fix: pull-through fallback token scope for registries returning placeholder scope (e.g. ghcr.io) - #149
Open
ariesy wants to merge 2 commits into
Open
fix: pull-through fallback token scope for registries returning placeholder scope (e.g. ghcr.io)#149ariesy wants to merge 2 commits into
ariesy wants to merge 2 commits into
Conversation
added 2 commits
August 8, 2026 14:27
…e (e.g. ghcr.io)
Two issues prevented pull-through fallback from working with ghcr.io:
1. The scope returned by the upstream /v2/ endpoint (e.g. ghcr.io returns
"repository:user/image:pull") was used as-is and then double-prefixed
with "repository:", producing garbage scopes like
"repository:repository:user/image:pull:pull,push" which the token
endpoint rejects. Always use the actual request namespace instead.
2. Requested scope included push permission (":pull,push") even though
fallback only performs read operations. ghcr.io rejects combined
pull,push scopes with 403 DENIED; requesting only ":pull" works.
Verified: ghcr.io (actions/actions-runner, home-assistant, otel-collector)
now returns 200 through fallback; docker.io, registry.k8s.io, quay.io and
gcr.io regression tests all pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #148
Summary
Pull-through fallback to ghcr.io (and any registry whose
/v2/endpoint returns ascopeattribute inWWW-Authenticate) currently fails withmanifest unknown(404). Two issues insrc/registry/http.ts:Double-prefixed scope:
authenticate()only overrides the upstream scope when empty, but ghcr.io returns a placeholder scope (repository:user/image:pull), soauthenticateBearer()buildsrepository:repository:user/image:pull:pull,pushwhich the token endpoint rejects.Unnecessary push permission:
authenticateBearer()requests:pull,push, but ghcr.io's token endpoint returns403 DENIEDfor combined scopes and only accepts single:pull. Fallback is read-only, so push permission is not needed.Changes
src/registry/http.ts:/v2/:pullpermission instead of:pull,pushVerification
Tested against a deployed instance with
REGISTRIES_JSON= Docker Hub + ghcr.io + registry.k8s.io + quay.io + gcr.io: