google / google/go-containerregistry
crane: should support multiple credentials to the same registry
- Dominant language
- Go
- Stars
- 4k
- Forks
- 686
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 26
Description
### Describe the bug
When trying to pull an image from a registry ie `quay.io` with an auth file that contains multiple entries for the same registry, crane gives an `UNATHORIZED` error.
### To Reproduce
1. Have access to a registry with different accounts for different namespaces/images
2. Create an auth file with multiple entries for the same registry
```
{
"auths": {
"quay.io/telcoci/simple-demo-operator-bundle": {
"auth": "XXXXXX"
},
"quay.io/telcoci": {
"auth": "YYYYYY"
},
"quay.io": {
"auth": "ZZZZZZ"
}
}
}
```
3. Run `crane pull quay.io/telcoci/simple-demo-operator-catalog:0.0.3` (as an example)
4. See an error of `Error: GET https://quay.io/v2/telcoci/simple-demo-operator-catalog/manifests/0.0.3: UNAUTHORIZED: access to the requested resource is not authorized; map[]`
### Expected behavior
I'd expect `crane` to be able to use the proper `auth` value like podman, skopeo, buildah, etc.
### Additional context
This also does not work when using the crane api's. We are using `crane` as a library for a go based project found [here](https://github.com/redhat-openshift-ecosystem/openshift-preflight), so should be implemented in the `cli` as well as the `api`.
This also might relate to:
- #723
but I think `crane` cli cmds use the files in the `authn` pkg
- Output of `crane version`: `0.8.0`
- Registry used (e.g., GCR, ECR, Quay): `quay` but I assume this exists for all registries.
Contributor guide
Research direction
Start in the authn package, which the issue identifies as handling credentials for crane CLI commands, and reproduce the failure with the provided multi-entry auth file and crane pull command. Check the related issue #723 and the API usage context. Done means the appropriate credential is selected for a registry path with multiple entries in both the CLI and API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100