Docker manifest fails for registries/users where JWT action "*" is restricted (e.g. gitlab)

[mschrupp]

Hi everyone,

playing around with docker manifest on gitlab gives me some issues due to a bug(?) in the docker CLI.

When trying to do a docker manifest push, it fails because gitlab allows * actions only for site admins.

Now I wonder whether the action * for those commands is intentional -
shouldn't it be push and/or pull (at least that's how I understand the docs)

I think (not really sure) I tracked this problem down to the line linked below:

cli/cli/registry/client/endpoint.go

Line 105 in 8618838

tokenHandler := auth.NewTokenHandler(authTransport, creds, repoName, "*")

The * action hardcoded in the last argument of the function call.

If the * action is required/intentional, I will argue in the corresponding gitlab bug instead (since that means their permission model doesn't work).

Thanks for any input on that issue.

[vdemeester]

cc @dmcgowan @clnperez

[clnperez]

Thanks @vdemeester for the tag. I'll take a look.