fix(docker): support nvcr.io tag listing

[steved]

Changes

Support nvcr.io image registry tag listing.

Context

Updating an nvcr.io image (nvidia/k8s-device-plugin in my particular case) fails with the following error:

DEBUG: Failed to get authHeaders for getTags lookup
DEBUG: Failed to look up dependency nvcr.io/nvidia/k8s-device-plugin (nvcr.io/nvidia/k8s-device-plugin)(packageFile="[...]/Dockerfile", dependency="nvcr.io/nvidia/k8s-device-plugin")

nvcr.io seems to deviate slightly from other image registries in that it does not return a service with the Www-authenticate header:

$ curl -v https://nvcr.io/v2/ |& grep Www
< Www-Authenticate: Bearer realm="https://nvcr.io/proxy_auth",scope=""

Returning an empty service query param back works fine:

$ curl -I 'https://nvcr.io/proxy_auth?service=&scope=repository:nvcr.io/nvidia/k8s-device-plugin:pull'
HTTP/1.1 200
...

The original change was made in #11942 and does not explain why service must be a string.

• closes No docker auth found - returning #17304

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[JamieMagee]

Interesting! That change was originally made to satisfy the types required later. All the documentation I had found pointed to it being a required parameter:

Docker¹:

$ curl -s -I https://index.docker.io/v2/ | grep -Fi www-authenticate
www-authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io"

GCR:

$ curl -s -I https://mirror.gcr.io/v2/ | grep -Fi www-authenticate
www-authenticate: Bearer realm="https://mirror.gcr.io/v2/token",service="mirror.gcr.io"

MCR²

Footnotes

1. https://docs.docker.com/registry/spec/auth/token/ ↩

2. https://docs.microsoft.com/en-us/rest/api/containerregistry/access-tokens/get-from-login?tabs=HTTP ↩

[viceice]

see open conversation

[renovate-release]

🎉 This PR is included in version 32.169.1 🎉

The release is available on:

• GitHub release
• 32.169.1

Your semantic-release bot 📦🚀