we're using the challenges from the /v2/ ping response and not the one from the destination URL in this request because: 1) docker does that as well 2) gcr.io is sending 401 without a WWW-Authenticate header in the real request debugging: https://github.com/containers/image/pull/211#issuecomment-2
(req *http.Request, extraScope *authScope)
| 700 | // |
| 701 | // debugging: https://github.com/containers/image/pull/211#issuecomment-273426236 and follows up |
| 702 | func (c *dockerClient) setupRequestAuth(req *http.Request, extraScope *authScope) error { |
| 703 | if len(c.challenges) == 0 { |
| 704 | return nil |
| 705 | } |
| 706 | schemeNames := make([]string, 0, len(c.challenges)) |
| 707 | for _, challenge := range c.challenges { |
| 708 | schemeNames = append(schemeNames, challenge.Scheme) |
| 709 | switch challenge.Scheme { |
| 710 | case "basic": |
| 711 | req.SetBasicAuth(c.auth.Username, c.auth.Password) |
| 712 | return nil |
| 713 | case "bearer": |
| 714 | registryToken := c.registryToken |
| 715 | if registryToken == "" { |
| 716 | cacheKey := "" |
| 717 | scopes := []authScope{c.scope} |
| 718 | if extraScope != nil { |
| 719 | // Using ':' as a separator here is unambiguous because getBearerToken below |
| 720 | // uses the same separator when formatting a remote request (and because |
| 721 | // repository names that we create can't contain colons, and extraScope values |
| 722 | // coming from a server come from `parseAuthScope`, which also splits on colons). |
| 723 | cacheKey = fmt.Sprintf("%s:%s:%s", extraScope.resourceType, extraScope.remoteName, extraScope.actions) |
| 724 | if colonCount := strings.Count(cacheKey, ":"); colonCount != 2 { |
| 725 | return fmt.Errorf( |
| 726 | "Internal error: there must be exactly 2 colons in the cacheKey ('%s') but got %d", |
| 727 | cacheKey, |
| 728 | colonCount, |
| 729 | ) |
| 730 | } |
| 731 | scopes = append(scopes, *extraScope) |
| 732 | } |
| 733 | var token bearerToken |
| 734 | t, inCache := c.tokenCache.Load(cacheKey) |
| 735 | if inCache { |
| 736 | token = t.(bearerToken) |
| 737 | } |
| 738 | if !inCache || time.Now().After(token.expirationTime) { |
| 739 | var ( |
| 740 | t *bearerToken |
| 741 | err error |
| 742 | ) |
| 743 | if c.auth.IdentityToken != "" { |
| 744 | t, err = c.getBearerTokenOAuth2(req.Context(), challenge, scopes) |
| 745 | } else { |
| 746 | t, err = c.getBearerToken(req.Context(), challenge, scopes) |
| 747 | } |
| 748 | if err != nil { |
| 749 | return err |
| 750 | } |
| 751 | |
| 752 | token = *t |
| 753 | c.tokenCache.Store(cacheKey, token) |
| 754 | } |
| 755 | registryToken = token.token |
| 756 | } |
| 757 | req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", registryToken)) |
| 758 | return nil |
| 759 | default: |
no test coverage detected