OCI publishing to Azure fails (token vs access_token)
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Launchpad itself |
Triaged
|
High
|
Unassigned |
Bug Description
I've configured a push rule for ACR (Azure Container Registry) on
Ubuntu 18.04 OCI recipe at
https:/
with following fields:
Registry URL: ubuntu.azurecr.io
Image name: ubuntu
Username: ubuntu
Password: <REDACTED>
When I triggered new build, the push failed when logging in into ACR
registry with the following message:
Registry upload failed: Could not get token from response data:
{'access_token': '... JWT TOKEN SNIPPED ...'}
The failed build URL is
I've done some digging with (patched) skopeo and Wireshark. In
ociregistryclie
"token" from the /oauth2/token response. When logging in into
Docker.io registry, the response JSON contains keys "token",
"access_token", "expires_in" and "issued_at", and "token" has the same
value as "access_token". But ACR registry response contains only
"access_token". I'm OAuth ignorant person but it seems that
"access_token" should be used instead of "token". At least that's what
skopeo seems to do, it doesn't have any problem with ACR response.
I'm attaching captured HTTP exchange between skopeo and remote
registry for the following commands as text files in attached tarball
(with my credentials redacted):
skopeo login docker.io
skopeo inspect --raw docker:
skopeo login vubuntu.azurecr.io
skopeo inspect --raw docker:
Both images are private so authentication/
This looks like to be respective documentation: /docs.microsoft .com/en- us/rest/ api/containerre gistry/ access- tokens/ get-from- login
https:/