response status code 401: unauthorized: authentication required

[sharadregoti]

What happened in your environment?

I am using oras version v1.1.0

I logged in to the docker hub using the below command. The command success

echo my-password- | oras login -u sharadregoti --password-stdin registry-1.docker.io
Login Succeeded

After login, When I try to push my helm artificat, I am getting this error

oras push registry-1.docker.io/sharadregoti/helm-kubevirt-vms:dev-v0.1.0 *.tgz
Exists    1db8e3a59e54 helm-kubevirt-vms-v0.2.0.tgz
Error: PUT "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/manifests/dev-v0.1.0": response status code 401: unauthorized: authentication required: [map[Action:pull Class: Name:sharadregoti/helm-kubevirt-vms Type:repository] map[Action:push Class: Name:sharadregoti/helm-kubevirt-vms Type:repository]]

To fix it I downgraded to v1.0.0 & it worked.

What did you expect to happen?

I should have been able to push without error

How can we reproduce it?

Reproduce using the above steps

What is the version of your ORAS CLI?

v1.1.0

What is your OS environment?

Ubuntu 22.04 WSL

Are you willing to submit PRs to fix it?

• [ ] Yes, I am willing to fix it.

[qweeah]

@sharadregoti can you share the --debug log? Does my-password- have push access to the repository?

[FeynmanZhou]

Hi @sharadregoti , has this issue been resolved or you are still blocked?

[sharadregoti]

Hi @sharadregoti , has this issue been resolved or you are still blocked?

@FeynmanZhou As described in the issue. To fix it I downgraded to v1.0.0 & it worked.

But v1.1.0 did not work for me

[sharadregoti]

@sharadregoti can you share the --debug log? Does my-password- have push access to the repository?

@qweeah Yes, my-password has push access to the repo.

Here are the logs

deploy/_helm/kubevirt-vms on  adding-playgrounds [$✘!?] is 📦 v0.1.0 via ⎈ v3.12.3 on ☁️  (ap-south-1) on ☁️  [email protected]
❯ echo my-password- | oras login -u sharadregoti --password-stdin registry-1.docker.io
DEBU[0000] Request #0
> Request URL: "https://registry-1.docker.io/v2/"
> Request method: "GET"
> Request headers:
   "User-Agent": "oras/1.1.0"
DEBU[0000] Response #0
< Response Status: "401 Unauthorized"
< Response headers:
   "Date": "Tue, 16 Apr 2024 09:14:37 GMT"
   "Content-Length": "87"
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Www-Authenticate": "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\""
DEBU[0000] Request #1
> Request URL: "https://auth.docker.io/token?service=registry.docker.io"
> Request method: "GET"
> Request headers:
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0001] Response #1
< Response Status: "200 OK"
< Response headers:
   "Content-Type": "application/json"
   "Date": "Tue, 16 Apr 2024 09:14:38 GMT"
   "Strict-Transport-Security": "max-age=31536000"
DEBU[0001] Request #2
> Request URL: "https://registry-1.docker.io/v2/"
> Request method: "GET"
> Request headers:
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0002] Response #2
< Response Status: "200 OK"
< Response headers:
   "Content-Length": "2"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Date": "Tue, 16 Apr 2024 09:14:39 GMT"
   "Strict-Transport-Security": "max-age=31536000"
Login Succeeded

deploy/_helm/kubevirt-vms on  adding-playgrounds [$✘!?] is 📦 v0.1.0 via ⎈ v3.12.3 on ☁️  (ap-south-1) on ☁️  [email protected] took 3s
❯ oras push registry-1.docker.io/sharadregoti/helm-kubevirt-vms:dev-v0.1.0 *.tgz --debug
DEBU[0000] Request #0
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/manifests/sha256:26dbe9017a77a84bce6a2395dce319c3c33b1a4b70205a6c7ff7e84eaf7a3556"
> Request method: "HEAD"
> Request headers:
   "Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json"
   "User-Agent": "oras/1.1.0"
DEBU[0000] Response #0
< Response Status: "401 Unauthorized"
< Response headers:
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Www-Authenticate": "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:sharadregoti/helm-kubevirt-vms:pull\""
   "Date": "Tue, 16 Apr 2024 09:10:31 GMT"
   "Content-Length": "173"
   "Strict-Transport-Security": "max-age=31536000"
   "Docker-Ratelimit-Source": "182.237.182.58"
DEBU[0001] Request #1
> Request URL: "https://auth.docker.io/token?scope=repository%3Asharadregoti%2Fhelm-kubevirt-vms%3Apull%2Cpush&service=registry.docker.io"
> Request method: "GET"
> Request headers:
   "User-Agent": "oras/1.1.0"
DEBU[0001] Response #1
< Response Status: "200 OK"
< Response headers:
   "Content-Type": "application/json"
   "Date": "Tue, 16 Apr 2024 09:10:32 GMT"
   "Strict-Transport-Security": "max-age=31536000"
DEBU[0001] Request #2
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/manifests/sha256:26dbe9017a77a84bce6a2395dce319c3c33b1a4b70205a6c7ff7e84eaf7a3556"
> Request method: "HEAD"
> Request headers:
   "Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json"
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0002] Response #2
< Response Status: "404 Not Found"
< Response headers:
   "Docker-Ratelimit-Source": "182.237.182.58"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Date": "Tue, 16 Apr 2024 09:10:32 GMT"
   "Content-Length": "215"
   "Strict-Transport-Security": "max-age=31536000"
   "Ratelimit-Limit": "100;w=21600"
   "Ratelimit-Remaining": "100;w=21600"
DEBU[0002] Request #3
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/sha256:618db1ac5cde87ba8dc1733fe8409cf76ece0a3fc2aa953ff301e5b0702ea8c9"
> Request method: "HEAD"
> Request headers:
   "User-Agent": "oras/1.1.0"
   "Authorization": "*****"
DEBU[0002] Request #4
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
> Request method: "HEAD"
> Request headers:
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0002] Response #3
< Response Status: "404 Not Found"
< Response headers:
   "Content-Length": "157"
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Date": "Tue, 16 Apr 2024 09:10:32 GMT"
Uploading 618db1ac5cde helm-kubevirt-vms-v0.1.0.tgz
DEBU[0002] Request #5
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/uploads/"
> Request method: "POST"
> Request headers:
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0003] Response #4
< Response Status: "307 Temporary Redirect"
< Response headers:
   "Content-Type": "application/octet-stream"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Location": "https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/44/44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a/data?verify=1713261633-d0hD7mfKDtgJDlillNkQ6DPvOe8%3D"
   "Date": "Tue, 16 Apr 2024 09:10:33 GMT"
   "Strict-Transport-Security": "max-age=31536000"
DEBU[0003] Request #6
> Request URL: "https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/44/44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a/data?verify=1713261633-d0hD7mfKDtgJDlillNkQ6DPvOe8%3D"
> Request method: "HEAD"
> Request headers:
   "User-Agent": "oras/1.1.0"
   "Referer": "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
DEBU[0003] Response #6
< Response Status: "200 OK"
< Response headers:
   "Cf-Ray": "87530afd5c1bf2da-BOM"
   "Accept-Ranges": "bytes"
   "Age": "995460"
   "Cache-Control": "public, max-age=14400"
   "X-Amz-Version-Id": "K3dC5TOqvG6H1vQv799pOEp02PfhXOac"
   "Content-Type": "application/octet-stream"
   "Content-Length": "2"
   "Vary": "Accept-Encoding"
   "Server": "cloudflare"
   "Cf-Cache-Status": "HIT"
   "Last-Modified": "Mon, 17 Jun 2019 07:15:52 GMT"
   "X-Amz-Id-2": "F+wnATRV5VNsrr8kIrGNqEjbxsxgisuX7tHFZ0sbsy3J/22ZFHeMIcDvzwX3s0UTbHXDoFandJA="
   "Date": "Tue, 16 Apr 2024 09:10:33 GMT"
   "Expires": "Tue, 16 Apr 2024 13:10:33 GMT"
   "Etag": "\"99914b932bd37a50b983c5e7c90ae93b\""
   "X-Amz-Request-Id": "BFXG0C3QCA4QVCX3"
DEBU[0003] Response #5
< Response Status: "401 Unauthorized"
< Response headers:
   "Content-Length": "262"
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Www-Authenticate": "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:sharadregoti/helm-kubevirt-vms:pull,push\",error=\"insufficient_scope\""
   "Date": "Tue, 16 Apr 2024 09:10:33 GMT"
DEBU[0003] Request #7
> Request URL: "https://auth.docker.io/token?scope=repository%3Asharadregoti%2Fhelm-kubevirt-vms%3Apull%2Cpush&service=registry.docker.io"
> Request method: "GET"
> Request headers:
   "User-Agent": "oras/1.1.0"
DEBU[0003] Response #7
< Response Status: "200 OK"
< Response headers:
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Date": "Tue, 16 Apr 2024 09:10:34 GMT"
DEBU[0003] Request #8
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/uploads/"
> Request method: "POST"
> Request headers:
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0004] Response #8
< Response Status: "401 Unauthorized"
< Response headers:
   "Date": "Tue, 16 Apr 2024 09:10:34 GMT"
   "Content-Length": "262"
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Www-Authenticate": "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:sharadregoti/helm-kubevirt-vms:push,pull\",error=\"insufficient_scope\""
Error: POST "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/uploads/": response status code 401: unauthorized: authentication required: [map[Action:pull Class: Name:sharadregoti/helm-kubevirt-vms Type:repository] map[Action:push Class: Name:sharadregoti/helm-kubevirt-vms Type:repository]]

deploy/_helm/kubevirt-vms on  adding-playgrounds [$✘!?] is 📦 v0.1.0 via ⎈ v3.12.3 on ☁️  (ap-south-1) on ☁️  [email protected] took 4s
❯ oras --version
Error: unknown flag: --version

deploy/_helm/kubevirt-vms on  adding-playgrounds [$✘!?] is 📦 v0.1.0 via ⎈ v3.12.3 on ☁️  (ap-south-1) on ☁️  [email protected]
❯ oras version
Version:        1.1.0
Go version:     go1.21.0
Git commit:     7079c468a06fb5815c99395eb4aaf46dd459d3fa
Git tree state: clean

[qweeah]

I cannot reproduce this issue. The logs are strange, the token for pull and push is re-obtained successfully:

DEBU[0003] Request #7
> Request URL: "https://auth.docker.io/token?scope=repository%3Asharadregoti%2Fhelm-kubevirt-vms%3Apull%2Cpush&service=registry.docker.io"
> Request method: "GET"
> Request headers:
   "User-Agent": "oras/1.1.0"
DEBU[0003] Response #7
< Response Status: "200 OK"
< Response headers:
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Date": "Tue, 16 Apr 2024 09:10:34 GMT"

but later on being rejected for insufficient scope:

DEBU[0003] Request #8
> Request URL: "https://registry-1.docker.io/v2/sharadregoti/helm-kubevirt-vms/blobs/uploads/"
> Request method: "POST"
> Request headers:
   "Authorization": "*****"
   "User-Agent": "oras/1.1.0"
DEBU[0004] Response #8
< Response Status: "401 Unauthorized"
< Response headers:
   "Date": "Tue, 16 Apr 2024 09:10:34 GMT"
   "Content-Length": "262"
   "Strict-Transport-Security": "max-age=31536000"
   "Content-Type": "application/json"
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Www-Authenticate": "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:sharadregoti/helm-kubevirt-vms:push,pull\",error=\"insufficient_scope\""

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 30 days with no activity.