Closed fkorotkov closed 10 months ago
If we are getting challenged by the registry to acquire an authentication token, then there should have credentials in place.
Not necessarily. For example, when pulling ghcr.io/cirruslabs/debian:latest
as an anonymous user, https://ghcr.io/v2/
will return HTTP 401
, but we'll still be able to authenticate against the realm presented in the WWW-Authenticate
header, even without the credentials provided.
You can try this yourself by running curl "https://ghcr.io/token?scope=repository:cirruslabs/debian:pull&service=ghcr.io"
.
If we are getting challenged by the registry to acquire an authentication token, then there should have credentials in place. Let's fail fast if there are no credentials.