What happened in your environment?
the error happens with ORAS 1.1.0 :
root@f54f52505a49:/# oras pull -d <GCP-artifact-registry-path-toartifact>:<version>
DEBU[0000] Request #0
> Request URL: "https://europe-docker.pkg.dev/v2/<GCP-artifact-registry-path-toartifact>/manifests/<version>"
> Request method: "GET"
> Request headers:
"Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json"
"User-Agent": "oras/1.1.0"
DEBU[0000] Response #0
< Response Status: "401 Unauthorized"
< Response headers:
"Content-Type": "application/json; charset=utf-8"
"X-Xss-Protection": "0"
"Content-Length": "102"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
"Docker-Distribution-Api-Version": "registry/2.0"
"Www-Authenticate": "Bearer realm=\"https://europe-docker.pkg.dev/v2/token\",service=\"europe-docker.pkg.dev\",scope=\"repository:<GCP-artifact-registry-path-toartifact>:pull\""
"X-Content-Type-Options": "nosniff"
"X-Frame-Options": "SAMEORIGIN"
"Date": "Thu, 14 Dec 2023 10:26:51 GMT"
DEBU[0000] Request #1
> Request URL: "https://europe-docker.pkg.dev/v2/token?scope=repository%3A<GCP-artifact-registry-path-toartifact>%3Apull&service=europe-docker.pkg.dev"
> Request method: "GET"
> Request headers:
"User-Agent": "oras/1.1.0"
DEBU[0000] Response #1
< Response Status: "403 Forbidden"
< Response headers:
"X-Content-Type-Options": "nosniff"
"X-Frame-Options": "SAMEORIGIN"
"X-Xss-Protection": "0"
"Date": "Thu, 14 Dec 2023 10:26:51 GMT"
"Content-Length": "226"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
"Content-Type": "application/json; charset=utf-8"
Error: failed to resolve 1.8.3.0-linux-x64: GET "https://europe-docker.pkg.dev/v2/<GCP-artifact-registry-path-toartifact>/manifests/<version>": GET "https://europe-docker.pkg.dev/v2/token?scope=repository%3A<GCP-artifact-registry-path-toartifact>%3Apull&service=europe-docker.pkg.dev": response status code 403: denied: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/<GCP-artifact-registry-path-toartifact>" (or it may not exist)
root@04f2353edd9a:/# oras version
Version: 1.1.0
Go version: go1.21.0
Git commit: 7079c468a06fb5815c99395eb4aaf46dd459d3fa
Git tree state: clean
obviously some sensitive information are masked
What did you expect to happen?
previous ORAS 1.0.0 works as expected:
root@4f8d3f2ee0e0:/# oras pull -d <GCP-artifact-registry-path-toartifact>:<version>
DEBU[0000] Request #0
> Request URL: "https://europe-docker.pkg.dev/v2/<GCP-artifact-registry-path-toartifact>/manifests/<version>"
> Request method: "GET"
> Request headers:
"Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json"
"User-Agent": "oras/1.0.0"
DEBU[0000] Response #0
< Response Status: "401 Unauthorized"
< Response headers:
"Www-Authenticate": "Bearer realm=\"https://europe-docker.pkg.dev/v2/token\",service=\"europe-docker.pkg.dev\",scope=\"repository:<GCP-artifact-registry-path-toartifact>:pull\""
"X-Content-Type-Options": "nosniff"
"X-Xss-Protection": "0"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
"Content-Type": "application/json; charset=utf-8"
"Docker-Distribution-Api-Version": "registry/2.0"
"X-Frame-Options": "SAMEORIGIN"
"Date": "Thu, 14 Dec 2023 11:06:35 GMT"
"Content-Length": "102"
DEBU[0000] Request #1
> Request URL: "https://europe-docker.pkg.dev/v2/token?scope=repository%3A<GCP-artifact-registry-path-toartifact>%3Apull&service=europe-docker.pkg.dev"
> Request method: "GET"
> Request headers:
"Authorization": "*****"
"User-Agent": "oras/1.0.0"
DEBU[0000] Response #1
< Response Status: "200 OK"
< Response headers:
"X-Frame-Options": "SAMEORIGIN"
"X-Xss-Protection": "0"
"Date": "Thu, 14 Dec 2023 11:06:35 GMT"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
"Content-Type": "application/json"
"X-Content-Type-Options": "nosniff"
DEBU[0000] Request #2
> Request URL: "https://europe-docker.pkg.dev/v2/<GCP-artifact-registry-path-toartifact>/manifests/<version>"
> Request method: "GET"
> Request headers:
"Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json"
"Authorization": "*****"
"User-Agent": "oras/1.0.0"
DEBU[0000] Response #2
< Response Status: "200 OK"
< Response headers:
"Content-Length": "683"
"Content-Type": "application/vnd.oci.image.manifest.v1+json"
"Docker-Distribution-Api-Version": "registry/2.0"
"X-Content-Type-Options": "nosniff"
"X-Xss-Protection": "0"
"Docker-Content-Digest": "sha256:4bab09616371cd2dbcbace686e44a19f7714dc06424f4a2d2cebd62804be9cf6"
"X-Frame-Options": "SAMEORIGIN"
"Date": "Thu, 14 Dec 2023 11:06:35 GMT"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
Downloading f148b4f8d409 linux-x64
DEBU[0000] Request #3
> Request URL: "https://europe-docker.pkg.dev/v2/<GCP-artifact-registry-path-toartifact>/blobs/sha256:<artifact-hash>"
> Request method: "GET"
> Request headers:
"Authorization": "*****"
"User-Agent": "oras/1.0.0"
DEBU[0000] Response #3
< Response Status: "302 Found"
< Response headers:
"Content-Type": "text/html; charset=utf-8"
"Docker-Distribution-Api-Version": "registry/2.0"
"Location": "/artifacts-downloads/namespaces/<GCP-artifact-registry-path-toartifact>/downloads/<very-long-string>"
"X-Content-Type-Options": "nosniff"
"X-Frame-Options": "SAMEORIGIN"
"X-Xss-Protection": "0"
"Date": "Thu, 14 Dec 2023 11:06:35 GMT"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
DEBU[0000] Request #4
> Request URL: "https://europe-docker.pkg.dev/artifacts-downloads/namespaces/<GCP-artifact-registry-path-toartifact>/downloads/<very-long-string>"
> Request method: "GET"
> Request headers:
"Authorization": "*****"
"User-Agent": "oras/1.0.0"
"Referer": "https://europe-docker.pkg.dev/v2/<GCP-artifact-registry-path-toartifact>/blobs/sha256:<artifact-hash>"
DEBU[0000] Response #4
< Response Status: "200 OK"
< Response headers:
"Content-Length": "234224"
"Date": "Thu, 14 Dec 2023 11:06:35 GMT"
"Expires": "Thu, 14 Dec 2023 11:06:35 GMT"
"Cache-Control": "private, max-age=0"
"X-Goog-Hash": "crc32c=evV6gA=="
"Content-Type": "application/octet-stream"
"Accept-Ranges": "bytes"
"Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
"X-Guploader-Uploadid": "ABPtcPpMqTQGvdkPXB76fMfTLFPCMTKVl-48qs_TNEfWmLlqaunE-aVdR5ympk5xQ4FOH5e6Jg"
"Server": "UploadServer"
Downloaded f148b4f8d409 linux-x64
Pulled [registry] <GCP-artifact-registry-path-toartifact>:<version>
Digest: sha256:4bab09616371cd2dbcbace686e44a19f7714dc06424f4a2d2cebd62804be9cf6
root@4f8d3f2ee0e0:/# oras version
Version: 1.0.0
Go version: go1.20.2
Git commit: b58e7b910ca556973d111e9bd734a71baef03db2
Git tree state: clean
root@4f8d3f2ee0e0:/#
obviously some sensitive information are masked
How can we reproduce it?
I've created two custom docker images with ORAS manually installed, one with ORAS v1.0.0 and another with ORAS v1.1.0, to be run through jenkins on a k8s environment, this is the dockerfile used to create the images:
# escape=`
ARG BUILD_IMAGE=gcr.io/cloud-builders/docker # ubuntu 20.04.6 LTS based image
# google cloud builder with oras
FROM $BUILD_IMAGE
ARG ORAS_VERSION
# install oras tool
RUN mkdir -p /tmp/oras-install/ && `
curl -LO "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_amd64.tar.gz" && `
ls -la . && `
tar -zxf ./oras_${ORAS_VERSION}_linux_amd64.tar.gz -C /tmp/oras-install/ && `
cp /tmp/oras-install/oras /usr/bin/ && `
cp /tmp/oras-install/oras /usr/sbin/ && `
chmod a+x /usr/bin/oras /usr/sbin/oras && `
rm -rf ./oras_${ORAS_VERSION}_linux_amd64.tar.gz /tmp/oras-install/
ENTRYPOINT [ "/bin/bash" ]
then use a .docker/config.json file with the content of a k8s service account used to push/pull artifact into GCP artifact registry.
The two docker images are executed, mounting .docker folder to the container's user .docker folder to do authentication, with:
docker run -it -v C:\Users\gpongelli\.docker\:/root/.docker <custom-docker-image>:1.1.0
docker run -it -v C:\Users\gpongelli\.docker\:/root/.docker <custom-docker-image>:1.0.0
into those images I've executed the oras pull command reported above.
Thanks!
What is the version of your ORAS CLI?
Version: 1.1.0
Go version: go1.21.0
Git commit: 7079c46
Git tree state: clean
What is your OS environment?
docker image
Are you willing to submit PRs to fix it?
What happened in your environment?
the error happens with ORAS 1.1.0 :
obviously some sensitive information are masked
What did you expect to happen?
previous ORAS 1.0.0 works as expected:
obviously some sensitive information are masked
How can we reproduce it?
I've created two custom docker images with ORAS manually installed, one with ORAS v1.0.0 and another with ORAS v1.1.0, to be run through jenkins on a k8s environment, this is the dockerfile used to create the images:
then use a .docker/config.json file with the content of a k8s service account used to push/pull artifact into GCP artifact registry.
The two docker images are executed, mounting .docker folder to the container's user .docker folder to do authentication, with:
docker run -it -v C:\Users\gpongelli\.docker\:/root/.docker <custom-docker-image>:1.1.0docker run -it -v C:\Users\gpongelli\.docker\:/root/.docker <custom-docker-image>:1.0.0into those images I've executed the
oras pullcommand reported above.Thanks!
What is the version of your ORAS CLI?
Version: 1.1.0
Go version: go1.21.0
Git commit: 7079c46
Git tree state: clean
What is your OS environment?
docker image
Are you willing to submit PRs to fix it?