mod: what should happen when an OCI server returns a 401 response?

[rogpeppe]

What version of CUE are you using (cue version)?

$ cue version
v0.8.0

Does this issue reproduce with the latest stable release?

N/A

What did you do?

This isn't the actual reproducer because I don't have access to the registry, but
this is the gist:

env CUE_REGISTRY=foo.example/modules
env CUE_DEBUG=http
env CUE_EXPERIMENT=modules

exec cue mod tidy

-- cue.mod/module.cue
module: "main.example"

-- main.cue --
package main

import e "x.example"

e

What did you expect to see?

An error saying that the module is unavailable.

What did you see instead?

failed to resolve "x.example": 401 Unauthorized: unauthorized: authentication required; detail: [{"Type":"repository","Class":"","Name":"provid/x.example","ProjectPath":"","Action":"pull"}]

The server is returning a 401 error rather than a 404, even though the client has acquired a valid auth token.

The HTTP log looks like this (names changed, cleaned up somewhat and run through jq .):

{
  "time": "2024-03-18T14:59:08.35335+01:00",
  "level": "INFO",
  "msg": "http client->",
  "info": {
    "id": 1,
    "method": "GET",
    "url": "https://foo.example/v2/provid/x.example/tags/list?n=1000",
    "contentLength": 0,
    "header": {
      "User-Agent": [
        "Cue/v0.8.0 (cmd/cue) Go/go1.22.1 (darwin/arm64)"
      ]
    }
  }
}
{
  "time": "2024-03-18T14:59:08.426175+01:00",
  "level": "INFO",
  "msg": "http client<-",
  "info": {
    "id": 1,
    "method": "GET",
    "url": "https://foo.example/v2/provid/x.example/tags/list?n=1000",
    "statusCode": 401,
    "header": {
      "Content-Length": [
        "176"
      ],
      "Content-Type": [
        "application/json"
      ],
      "Date": [
        "Mon, 18 Mar 2024 13:59:08 GMT"
      ],
      "Docker-Distribution-Api-Version": [
        "registry/2.0"
      ],
      "Server": [
        "nginx"
      ],
      "Www-Authenticate": [
        "Bearer realm=\"https://tokenserver.example/jwt/auth\",service=\"container_registry\",scope=\"repository:provid/x.example:pull\""
      ],
      "X-Content-Type-Options": [
        "nosniff"
      ]
    },
    "body": "{\"errors\":[{\"code\":\"UNAUTHORIZED\",\"message\":\"authentication required\",\"detail\":[{\"Type\":\"repository\",\"Class\":\"\",\"Name\":\"provid/x.example\",\"ProjectPath\":\"\",\"Action\":\"pull\"}]}]}\n"
  }
}
{
  "time": "2024-03-18T14:59:08.426259+01:00",
  "level": "INFO",
  "msg": "http client->",
  "info": {
    "id": 2,
    "method": "GET",
    "url": "https://tokenserver.example/jwt/auth?scope=repository:provid/x.example:pull&service=container_registry",
    "contentLength": 0,
    "header": {
      "Authorization": [
        "Basic REDACTED"
      ],
      "User-Agent": [
        "Cue/v0.8.0 (cmd/cue) Go/go1.22.1 (darwin/arm64)"
      ]
    }
  }
}
{
  "time": "2024-03-18T14:59:08.516768+01:00",
  "level": "INFO",
  "msg": "http client<-",
  "info": {
    "id": 2,
    "method": "GET",
    "url": "https://tokenserver.example/jwt/auth?scope=repository:provid/x.example:pull&service=container_registry",
    "statusCode": 200,
    "header": {
      "Cache-Control": [
        "max-age=0, private, must-revalidate"
      ],
      "Content-Security-Policy": [
        ""
      ],
      "Content-Type": [
        "application/json; charset=utf-8"
      ],
      "Date": [
        "Mon, 18 Mar 2024 13:59:08 GMT"
      ],
      "Etag": [
        "W/\"0398676f0e4e99a35643c00d645cca58\""
      ],
      "Permissions-Policy": [
        "interest-cohort=()"
      ],
      "Referrer-Policy": [
        "strict-origin-when-cross-origin"
      ],
      "Server": [
        "nginx"
      ],
      "Strict-Transport-Security": [
        "max-age=63072000"
      ],
      "Vary": [
        "Accept-Encoding"
      ],
      "X-Content-Type-Options": [
        "nosniff"
      ],
      "X-Download-Options": [
        "noopen"
      ],
      "X-Frame-Options": [
        "SAMEORIGIN"
      ],
      "X-Gitlab-Meta": [
        "{\"correlation_id\":\"01HS8XQREB85JDA6TX2BGT77RC\",\"version\":\"1\"}"
      ],
      "X-Permitted-Cross-Domain-Policies": [
        "none"
      ],
      "X-Request-Id": [
        "01HS8XQREB85JDA6TX2BGT77RC"
      ],
      "X-Runtime": [
        "0.035188"
      ],
      "X-Ua-Compatible": [
        "IE=edge"
      ],
      "X-Xss-Protection": [
        "1; mode=block"
      ]
    },
    "body": "REDACTED",
    "bodyTruncated": true
  }
}
{
  "time": "2024-03-18T14:59:08.516947+01:00",
  "level": "INFO",
  "msg": "http client->",
  "info": {
    "id": 3,
    "method": "GET",
    "url": "https://foo.example/v2/provid/x.example/tags/list?n=1000",
    "contentLength": 0,
    "header": {
      "Authorization": [
        "Bearer REDACTED"
      ],
      "User-Agent": [
        "Cue/v0.8.0 (cmd/cue) Go/go1.22.1 (darwin/arm64)"
      ]
    }
  }
}
{
  "time": "2024-03-18T14:59:08.537749+01:00",
  "level": "INFO",
  "msg": "http client<-",
  "info": {
    "id": 3,
    "method": "GET",
    "url": "https://foo.example/v2/provid/x.example/tags/list?n=1000",
    "statusCode": 401,
    "header": {
      "Content-Length": [
        "176"
      ],
      "Content-Type": [
        "application/json"
      ],
      "Date": [
        "Mon, 18 Mar 2024 13:59:08 GMT"
      ],
      "Docker-Distribution-Api-Version": [
        "registry/2.0"
      ],
      "Server": [
        "nginx"
      ],
      "Www-Authenticate": [
        "Bearer realm=\"https://tokenserver.example/jwt/auth\",service=\"container_registry\",scope=\"repository:provid/x.example:pull\",error=\"insufficient_scope\""
      ],
      "X-Content-Type-Options": [
        "nosniff"
      ]
    },
    "body": "{\"errors\":[{\"code\":\"UNAUTHORIZED\",\"message\":\"authentication required\",\"detail\":[{\"Type\":\"repository\",\"Class\":\"\",\"Name\":\"provid/x.example\",\"ProjectPath\":\"\",\"Action\":\"pull\"}]}]}\n"
  }
}

[mvdan]

What do other clients do in this scenario, e.g. docker pull?

[mxey]

@mvdan The difference is that CUE tries to look up multiple OCI repos, while docker pull only ever talks to one.