initiateUpload() fails with gitlab registries due to urlValues["from"] causing an auth failiure

[bajacondor]

Authentication to gitlab docker registry is failing on push for blobs that have the from querystring property added when that value is a registry other than gitlab.

Requests like this from initiateUpload():
https://gitlab-registry.example.com/v2/cicd/bazel-reference-implementations/java/blobs/uploads/?from=library%2Fnginx&mount=sha256%3A162f7aebbf400c6fb16f0520254513b6e505b567ca2fb3995311f92a71f0419f

Respond with this:
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"cicd/bazel-reference-implementations/java","Action":"pull"},{"Type":"repository","Class":"","Name":"cicd/bazel-reference-implementations/java","Action":"push"},{"Type":"repository","Class":"","Name":"library/nginx","Action":"pull"}]}]}

[jonjohnsonjr]

I think this was fixed a couple hours ago 😅

See #219

[mattmoor]

Going to close this. Please feel free to reopen if it repros at HEAD.

[jonjohnsonjr]

Reopening because it seems this worked for harbor but not gitlab.

Copying @bajacondor 's comment from the PR.

Unfortunately, when pushing to gitlab private registry, This doesn't completely fix the unauthorized issue. Apparently, the scopes (line 48) also have an effect on the way the registry auths the blob write. I was able to successfully push by replacing line 48 with scopes = append(scopes, ref.Scope(transport.PushScope)) which is kind of a hack. I'm not sure what would be better.

[jonjohnsonjr]

I am admittedly ruby-ignorant, but casually looking through gitlab it seems that they don't handle multiple scopes during the token exchange. I may be misreading, but see here:
https://github.com/gitlabhq/gitlabhq/blob/889098471e6efc5afa63d70d4089c52326fff43e/app/services/auth/container_registry_authentication_service.rb#L57

I wonder if #221 would help with this somehow.

[bajacondor]

Thank you for re-opening. Also, thank you @jonjohnsonjr for digging into gitlab code. I see also that they refuse a scope where the path is not within the repository:
https://github.com/gitlabhq/gitlabhq/blob/889098471e6efc5afa63d70d4089c52326fff43e/app/services/auth/container_registry_authentication_service.rb#L78
My company is a customer of gitlab. I will open an issue with them.

[jonjohnsonjr]

Thanks @bajacondor - I just saw this issue as well: https://gitlab.com/gitlab-org/gitlab-ce/issues/48968

Related kaniko issue: GoogleContainerTools/kaniko#181

[jonjohnsonjr]

Looks like this got fixed on GitLab's side: https://gitlab.com/gitlab-org/gitlab-ce/issues/48968 🎉

@bajacondor can we close this now?