5 Commits (7cd01254d33ba41ec5020fd1af780cd26a6ca02a)

Author	SHA1	Message	Date
Terry Howe	2fb05f8a35	fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1 ... oras-go v2.6.1 hardens the auth client to drop the Authorization header when a request's origin changes mid-flight (GHSA-vh4v-2xq2-g5cg). Helm's fallbackTransport reaches plain-HTTP registries by downgrading the connection from https to http inside a single round trip, which oras now treats as a credential-leaking origin change and refuses to authenticate. On login, detect when the transport has fallen back to plain HTTP and, in that case, set PlainHTTP explicitly and re-ping so requests are built as http from the start. The scheme no longer changes mid-request, credentials flow as before, and the new cross-origin protection is preserved for real https registries (forcedHTTP stays false, so the retry never triggers). Signed-off-by: Terry Howe <terrylhowe@gmail.com>	2 months ago
Terry Howe	b52bb41484	fix: add debug logging to oci transport ... Signed-off-by: Terry Howe <terrylhowe@gmail.com> Co-authored-by: Billy Zha <jinzha1@microsoft.com>	1 year ago
Terry Howe	cdd7c105a6	docs: Note about http fallback for OCI registries ... Signed-off-by: Terry Howe <terrylhowe@gmail.com>	1 year ago
Terry Howe	1435ec7c77	Update pkg/registry/fallback.go ... Signed-off-by: Terry Howe <terrylhowe@gmail.com>	1 year ago
Terry Howe	674e882c88	automatic fallback to http ... Signed-off-by: Terry Howe <terrylhowe@gmail.com>	1 year ago