=
 golang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/pkg/docker/config/config.go b/pkg/docker/config/config.go
index cf82ee86..983df41d 100644
--- a/pkg/docker/config/config.go
+++ b/pkg/docker/config/config.go
@@ -86,7 +86,7 @@ func GetAllCredentials(sys *types.SystemContext) (map[string]types.DockerAuthCon
 	// Note: we need to read the auth files in the inverse order to prevent
 	// a priority inversion when writing to the map.
 	authConfigs := make(map[string]types.DockerAuthConfig)
-	paths := getAuthFilePaths(sys)
+	paths := getAuthFilePaths(sys, homedir.Get())
 	for i := len(paths) - 1; i >= 0; i-- {
 		path := paths[i]
 		// readJSONFile returns an empty map in case the path doesn't exist.
@@ -126,7 +126,9 @@ func GetAllCredentials(sys *types.SystemContext) (map[string]types.DockerAuthCon
 
 // getAuthFilePaths returns a slice of authPaths based on the system context
 // in the order they should be searched. Note that some paths may not exist.
-func getAuthFilePaths(sys *types.SystemContext) []authPath {
+// The homeDir parameter should always be homedir.Get(), and is only intended to be overridden
+// by tests.
+func getAuthFilePaths(sys *types.SystemContext, homeDir string) []authPath {
 	paths := []authPath{}
 	pathToAuth, lf, err := getPathToAuth(sys)
 	if err == nil {
@@ -139,7 +141,7 @@ func getAuthFilePaths(sys *types.SystemContext) []authPath {
 	}
 	xdgCfgHome := os.Getenv("XDG_CONFIG_HOME")
 	if xdgCfgHome == "" {
-		xdgCfgHome = filepath.Join(homedir.Get(), ".config")
+		xdgCfgHome = filepath.Join(homeDir, ".config")
 	}
 	paths = append(paths, authPath{path: filepath.Join(xdgCfgHome, xdgConfigHomePath), legacyFormat: false})
 	if dockerConfig := os.Getenv("DOCKER_CONFIG"); dockerConfig != "" {
@@ -148,11 +150,11 @@ func getAuthFilePaths(sys *types.SystemContext) []authPath {
 		)
 	} else {
 		paths = append(paths,
-			authPath{path: filepath.Join(homedir.Get(), dockerHomePath), legacyFormat: false},
+			authPath{path: filepath.Join(homeDir, dockerHomePath), legacyFormat: false},
 		)
 	}
 	paths = append(paths,
-		authPath{path: filepath.Join(homedir.Get(), dockerLegacyHomePath), legacyFormat: true},
+		authPath{path: filepath.Join(homeDir, dockerLegacyHomePath), legacyFormat: true},
 	)
 	return paths
 }
@@ -161,6 +163,12 @@ func getAuthFilePaths(sys *types.SystemContext) []authPath {
 // file or .docker/config.json, including support for OAuth2 and IdentityToken.
 // If an entry is not found, an empty struct is returned.
 func GetCredentials(sys *types.SystemContext, registry string) (types.DockerAuthConfig, error) {
+	return getCredentialsWithHomeDir(sys, registry, homedir.Get())
+}
+
+// getCredentialsWithHomeDir is an internal implementation detail of GetCredentials,
+// it exists only to allow testing it with an artificial home directory.
+func getCredentialsWithHomeDir(sys *types.SystemContext, registry, homeDir string) (types.DockerAuthConfig, error) {
 	if sys != nil && sys.DockerAuthConfig != nil {
 		logrus.Debug("Returning credentials from DockerAuthConfig")
 		return *sys.DockerAuthConfig, nil
@@ -177,7 +185,7 @@ func GetCredentials(sys *types.SystemContext, registry string) (types.DockerAuth
 		}
 	}
 
-	for _, path := range getAuthFilePaths(sys) {
+	for _, path := range getAuthFilePaths(sys, homeDir) {
 		authConfig, err := findAuthentication(registry, path.path, path.legacyFormat)
 		if err != nil {
 			logrus.Debugf("Credentials not found")
@@ -203,7 +211,13 @@ func GetCredentials(sys *types.SystemContext, registry string) (types.DockerAuth
 // GetCredentials API. The new API should be used and this API is kept to
 // maintain backward compatibility.
 func GetAuthentication(sys *types.SystemContext, registry string) (string, string, error) {
-	auth, err := GetCredentials(sys, registry)
+	return getAuthenticationWithHomeDir(sys, registry, homedir.Get())
+}
+
+// getAuthenticationWithHomeDir is an internal implementation detail of GetAuthentication,
+// it exists only to allow testing it with an artificial home directory.
+func getAuthenticationWithHomeDir(sys *types.SystemContext, registry, homeDir string) (string, string, error) {
+	auth, err := getCredentialsWithHomeDir(sys, registry, homeDir)
 	if err != nil {
 		return "", "", err
 	}
@@ -262,6 +276,12 @@ func RemoveAllAuthentication(sys *types.SystemContext) error {
 // getPathToAuth gets the path of the auth.json file used for reading and writing credentials
 // returns the path, and a bool specifies whether the file is in legacy format
 func getPathToAuth(sys *types.SystemContext) (string, bool, error) {
+	return getPathToAuthWithOS(sys, runtime.GOOS)
+}
+
+// getPathToAuthWithOS is an internal implementation detail of getPathToAuth,
+// it exists only to allow testing it with an artificial runtime.GOOS.
+func getPathToAuthWithOS(sys *types.SystemContext, goOS string) (string, bool, error) {
 	if sys != nil {
 		if sys.AuthFilePath != "" {
 			return sys.AuthFilePath, false, nil
@@ -273,7 +293,7 @@ func getPathToAuth(sys *types.SystemContext) (string, bool, error) {
 			return filepath.Join(sys.RootForImplicitAbsolutePaths, fmt.Sprintf(defaultPerUIDPathFormat, os.Getuid())), false, nil
 		}
 	}
-	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+	if goOS == "windows" || goOS == "darwin" {
 		return filepath.Join(homedir.Get(), nonLinuxAuthFilePath), false, nil
 	}
 
diff --git a/pkg/sysregistriesv2/system_registries_v2.go b/pkg/sysregistriesv2/system_registries_v2.go
index 89ad7c53..b0dff544 100644
--- a/pkg/sysregistriesv2/system_registries_v2.go
+++ b/pkg/sysregistriesv2/system_registries_v2.go
@@ -405,9 +405,15 @@ type configWrapper struct {
 
 // newConfigWrapper returns a configWrapper for the specified SystemContext.
 func newConfigWrapper(ctx *types.SystemContext) configWrapper {
+	return newConfigWrapperWithHomeDir(ctx, homedir.Get())
+}
+
+// newConfigWrapperWithHomeDir is an internal implementation detail of newConfigWrapper,
+// it exists only to allow testing it with an artificial home directory.
+func newConfigWrapperWithHomeDir(ctx *types.SystemContext, homeDir string) configWrapper {
 	var wrapper configWrapper
-	userRegistriesFilePath := filepath.Join(homedir.Get(), userRegistriesFile)
-	userRegistriesDirPath := filepath.Join(homedir.Get(), userRegistriesDir)
+	userRegistriesFilePath := filepath.Join(homeDir, userRegistriesFile)
+	userRegistriesDirPath := filepath.Join(homeDir, userRegistriesDir)
 
 	// decide configPath using per-user path or system file
 	if ctx != nil && ctx.SystemRegistriesConfPath != "" {
diff --git a/signature/policy_config.go b/signature/policy_config.go
index d8cc4a09..65022430 100644
--- a/signature/policy_config.go
+++ b/signature/policy_config.go
@@ -59,10 +59,16 @@ func DefaultPolicy(sys *types.SystemContext) (*Policy, error) {
 
 // defaultPolicyPath returns a path to the default policy of the system.
 func defaultPolicyPath(sys *types.SystemContext) string {
+	return defaultPolicyPathWithHomeDir(sys, homedir.Get())
+}
+
+// defaultPolicyPathWithHomeDir is an internal implementation detail of defaultPolicyPath,
+// it exists only to allow testing it with an artificial home directory.
+func defaultPolicyPathWithHomeDir(sys *types.SystemContext, homeDir string) string {
 	if sys != nil && sys.SignaturePolicyPath != "" {
 		return sys.SignaturePolicyPath
 	}
-	userPolicyFilePath := filepath.Join(homedir.Get(), userPolicyFile)
+	userPolicyFilePath := filepath.Join(homeDir, userPolicyFile)
 	if _, err := os.Stat(userPolicyFilePath); err == nil {
 		return userPolicyFilePath
 	}


Test patch:
diff --git a/docker/lookaside_test.go b/docker/lookaside_test.go
index 545459e5..79c06141 100644
--- a/docker/lookaside_test.go
+++ b/docker/lookaside_test.go
@@ -55,19 +55,9 @@ func TestRegistriesDirPath(t *testing.T) {
 	const nondefaultPath = "/this/is/not/the/default/registries.d"
 	const variableReference = "$HOME"
 	const rootPrefix = "/root/prefix"
-	oldHomeEnv, hasHomeEnv := os.LookupEnv("HOME")
 	tempHome, err := ioutil.TempDir("", "tempHome")
 	require.NoError(t, err)
-	err = os.Setenv("HOME", tempHome)
-	require.NoError(t, err)
-	defer func() {
-		os.RemoveAll(tempHome)
-		if hasHomeEnv {
-			os.Setenv("HOME", oldHomeEnv)
-		} else {
-			os.Unsetenv("HOME")
-		}
-	}()
+	defer os.RemoveAll(tempHome)
 	var userRegistriesDir = filepath.FromSlash(".config/containers/registries.d")
 	userRegistriesDirPath := filepath.Join(tempHome, userRegistriesDir)
 	for _, c := range []struct {
@@ -119,7 +109,7 @@ func TestRegistriesDirPath(t *testing.T) {
 			err := os.RemoveAll(userRegistriesDirPath)
 			require.NoError(t, err)
 		}
-		path := registriesDirPath(c.sys)
+		path := registriesDirPathWithHomeDir(c.sys, tempHome)
 		assert.Equal(t, c.expected, path)
 	}
 }
diff --git a/pkg/docker/config/config_test.go b/pkg/docker/config/config_test.go
index fe415698..13ffeec0 100644
--- a/pkg/docker/config/config_test.go
+++ b/pkg/docker/config/config_test.go
@@ -6,17 +6,23 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/containers/image/v5/types"
-	"github.com/containers/storage/pkg/homedir"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestGetPathToAuth(t *testing.T) {
+	const linux = "linux"
+	const darwin = "darwin"
+
 	uid := fmt.Sprintf("%d", os.Getuid())
+	// We don’t have to override the home directory for this because use of this path does not depend
+	// on any state of the filesystem.
+	darwinDefault := filepath.Join(os.Getenv("HOME"), ".config", "containers", "auth.json")
 
 	tmpDir, err := ioutil.TempDir("", "TestGetPathToAuth")
 	require.NoError(t, err)
@@ -35,27 +41,35 @@ func TestGetPathToAuth(t *testing.T) {
 
 	for _, c := range []struct {
 		sys          *types.SystemContext
+		os           string
 		xrd          string
 		expected     string
 		legacyFormat bool
 	}{
 		// Default paths
-		{&types.SystemContext{}, "", "/run/containers/" + uid + "/auth.json", false},
-		{nil, "", "/run/containers/" + uid + "/auth.json", false},
+		{&types.SystemContext{}, linux, "", "/run/containers/" + uid + "/auth.json", false},
+		{&types.SystemContext{}, darwin, "", darwinDefault, false},
+		{nil, linux, "", "/run/containers/" + uid + "/auth.json", false},
+		{nil, darwin, "", darwinDefault, false},
 		// SystemContext overrides
-		{&types.SystemContext{AuthFilePath: "/absolute/path"}, "", "/absolute/path", false},
-		{&types.SystemContext{LegacyFormatAuthFilePath: "/absolute/path"}, "", "/absolute/path", true},
-		{&types.SystemContext{RootForImplicitAbsolutePaths: "/prefix"}, "", "/prefix/run/containers/" + uid + "/auth.json", false},
+		{&types.SystemContext{AuthFilePath: "/absolute/path"}, linux, "", "/absolute/path", false},
+		{&types.SystemContext{AuthFilePath: "/absolute/path"}, darwin, "", "/absolute/path", false},
+		{&types.SystemContext{LegacyFormatAuthFilePath: "/absolute/path"}, linux, "", "/absolute/path", true},
+		{&types.SystemContext{LegacyFormatAuthFilePath: "/absolute/path"}, darwin, "", "/absolute/path", true},
+		{&types.SystemContext{RootForImplicitAbsolutePaths: "/prefix"}, linux, "", "/prefix/run/containers/" + uid + "/auth.json", false},
+		{&types.SystemContext{RootForImplicitAbsolutePaths: "/prefix"}, darwin, "", "/prefix/run/containers/" + uid + "/auth.json", false},
 		// XDG_RUNTIME_DIR defined
-		{nil, tmpDir, tmpDir + "/containers/auth.json", false},
-		{nil, tmpDir + "/thisdoesnotexist", "", false},
+		{nil, linux, tmpDir, tmpDir + "/containers/auth.json", false},
+		{nil, darwin, tmpDir, darwinDefault, false},
+		{nil, linux, tmpDir + "/thisdoesnotexist", "", false},
+		{nil, darwin, tmpDir + "/thisdoesnotexist", darwinDefault, false},
 	} {
 		if c.xrd != "" {
 			os.Setenv("XDG_RUNTIME_DIR", c.xrd)
 		} else {
 			os.Unsetenv("XDG_RUNTIME_DIR")
 		}
-		res, lf, err := getPathToAuth(c.sys)
+		res, lf, err := getPathToAuthWithOS(c.sys, c.os)
 		if c.expected == "" {
 			assert.Error(t, err)
 		} else {
@@ -68,42 +82,41 @@ func TestGetPathToAuth(t *testing.T) {
 
 func TestGetAuth(t *testing.T) {
 	origXDG := os.Getenv("XDG_RUNTIME_DIR")
-	tmpDir1, err := ioutil.TempDir("", "test_docker_client_get_auth")
+	tmpXDGRuntimeDir, err := ioutil.TempDir("", "test_docker_client_get_auth")
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Logf("using temporary XDG_RUNTIME_DIR directory: %q", tmpDir1)
+	t.Logf("using temporary XDG_RUNTIME_DIR directory: %q", tmpXDGRuntimeDir)
 	// override XDG_RUNTIME_DIR
-	os.Setenv("XDG_RUNTIME_DIR", tmpDir1)
+	os.Setenv("XDG_RUNTIME_DIR", tmpXDGRuntimeDir)
 	defer func() {
-		err := os.RemoveAll(tmpDir1)
+		err := os.RemoveAll(tmpXDGRuntimeDir)
 		if err != nil {
-			t.Logf("failed to cleanup temporary home directory %q: %v", tmpDir1, err)
+			t.Logf("failed to cleanup temporary home directory %q: %v", tmpXDGRuntimeDir, err)
 		}
 		os.Setenv("XDG_RUNTIME_DIR", origXDG)
 	}()
 
-	origHomeDir := homedir.Get()
-	tmpDir2, err := ioutil.TempDir("", "test_docker_client_get_auth")
+	tmpHomeDir, err := ioutil.TempDir("", "test_docker_client_get_auth")
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Logf("using temporary home directory: %q", tmpDir2)
-	//override homedir
-	os.Setenv(homedir.Key(), tmpDir2)
+	t.Logf("using temporary home directory: %q", tmpHomeDir)
 	defer func() {
-		err := os.RemoveAll(tmpDir2)
+		err := os.RemoveAll(tmpHomeDir)
 		if err != nil {
-			t.Logf("failed to cleanup temporary home directory %q: %v", tmpDir2, err)
+			t.Logf("failed to cleanup temporary home directory %q: %v", tmpHomeDir, err)
 		}
-		os.Setenv(homedir.Key(), origHomeDir)
 	}()
 
-	configDir1 := filepath.Join(tmpDir1, "containers")
+	configDir1 := filepath.Join(tmpXDGRuntimeDir, "containers")
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		configDir1 = filepath.Join(tmpHomeDir, ".config", "containers")
+	}
 	if err := os.MkdirAll(configDir1, 0700); err != nil {
 		t.Fatal(err)
 	}
-	configDir2 := filepath.Join(tmpDir2, ".docker")
+	configDir2 := filepath.Join(tmpHomeDir, ".docker")
 	if err := os.MkdirAll(configDir2, 0700); err != nil {
 		t.Fatal(err)
 	}
@@ -245,12 +258,12 @@ func TestGetAuth(t *testing.T) {
 				if tc.sys != nil {
 					sys = tc.sys
 				}
-				auth, err := GetCredentials(sys, tc.hostname)
+				auth, err := getCredentialsWithHomeDir(sys, tc.hostname, tmpHomeDir)
 				assert.Equal(t, tc.expectedError, err)
 				assert.Equal(t, tc.expected, auth)
 
 				// Test for the previous APIs.
-				username, password, err := GetAuthentication(sys, tc.hostname)
+				username, password, err := getAuthenticationWithHomeDir(sys, tc.hostname, tmpHomeDir)
 				if tc.expected.IdentityToken != "" {
 					assert.Equal(t, "", username)
 					assert.Equal(t, "", password)
@@ -268,20 +281,16 @@ func TestGetAuth(t *testing.T) {
 }
 
 func TestGetAuthFromLegacyFile(t *testing.T) {
-	origHomeDir := homedir.Get()
 	tmpDir, err := ioutil.TempDir("", "test_docker_client_get_auth")
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Logf("using temporary home directory: %q", tmpDir)
-	// override homedir
-	os.Setenv(homedir.Key(), tmpDir)
 	defer func() {
 		err := os.RemoveAll(tmpDir)
 		if err != nil {
 			t.Logf("failed to cleanup temporary home directory %q: %v", tmpDir, err)
 		}
-		os.Setenv(homedir.Key(), origHomeDir)
 	}()
 
 	configPath := filepath.Join(tmpDir, ".dockercfg")
@@ -318,12 +327,12 @@ func TestGetAuthFromLegacyFile(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			auth, err := GetCredentials(nil, tc.hostname)
+			auth, err := getCredentialsWithHomeDir(nil, tc.hostname, tmpDir)
 			assert.Equal(t, tc.expectedError, err)
 			assert.Equal(t, tc.expected, auth)
 
 			// Testing for previous APIs
-			username, password, err := GetAuthentication(nil, tc.hostname)
+			username, password, err := getAuthenticationWithHomeDir(nil, tc.hostname, tmpDir)
 			assert.Equal(t, tc.expectedError, err)
 			assert.Equal(t, tc.expected.Username, username)
 			assert.Equal(t, tc.expected.Password, password)
@@ -332,20 +341,16 @@ func TestGetAuthFromLegacyFile(t *testing.T) {
 }
 
 func TestGetAuthPreferNewConfig(t *testing.T) {
-	origHomeDir := homedir.Get()
 	tmpDir, err := ioutil.TempDir("", "test_docker_client_get_auth")
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Logf("using temporary home directory: %q", tmpDir)
-	// override homedir
-	os.Setenv(homedir.Key(), tmpDir)
 	defer func() {
 		err := os.RemoveAll(tmpDir)
 		if err != nil {
 			t.Logf("failed to cleanup temporary home directory %q: %v", tmpDir, err)
 		}
-		os.Setenv(homedir.Key(), origHomeDir)
 	}()
 
 	configDir := filepath.Join(tmpDir, ".docker")
@@ -376,7 +381,7 @@ func TestGetAuthPreferNewConfig(t *testing.T) {
 		}
 	}
 
-	auth, err := GetCredentials(nil, "docker.io")
+	auth, err := getCredentialsWithHomeDir(nil, "docker.io", tmpDir)
 	assert.NoError(t, err)
 	assert.Equal(t, "docker", auth.Username)
 	assert.Equal(t, "io", auth.Password)
@@ -384,45 +389,44 @@ func TestGetAuthPreferNewConfig(t *testing.T) {
 
 func TestGetAuthFailsOnBadInput(t *testing.T) {
 	origXDG := os.Getenv("XDG_RUNTIME_DIR")
-	tmpDir1, err := ioutil.TempDir("", "test_docker_client_get_auth")
+	tmpXDGRuntimeDir, err := ioutil.TempDir("", "test_docker_client_get_auth")
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Logf("using temporary XDG_RUNTIME_DIR directory: %q", tmpDir1)
-	// override homedir
-	os.Setenv("XDG_RUNTIME_DIR", tmpDir1)
+	t.Logf("using temporary XDG_RUNTIME_DIR directory: %q", tmpXDGRuntimeDir)
+	// override XDG_RUNTIME_DIR
+	os.Setenv("XDG_RUNTIME_DIR", tmpXDGRuntimeDir)
 	defer func() {
-		err := os.RemoveAll(tmpDir1)
+		err := os.RemoveAll(tmpXDGRuntimeDir)
 		if err != nil {
-			t.Logf("failed to cleanup temporary home directory %q: %v", tmpDir1, err)
+			t.Logf("failed to cleanup temporary home directory %q: %v", tmpXDGRuntimeDir, err)
 		}
 		os.Setenv("XDG_RUNTIME_DIR", origXDG)
 	}()
 
-	origHomeDir := homedir.Get()
-	tmpDir2, err := ioutil.TempDir("", "test_docker_client_get_auth")
+	tmpHomeDir, err := ioutil.TempDir("", "test_docker_client_get_auth")
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Logf("using temporary home directory: %q", tmpDir2)
-	// override homedir
-	os.Setenv(homedir.Key(), tmpDir2)
+	t.Logf("using temporary home directory: %q", tmpHomeDir)
 	defer func() {
-		err := os.RemoveAll(tmpDir2)
+		err := os.RemoveAll(tmpHomeDir)
 		if err != nil {
-			t.Logf("failed to cleanup temporary home directory %q: %v", tmpDir2, err)
+			t.Logf("failed to cleanup temporary home directory %q: %v", tmpHomeDir, err)
 		}
-		os.Setenv(homedir.Key(), origHomeDir)
 	}()
 
-	configDir := filepath.Join(tmpDir1, "containers")
-	if err := os.Mkdir(configDir, 0750); err != nil {
+	configDir := filepath.Join(tmpXDGRuntimeDir, "containers")
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		configDir = filepath.Join(tmpHomeDir, ".config", "containers")
+	}
+	if err := os.MkdirAll(configDir, 0750); err != nil {
 		t.Fatal(err)
 	}
 	configPath := filepath.Join(configDir, "auth.json")
 
 	// no config file present
-	auth, err := GetCredentials(nil, "index.docker.io")
+	auth, err := getCredentialsWithHomeDir(nil, "index.docker.io", tmpHomeDir)
 	if err != nil {
 		t.Fatalf("got unexpected error: %#+v", err)
 	}
@@ -431,7 +435,7 @@ func TestGetAuthFailsOnBadInput(t *testing.T) {
 	if err := ioutil.WriteFile(configPath, []byte("Json rocks! Unless it doesn't."), 0640); err != nil {
 		t.Fatalf("failed to write file %q: %v", configPath, err)
 	}
-	auth, err = GetCredentials(nil, "index.docker.io")
+	auth, err = getCredentialsWithHomeDir(nil, "index.docker.io", tmpHomeDir)
 	if err == nil {
 		t.Fatalf("got unexpected non-error: username=%q, password=%q", auth.Username, auth.Password)
 	}
@@ -442,17 +446,17 @@ func TestGetAuthFailsOnBadInput(t *testing.T) {
 	// remove the invalid config file
 	os.RemoveAll(configPath)
 	// no config file present
-	auth, err = GetCredentials(nil, "index.docker.io")
+	auth, err = getCredentialsWithHomeDir(nil, "index.docker.io", tmpHomeDir)
 	if err != nil {
 		t.Fatalf("got unexpected error: %#+v", err)
 	}
 	assert.Equal(t, types.DockerAuthConfig{}, auth)
 
-	configPath = filepath.Join(tmpDir2, ".dockercfg")
+	configPath = filepath.Join(tmpHomeDir, ".dockercfg")
 	if err := ioutil.WriteFile(configPath, []byte("I'm certainly not a json string."), 0640); err != nil {
 		t.Fatalf("failed to write file %q: %v", configPath, err)
 	}
-	auth, err = GetCredentials(nil, "index.docker.io")
+	auth, err = getCredentialsWithHomeDir(nil, "index.docker.io", tmpHomeDir)
 	if err == nil {
 		t.Fatalf("got unexpected non-error: username=%q, password=%q", auth.Username, auth.Password)
 	}
diff --git a/pkg/sysregistriesv2/system_registries_v2_test.go b/pkg/sysregistriesv2/system_registries_v2_test.go
index 6555790f..763a785e 100644
--- a/pkg/sysregistriesv2/system_registries_v2_test.go
+++ b/pkg/sysregistriesv2/system_registries_v2_test.go
@@ -123,23 +123,13 @@ func TestRefMatchesPrefix(t *testing.T) {
 	}
 }
 
-func TestConfigPath(t *testing.T) {
+func TestNewConfigWrapper(t *testing.T) {
 	const nondefaultPath = "/this/is/not/the/default/registries.conf"
 	const variableReference = "$HOME"
 	const rootPrefix = "/root/prefix"
-	oldHomeEnv, hasHomeEnv := os.LookupEnv("HOME")
 	tempHome, err := ioutil.TempDir("", "tempHome")
 	require.NoError(t, err)
-	err = os.Setenv("HOME", tempHome)
-	require.NoError(t, err)
-	defer func() {
-		os.RemoveAll(tempHome)
-		if hasHomeEnv {
-			os.Setenv("HOME", oldHomeEnv)
-		} else {
-			os.Unsetenv("HOME")
-		}
-	}()
+	defer os.RemoveAll(tempHome)
 	var userRegistriesFile = filepath.FromSlash(".config/containers/registries.conf")
 	userRegistriesFilePath := filepath.Join(tempHome, userRegistriesFile)
 
@@ -194,7 +184,7 @@ func TestConfigPath(t *testing.T) {
 		} else {
 			os.Remove(userRegistriesFilePath)
 		}
-		path := ConfigPath(c.sys)
+		path := newConfigWrapperWithHomeDir(c.sys, tempHome).configPath
 		assert.Equal(t, c.expected, path)
 	}
 }
diff --git a/signature/policy_config_test.go b/signature/policy_config_test.go
index c09d6b63..5a190309 100644
--- a/signature/policy_config_test.go
+++ b/signature/policy_config_test.go
@@ -102,23 +102,12 @@ func TestDefaultPolicy(t *testing.T) {
 }
 
 func TestDefaultPolicyPath(t *testing.T) {
-
 	const nondefaultPath = "/this/is/not/the/default/path.json"
 	const variableReference = "$HOME"
 	const rootPrefix = "/root/prefix"
-	oldHomeEnv, hasHomeEnv := os.LookupEnv("HOME")
 	tempHome, err := ioutil.TempDir("", "tempHome")
 	require.NoError(t, err)
-	err = os.Setenv("HOME", tempHome)
-	require.NoError(t, err)
-	defer func() {
-		os.RemoveAll(tempHome)
-		if hasHomeEnv {
-			os.Setenv("HOME", oldHomeEnv)
-		} else {
-			os.Unsetenv("HOME")
-		}
-	}()
+	defer os.RemoveAll(tempHome)
 	userDefaultPolicyPath := filepath.Join(tempHome, userPolicyFile)
 
 	for _, c := range []struct {
@@ -188,7 +177,7 @@ func TestDefaultPolicyPath(t *testing.T) {
 		} else {
 			os.Remove(userDefaultPolicyPath)
 		}
-		path := defaultPolicyPath(c.sys)
+		path := defaultPolicyPathWithHomeDir(c.sys, tempHome)
 		assert.Equal(t, c.expected, path)
 	}
 }