Expand description
Bearer-challenge handling for OCI registries.
Only the standard WWW-Authenticate: Bearer realm=…,service=…,scope=…
flow is implemented. Registry-specific login endpoints are out of scope:
an unrecognised challenge is a fetch failure, not a silent downgrade to an
anonymous request.
The credential itself never appears in an error or a log field. A secret
containing : is treated as user:token and sent as HTTP Basic, matching
how registries issue robot accounts; anything else is sent as a bearer
token.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.