fix(registry): digest retrieval failed, falling back to full pull (#763)

- add redirect detection to GetToken and handleBearerAuth functions
- add special handling for lscr.io registry authentication and manifest requests
- add LSCRRegistry constant for lscr.io identification
- refactor buildManifestURL to accept explicit scheme parameter
- add handleManifestResponse and makeManifestRequest utility functions
- update tests to handle new function signatures and add redirect test cases
- remove viper dependency from BuildManifestURL function

Fixes #761

Author: nicholas-fedor

pkg/registry/auth/auth.go

@@ -30,6 +30,7 @@ const ChallengeHeader = "WWW-Authenticate"
 const (
 	DockerRegistryDomain = "docker.io"
 	DockerRegistryHost   = "index.docker.io"
+	LSCRRegistry         = "lscr.io"
 )
 
 // Constants for HTTP client configuration.
@@ -229,20 +230,23 @@ func extractChallengeHost(realm string, fields logrus.Fields) string {
 //   - container: Container with image info.
 //   - registryAuth: Base64-encoded auth string.
 //   - client: Client for HTTP requests.
+//   - redirected: True if the challenge request was redirected.
 //   - fields: Logging fields for context.
 //
 // Returns:
 //   - string: Bearer token header (e.g., "Bearer ...").
 //   - string: Challenge host (e.g., "ghcr.io").
+//   - bool: Redirect flag (passed through).
 //   - error: Non-nil if processing fails, nil on success.
 func handleBearerAuth(
 	ctx context.Context,
 	wwwAuthHeader string,
 	container types.Container,
 	registryAuth string,
 	client Client,
+	redirected bool,
 	fields logrus.Fields,
-) (string, string, error) {
+) (string, string, bool, error) {
 	logrus.WithFields(fields).Debug("Entering Bearer auth path")
 
 	var challengeHost string
@@ -276,7 +280,7 @@ func handleBearerAuth(
 	if err != nil {
 		logrus.WithError(err).WithFields(fields).Debug("Failed to parse image name")
 
-		return "", "", fmt.Errorf("%w: %w", errFailedParseImageName, err)
+		return "", "", redirected, fmt.Errorf("%w: %w", errFailedParseImageName, err)
 	}
 
 	token, err := GetBearerHeader(
@@ -289,21 +293,24 @@ func handleBearerAuth(
 	if err != nil {
 		logrus.WithError(err).WithFields(fields).Debug("Failed to get bearer token")
 
-		return "", "", fmt.Errorf("%w: %w", errFailedDecodeResponse, err)
+		return "", "", redirected, fmt.Errorf("%w: %w", errFailedDecodeResponse, err)
 	}
 
 	if token == "" {
 		logrus.WithFields(fields).Debug("Empty bearer token received")
 
-		return "", "", fmt.Errorf("%w: empty token in response", errFailedDecodeResponse)
+		return "", "", redirected, fmt.Errorf(
+			"%w: empty token in response",
+			errFailedDecodeResponse,
+		)
 	}
 
 	logrus.WithFields(fields).
 		WithField("token_present", token != "").
 		WithField("challenge_host", challengeHost).
 		Debug("Returning Bearer token and challenge host")
 
-	return token, challengeHost, nil
+	return token, challengeHost, redirected, nil
 }
 
 // GetToken fetches a token and the challenge host for the registry hosting the provided image.
@@ -317,13 +324,14 @@ func handleBearerAuth(
 // Returns:
 //   - string: Authentication token (e.g., "Basic ..." or "Bearer ...").
 //   - string: Challenge host (e.g., "ghcr.io"), empty if not applicable.
+//   - bool: True if the challenge request was redirected, false otherwise.
 //   - error: Non-nil if operation fails, nil on success.
 func GetToken(
 	ctx context.Context,
 	container types.Container,
 	registryAuth string,
 	client Client,
-) (string, string, error) {
+) (string, string, bool, error) {
 	fields := logrus.Fields{
 		"image": container.ImageName(),
 	}
@@ -333,7 +341,7 @@ func GetToken(
 	if err != nil {
 		logrus.WithError(err).WithFields(fields).Debug("Failed to parse image name")
 
-		return "", "", fmt.Errorf("%w: %w", errFailedParseImageName, err)
+		return "", "", false, fmt.Errorf("%w: %w", errFailedParseImageName, err)
 	}
 
 	// Generate the challenge URL.
@@ -347,7 +355,7 @@ func GetToken(
 	if err != nil {
 		logrus.WithError(err).WithFields(fields).Debug("Failed to create challenge request")
 
-		return "", "", fmt.Errorf("%w: %w", errFailedCreateChallengeRequest, err)
+		return "", "", false, fmt.Errorf("%w: %w", errFailedCreateChallengeRequest, err)
 	}
 
 	res, err := client.Do(req)
@@ -357,17 +365,20 @@ func GetToken(
 			WithField("url", challengeURL.String()).
 			Debug("Failed to execute challenge request")
 
-		return "", "", fmt.Errorf("%w: %w", errFailedExecuteChallengeRequest, err)
+		return "", "", false, fmt.Errorf("%w: %w", errFailedExecuteChallengeRequest, err)
 	}
 	defer res.Body.Close()
 
+	// Detect if the request was redirected.
+	redirected := res.Request.URL.Host != challengeURL.Host
+
 	// Handle 200 OK response (no auth required).
 	if res.StatusCode == http.StatusOK {
 		logrus.WithFields(fields).
 			WithField("url", challengeURL.String()).
 			Debug("No authentication required (200 OK)")
 
-		return "", "", nil
+		return "", "", redirected, nil
 	}
 
 	// Extract the challenge header.
@@ -383,7 +394,7 @@ func GetToken(
 			WithField("url", challengeURL.String()).
 			Debug("Empty WWW-Authenticate header; assuming no authentication required")
 
-		return "", "", nil
+		return "", "", redirected, nil
 	}
 
 	// Normalize challenge for comparison.
@@ -395,25 +406,33 @@ func GetToken(
 		if registryAuth == "" {
 			logrus.WithFields(fields).Debug("No credentials provided for Basic auth")
 
-			return "", "", fmt.Errorf("%w: basic auth required", errNoCredentials)
+			return "", "", redirected, fmt.Errorf("%w: basic auth required", errNoCredentials)
 		}
 
 		logrus.WithFields(fields).Debug("Using Basic auth")
 
-		return "Basic " + registryAuth, "", nil
+		return "Basic " + registryAuth, "", redirected, nil
 	}
 
 	// Handle Bearer auth.
 	if strings.HasPrefix(challenge, "bearer") {
-		return handleBearerAuth(ctx, wwwAuthHeader, container, registryAuth, client, fields)
+		return handleBearerAuth(
+			ctx,
+			wwwAuthHeader,
+			container,
+			registryAuth,
+			client,
+			redirected,
+			fields,
+		)
 	}
 
 	// Handle unknown challenge types.
 	logrus.WithFields(fields).
 		WithField("challenge", challenge).
 		Error("Unsupported challenge type from registry")
 
-	return "", "", fmt.Errorf("%w: %s", errUnsupportedChallenge, challenge)
+	return "", "", redirected, fmt.Errorf("%w: %s", errUnsupportedChallenge, challenge)
 }
 
 // processChallenge parses the WWW-Authenticate header to extract authentication details.
@@ -631,10 +650,36 @@ func GetAuthURL(challenge string, imageRef reference.Named) (*url.URL, error) {
 		}
 	}
 
+	// Get registry address for special handling.
+	registryAddress, err := GetRegistryAddress(imageRef.Name())
+	if err != nil {
+		logrus.WithError(err).
+			WithField("image", imageRef.Name()).
+			Debug("Failed to get registry address")
+	}
+
+	// Special handling for lscr.io registry authentication:
+	// lscr.io (LinuxServer.io) images are hosted on GitHub Container Registry (ghcr.io),
+	// but the authentication challenge from lscr.io redirects to ghcr.io. When we receive
+	// the WWW-Authenticate header from ghcr.io, it contains the ghcr.io realm URL.
+	// However, for lscr.io images, we need to ensure the realm points to ghcr.io's token endpoint
+	// to get the correct authentication tokens. This prevents authentication failures
+	// that would occur if we tried to use lscr.io's non-existent token endpoint.
+	//
+	// Without this override, lscr.io authentication would fail because:
+	// 1. Challenge request to lscr.io/v2/ redirects to ghcr.io/v2/
+	// 2. ghcr.io returns WWW-Authenticate header with ghcr.io realm
+	// 3. But sometimes the realm might not be correctly set, causing token requests to fail
+	// 4. This ensures we always use the correct ghcr.io token endpoint for lscr.io images
+	if registryAddress == LSCRRegistry {
+		values["realm"] = "https://ghcr.io/token"
+	}
+
 	logrus.WithFields(logrus.Fields{
 		"image":   imageRef.Name(),
 		"realm":   values["realm"],
 		"service": values["service"],
+		"scope":   values["scope"],
 	}).Debug("Parsed challenge header")
 
 	// Validate required fields.
@@ -748,7 +793,7 @@ func TransformAuth(registryAuth string) string {
 	return registryAuth // Return original if no valid credentials.
 }
 
-// GetChallengeURL generates a challenge URL for accessing an image’s registry.
+// GetChallengeURL generates a challenge URL for accessing an image's registry.
 //
 // Parameters:
 //   - imageRef: Normalized image reference.
@@ -759,6 +804,12 @@ func GetChallengeURL(imageRef reference.Named) url.URL {
 	// Extract registry host from the image reference.
 	host, _ := GetRegistryAddress(imageRef.Name())
 
+	// Special handling for lscr.io registry: use ghcr.io for challenge URL
+	// to get the correct WWW-Authenticate header with proper scope.
+	if host == "lscr.io" {
+		host = "ghcr.io"
+	}
+
 	scheme := "https"
 	if viper.GetBool("WATCHTOWER_REGISTRY_TLS_SKIP") {
 		scheme = "http"