Fix bug in RegistryRequiresAuth

Author: vladbologa

internal/dockerauth/dockerauth.go

@@ -226,6 +226,10 @@ func (d *DockerAuth) RegistryRequiresAuth(ctx context.Context, registry string)
 
 	tr, err := transport.NewWithContext(ctx, reg, authn.Anonymous, http.DefaultTransport, []string{repo.Scope("pull")})
 	if err != nil {
+		var te *transport.Error
+		if errors.As(err, &te) && requiresAuth(te.StatusCode) {
+			return true, nil
+		}
 		return true, fmt.Errorf("negotiating anonymous access to %s: %w", host, err)
 	}
 
@@ -244,12 +248,16 @@ func (d *DockerAuth) RegistryRequiresAuth(ctx context.Context, registry string)
 	if resp.StatusCode >= http.StatusOK && resp.StatusCode < http.StatusMultipleChoices {
 		return false, nil
 	}
-	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusNotFound {
+	if requiresAuth(resp.StatusCode) {
 		return true, nil
 	}
 	return true, fmt.Errorf("unexpected status %s from %s", resp.Status, host)
 }
 
+func requiresAuth(code int) bool {
+	return code == http.StatusUnauthorized || code == http.StatusForbidden || code == http.StatusNotFound
+}
+
 // CreatePullSecretYAMLFromCredentials creates Kubernetes pull secret YAML from
 // verified credentials, scoped to the host of the given image registry
 func (d *DockerAuth) CreatePullSecretYAMLFromCredentials(creds Credentials, namespace, registry string) string {

internal/dockerauth/dockerauth_test.go

@@ -149,7 +149,6 @@ func TestRegistryRequiresAuth(t *testing.T) {
 			challengeAuth:    true,
 			tokenStatus:      http.StatusUnauthorized,
 			expectedRequires: true,
-			expectErr:        true,
 		},
 		{
 			name: "tags-list request returns an unexpected server error",