Login failed for local HTTPS registry

[Skarlso]

Hello. I have a local registry with username password setup.

I tried ORAS to log in using the library and the CLI. Both failed. Whereas crane is succeeding with the login.

host:  py-test.local
certs:  {ocmuser ocmpass  }
Error: ocm.software/podinfo:1.0.7: creating target version: failed to resolve manifest "py-test.local/component-descriptors/ocm.software/podinfo:1.0.7": HEAD "https://py-test.local/v2/component-descriptors/ocm.software/podinfo/manifests/1.0.7": response status code 401: Unauthorized

with crane CLI

➜ crane auth login py-test.local --username ocmuser --password ocmpass
2024/12/19 17:48:43 logged in via /Users/skarlso/.docker/config.json

with oras cli

❯ oras login py-test.local --debug
Username: ocmuser
Password:
DEBU[0005] Request #0
> Request URL: "https://py-test.local/v2/"
> Request method: "GET"
> Request headers:
   "User-Agent": "oras/1.2.0+Homebrew"
DEBU[0010] Response #0
< Response Status: "401 Unauthorized"
< Response headers:
   "Docker-Distribution-Api-Version": "registry/2.0"
   "Www-Authenticate": "Basic realm=\"Registry Realm\""
   "X-Content-Type-Options": "nosniff"
   "Content-Length": "87"
   "Date": "Thu, 19 Dec 2024 16:50:10 GMT"
   "Content-Type": "application/json; charset=utf-8"
DEBU[0010] Request #1
> Request URL: "https://py-test.local/v2/"
> Request method: "GET"
> Request headers:
   "User-Agent": "oras/1.2.0+Homebrew"
   "Authorization": "*****"
DEBU[0010] Response #1
< Response Status: "401 Unauthorized"
< Response headers:
   "Www-Authenticate": "Basic realm=\"Registry Realm\""
   "X-Content-Type-Options": "nosniff"
   "Content-Length": "87"
   "Date": "Thu, 19 Dec 2024 16:50:10 GMT"
   "Content-Type": "application/json; charset=utf-8"
   "Docker-Distribution-Api-Version": "registry/2.0"
Error response from registry: failed to validate the credentials for py-test.local: unauthorized: authentication required
ocm on  main [$!?] via 🐹 v1.23.2 via 🐍 v3.13.0 (oras-oci-python-test) on ☁️   [email protected] took 10s

❯ docker ps
CONTAINER ID   IMAGE            COMMAND                  CREATED          STATUS          PORTS                            NAMES
453acb9b7160   registry:2.8.1   "/entrypoint.sh /etc…"   20 minutes ago   Up 20 minutes   0.0.0.0:443->443/tcp, 5000/tcp   registry

ime="2024-12-19T16:50:10.773189883Z" level=warning msg="error authorizing context: basic authentication challenge for realm "Registry Realm": authentication failure" go.version=go1.16.15 http.request.host=py-test.local http.request.id=8c10999b-4748-42b7-8150-aabf9eaabf22 http.request.method=GET http.request.remoteaddr="172.17.0.1:58074" http.request.uri="/v2/" http.request.useragent="oras/1.2.0+Homebrew"
172.17.0.1 - - [19/Dec/2024:16:50:10 +0000] "GET /v2/ HTTP/2.0" 401 87 "" "oras/1.2.0+Homebrew"

[Wwwsylvia]

Hi @Skarlso , could you maybe share the crane debug as well so that we can see the difference?

[Skarlso]

@Wwwsylvia Sadly, crane doesn't have a debug flag, and --verbose isn't display anything else to me. :/

❯ crane auth login -v py-test.local --username ocmuser --password ocmpass                                                                                                                                                                                                                                               (base)
2025/01/02 11:36:48 logged in via /Users/skarlso/.docker/config.json

[Skarlso]

Oh nevermind, I think crane auth login is just broken. :D I give it whatever input and then it just says, logged via docker config. Interesting.

[Skarlso]

Okay, nevermind round two. I reproduced the problem with regclient too.. So I think it's a setup issue. Thanks very much, sorry for the noise.

➜ regctl registry login py-test.local                                                                                                                   (base)
Enter Username: ocmuser
Enter Password:
WARN[0009] Changing TLS settings for registry            host="127.0.0.1:5000" new=disabled orig=enabled
^A^[[WARN[0014] Failed to ping registry, credentials were still stored
failed to ping registry py-test.local: unauthorized

I don't know yet what the fix is if anyone stumbles on this, but I doubt it's the problem of either of these clients.