Skip to content

ggcr: remote.Delete() fails or registries which require additional token scope/action #2184

@sjhx

Description

@sjhx

Describe the bug

remote.Delete() fails for registries which require additional token scope/action over "pull,push"
specifically IBM Cloud Registry requires either "*" or "delete" action in the token

To Reproduce

remote.Delete() results in error

DELETE https://icr.io/v2/testing-te-1-dev/scratchtest/manifests/sha256:8f9f519f9a82865e4255f057f0f840fa6cf75091346a546d33e7cf8310010721: DENIED: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-resource; [map[Action:delete Class: Name:testing-te-1-dev/scratchtest Type:repository]]

Expected behavior

Successful delete of the manifest referenced.

Additional context

I notice that the v1/remote/transport/scope.go DeleteScope value is unreferenced / unimplemented.

Modifying PushScope in scope.go to "push,pull,*" gets delete working, probably want to actually implement use of a distinct DeleteScope though?

  • Version of the module v0.20.7
  • Registry used IBM Cloud Container Registry (ICR)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions