google / google/go-containerregistry

crane: should support multiple credentials to the same registry

Open
#1,329 4 comments 0 reactions 0 assignees View on GitHub
bug lifecycle/frozen
Dominant language
Go
Stars
4k
Forks
686
Avg merge
2d 12h
Merged PRs (30d)
26

Description

### Describe the bug
When trying to pull an image from a registry ie `quay.io` with an auth file that contains multiple entries for the same registry, crane gives an `UNATHORIZED` error.

### To Reproduce
1. Have access to a registry with different accounts for different namespaces/images
2. Create an auth file with multiple entries for the same registry
```
{
"auths": {
"quay.io/telcoci/simple-demo-operator-bundle": {
"auth": "XXXXXX"
},
"quay.io/telcoci": {
"auth": "YYYYYY"
},
"quay.io": {
"auth": "ZZZZZZ"
}
}
}
```

3. Run `crane pull quay.io/telcoci/simple-demo-operator-catalog:0.0.3` (as an example)
4. See an error of `Error: GET https://quay.io/v2/telcoci/simple-demo-operator-catalog/manifests/0.0.3: UNAUTHORIZED: access to the requested resource is not authorized; map[]`

### Expected behavior
I'd expect `crane` to be able to use the proper `auth` value like podman, skopeo, buildah, etc.

### Additional context
This also does not work when using the crane api's. We are using `crane` as a library for a go based project found [here](https://github.com/redhat-openshift-ecosystem/openshift-preflight), so should be implemented in the `cli` as well as the `api`.

This also might relate to:

- #723

but I think `crane` cli cmds use the files in the `authn` pkg

- Output of `crane version`: `0.8.0`
- Registry used (e.g., GCR, ECR, Quay): `quay` but I assume this exists for all registries.

Contributor guide

Open the contributing guide

Research direction

Start in the authn package, which the issue identifies as handling credentials for crane CLI commands, and reproduce the failure with the provided multi-entry auth file and crane pull command. Check the related issue #723 and the API usage context. Done means the appropriate credential is selected for a registry path with multiple entries in both the CLI and API.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.