Registry: prevent double authorization when getting a new token #922
+7
−5
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem: normally, the reason we get the HTTP 401 when working with OCI registries is the initial lack of token, in which case
AuthenticationKeeper
will have noAuthentication
set, and theauthenticationKeeper.header()
will returnnil
.However, sometimes the cause for the HTTP 401 is that the scopes mismatch, and since the
AuthenticationKeeper
now already hasAuthentication
, we'll happily add it to a request for a new token (not just for a regular OCI request):tart/Sources/tart/OCI/Registry.swift
Lines 419 to 421 in c0b2093
This results in a token request with two values in the
Authorization
and causes HTTP 400 for e.g. GitLab Registry.Solution: never consider
AuthenticationKeeper
when making a request for a new token.Resolves #914.