bash - docker registry v2 和 curl 的 insufficient_scope 错误

Question

我试图通过 v2 注册表访问 docker hub，但不明白为什么我在 header 中返回了 insufficient_scope 错误。

#!/bin/bash
REPO=ubuntu
TAG=latest
REGISTRY=https://registry-1.docker.io/v2

URI="$REGISTRY/$REPO/manifests/$TAG"
echo URI=$URI
MANIFEST="`curl -skL -o /dev/null -D- $URI`"
CHALLENGE="`grep "Www-Authenticate" <<<"$MANIFEST"`"
if [[ CHALLENGE ]]; then
    IFS=\" read _ REALM _ SERVICE _ SCOPE _ <<<"$CHALLENGE"
    echo REALM is $REALM
    echo SERVICE is $SERVICE
    echo SCOPE is $SCOPE
    TOKEN="`curl -skL "$REALM?service=$SERVICE&scope=$SCOPE"`"
    IFS=\" read _ _ _ TOKEN _ <<<"$TOKEN"
    echo TOKEN is $TOKEN
    MANIFEST="`curl -isk -X GET -H "Authorization: Bearer $TOKEN" $URI`"
    echo "RESPONSE is $MANIFEST"
fi

控制台输出为:

URI=https://registry-1.docker.io/v2/ubuntu/manifests/latest
REALM is https://auth.docker.io/token
SERVICE is registry.docker.io
SCOPE is repository:ubuntu:pull
TOKEN is eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsIng1YyI6WyJNSUlDTHpDQ0FkU2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakJHTVVRd1FnWURWUVFERXp0Uk5Gb3pPa2RYTjBrNldGUlFSRHBJVFRSUk9rOVVWRmc2TmtGRlF6cFNUVE5ET2tGU01rTTZUMFkzTnpwQ1ZrVkJPa2xHUlVrNlExazFTekFlRncweE5qQTFNekV5TXpVNE5UZGFGdzB4TnpBMU16RXlNelU0TlRkYU1FWXhSREJDQmdOVkJBTVRPMUV6UzFRNlFqSkpNenBhUjFoT09qSlhXRTA2UTBWWFF6cFVNMHhPT2tvMlYxWTZNbGsyVHpwWlFWbEpPbGhQVTBRNlZFUlJTVG8wVWtwRE1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVo0NkVLV3VKSXhxOThuUC9GWEU3U3VyOXlkZ3c3K2FkcndxeGlxN004VHFUa0N0dzBQZm1SS2VLdExwaXNTRFU4LzZseWZ3QUFwZWh6SHdtWmxZR2dxT0JzakNCcnpBT0JnTlZIUThCQWY4RUJBTUNCNEF3RHdZRFZSMGxCQWd3QmdZRVZSMGxBREJFQmdOVkhRNEVQUVE3VVROTFZEcENNa2t6T2xwSFdFNDZNbGRZVFRwRFJWZERPbFF6VEU0NlNqWlhWam95V1RaUE9sbEJXVWs2V0U5VFJEcFVSRkZKT2pSU1NrTXdSZ1lEVlIwakJEOHdQWUE3VVRSYU16cEhWemRKT2xoVVVFUTZTRTAwVVRwUFZGUllPalpCUlVNNlVrMHpRenBCVWpKRE9rOUdOemM2UWxaRlFUcEpSa1ZKT2tOWk5Vc3dDZ1lJS29aSXpqMEVBd0lEU1FBd1JnSWhBTzYxSWloN1FUcHNTMFFIYUNwTDFZTWNMMnZXZlNydlhHbHpSRDEwN2NRUEFpRUFtZXduelNYRHplRGxqcDc4T1NsTFFzbnROYWM5eHRyYW0xU0kxY0ZXQ2tJPSJdfQ.eyJhY2Nlc3MiOltdLCJhdWQiOiJyZWdpc3RyeS5kb2NrZXIuaW8iLCJleHAiOjE0NjgyNTU4ODgsImlhdCI6MTQ2ODI1NTU4OCwiaXNzIjoiYXV0aC5kb2NrZXIuaW8iLCJqdGkiOiJBc2R5ZzBiX0hnNlNDS2Z0MEgtMiIsIm5iZiI6MTQ2ODI1NTU4OCwic3ViIjoiIn0.6pCh0OIabGGbBd8mubOpwlighlX69P7tMFqGk5P-knsJqxw7-G9YzaY-5_gUKRb44NvaJAeib84EYa0AejbUSw
RESPONSE is HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
Docker-Distribution-Api-Version: registry/2.0
Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:ubuntu:pull",error="insufficient_scope"
Date: Mon, 11 Jul 2016 16:46:31 GMT
Content-Length: 138
Strict-Transport-Security: max-age=31536000

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Name":"ubuntu","Action":"pull"}]}]

echo 正是我所期待的，所以我现在很困惑。

我只能发现 this谷歌上的票，但它没有说明我的情况。

Answer 1

对于任何看到这篇文章的人来说，问题似乎是没有 ubuntu 存储库(至少不是公开的)。替换 REPO=library/ubuntu 似乎已经解决了它。