See: https://github.com/opencontainers/distribution-spec/pull/275 We need to add a test for this behaviour to the conformance tests when registries have security "disabled".