Listing Docker Tags in GHCR without Authorization? #204710
🏷️ Discussion TypeBug BodyHi, I wanted to list available docker tags of renovate. Following the OCI specification this should be possible by calling https://ghcr.io/v2/renovatebot/renovate/tags/list - However I get the following response: {"errors":[{"code":"UNAUTHORIZED","message":"authentication required"}]}Even with a user token with scope Best, |
Replies: 3 comments
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
|
@fabianvallon-db Every That tells you where to get a token and what scope to ask for. You then request a short-lived token from that TOKEN=$(curl -s "https://ghcr.io/token?service=ghcr.io&scope=repository:renovatebot/renovate:pull" | jq -r .token)
curl -H "Authorization: Bearer $TOKEN" \
https://ghcr.io/v2/renovatebot/renovate/tags/listSince Worth knowing separately: GHCR doesn't return a token expiry, so don't assume a long-lived token — if you're scripting this, just request a fresh token per session rather than caching it. |
|
thanks for your answer. that makes a lot of sense. i was misled by copilot to get a user token, so I was extra confused. especially thanks for taking the time for the step-by-step writeup :) |
@fabianvallon-db
Not a bug — this is expected OCI distribution behavior, and GHCR does support anonymous access for public packages, but it needs the token-exchange step first rather than a PAT sent straight as
Authorization: Bearer.Every
/v2/...endpoint on GHCR (and on most OCI-compliant registries) always answers unauthenticated requests with401+ aWWW-Authenticatechallenge, regardless of whether the package is public. That's by spec — you're expected to follow the challenge, not treat the 401 as a hard "no." If you check the response headers on your original request, you'll see something like: