build and push image to private registry return "insufficient_scope: authorization failed"

When I run docker image build and push my image to registry with such commands:
(The auth file has already been located in $HOME/.docker/config.json)

#buildctl build --frontend dockerfile.v0 --frontend-opt filename=Dockerfile --local context=. --local dockerfile=. --exporter=image --exporter-opt name=XXX/XX/buildkit:master --exporter-opt push=true

The output：

exporting to image:
error: failed to solve: rpc error: code = Unknown desc = server message: insufficient_scope: authorization failed

buildkitd version that I used is built with the latest master code.

Here are logs from buildkitd debug mode:

DEBU[0254] do request digest="sha256:fe779acdcaf3dc24c81f65ae60648242f6b5822d2e60d6d0da8777f65f2532af" mediatype=application/vnd.docker.image.rootfs.diff.tar.gzip request.headers="map[Authorization:[Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjRSSU06SEhMNDpHU1MyOjdaQ0w6QkNMRDpKN0ZIOlVPNzM6Q1FETzpNUUg1OjdNQ1E6T0lQUTpYQlk1In0.eyJpc3MiOiJkb2NrZXJhdXRoLmFsaXl1bmNzLmNvbSIsImF1ZCI6InJlZy5kb2NrZXIuYWxpYmFiYS1pbmMuY29tOmNuLWlubmVyIiwic3ViIjoiIiwiaWF0IjoxNTUxMjY2MDA0LCJqdGkiOiJOU1BBdnMzVGR1QXg2VWZwNnBGc3NnIiwibmJmIjoxNTUxMjY1NzA0LCJleHAiOjE1NTEyNjY2MDQsImFjY2VzcyI6W3sibmFtZSI6ImFudGIvYnVpbGRraXQiLCJ0eXBlIjoicmVwb3NpdG9yeSIsImFjdGlvbnMiOlsicHVsbCJdfSx7Im5hbWUiOiJhbnRiL2J1aWxka2l0IiwidHlwZSI6InJlcG9zaXRvcnkiLCJhY3Rpb25zIjpbInB1bGwiXX1dfQ.RvcoUFzRp0heAugH2yXNjdoqqAQCq1BSswKKjQv6fxagalMMTtSPzlm1gFU9pz3n8YU00FV0aUzogdCECo7lCwMRZa8Mfa2_RY8DydaqWyZ0bFnEbG0S9QQpPyx4IXi_8ajPbsEIldLH9KTnkzEGfp8ykmWPC7D9lK8VV7FH6Dq6zWA-G1VGFrXzS3g9nn5Jjv7XVMNq9RFezwhTiWYJZ1ehFMmR-oXrOVI1Es9mHNyXPbYllEfuwiuZBvpKkHzCLJU83fHy-G-oD9aLTeu9ZRsih8KPa6pn5QAA5wiRsNdxW5x06ug9CnGgkGcQZanvzpnnCBFDqOoQWnhaSn5WMQ]]" request.method=POST size=202 url="https://XXXX/v2/antb/buildkit/blobs/uploads/"
DEBU[0254] fetch response received
ERRO[0254] /moby.buildkit.v1.Control/Solve returned error: authorization failed
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.init
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/resolver.go:47
github.com/moby/buildkit/util/contentutil.init
:1
github.com/moby/buildkit/cache/remotecache/v1.init
:1
github.com/moby/buildkit/cache/remotecache.init
:1
main.init
:1
runtime.main
/usr/local/go/src/runtime/proc.go:186
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:2361
server message: insufficient_scope
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.invalidAuthorization
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/authorizer.go:306
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.(*dockerAuthorizer).AddResponses
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/authorizer.go:75
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.(*dockerBase).retryRequest
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/resolver.go:408
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.(*dockerBase).doRequestWithRetries
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/resolver.go:388
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.(*dockerBase).doRequestWithRetries
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/resolver.go:395
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.dockerPusher.Push
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker/pusher.go:143
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/docker.(*dockerPusher).Push
:1
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes.push
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/handlers.go:135
github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes.PushHandler.func1
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/remotes/handlers.go:127
github.com/moby/buildkit/vendor/github.com/containerd/containerd/images.HandlerFunc.Handle
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/images/handlers.go:53
github.com/moby/buildkit/vendor/github.com/containerd/containerd/images.Handlers.func1
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/images/handlers.go:63
github.com/moby/buildkit/vendor/github.com/containerd/containerd/images.HandlerFunc.Handle
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/images/handlers.go:53
github.com/moby/buildkit/vendor/github.com/containerd/containerd/images.Dispatch.func1
/go/src/github.com/moby/buildkit/vendor/github.com/containerd/containerd/images/handlers.go:123
github.com/moby/buildkit/vendor/golang.org/x/sync/errgroup.(*Group).Go.func1

I can docker push such image if export as docker image in the host. But it returns such "insufficient_scope: authorization failed".

I found the authenticationScheme is bearerAuth, it maybe cause by the dis-match between scope and auth defined in code "vendor/github.com/containerd/containerd/remotes/docker/authorizer.go"

Do we have any path to fix this issue ? OR Do I have anything wrong when use the push during build?

Reproduce the buildctl Dockerfile build with --exporter=image and --exporter-opt push=true against a private registry, then inspect vendor/github.com/containerd/containerd/remotes/docker/authorizer.go and the related pusher path shown in the logs. Compare the bearer scope sent during the build push with a normal docker push; done means the image pushes successfully without an insufficient_scope authorization error.