Repository navigation
gh auth token scopes not valid for ghcr #5174
Description
Describe the bug
The token generated by gh auth login --scopes read:packages does not respected by ghcr.io.
❯ gh --version
gh version 2.5.0 (2022-02-01)
https://github.com/cli/cli/releases/tag/v2.5.0
Steps to reproduce the behavior
Login via gh
gh auth login --hostname github.com --web --scopes read:packages
Using the generated token
gh auth status --show-token
Login via the docker cli
echo "<token>" | docker login ghcr.io --username <username> --password-stdin
Pull private or internal docker image from ghcr.io
docker pull ghcr.io/<org>/<repo>:latest
Expected vs actual behavior
It's expected that the tokens generated via gh auth (given the read:packages scope) will be able to docker pull images that have private or internal visibility -- this is the case for PATs.
Instead the following error is produced Error response from daemon: unauthorized.
Reacted by Max Ekman, Oscar Söderlund, John McGrath, きわみざむらい and Andrew Tec
Activity
maxekman commentedon Feb 7, 2022
Would love to see this solved!
odsod commentedon Feb 7, 2022
@xzyfer I ran into the same issue, and for me it was that the GHCR images were stored in an SSO-protected organization. It might be that
gh auth loginneeds to support SSO authorizing the generated token.xzyfer commentedon Feb 7, 2022
I can confirm new do not have SSO. Other authenticated operations via gh work fine. The issue appears to be related specifically to ghcr's auty model.
mislav commentedon Feb 7, 2022
Ah, so, I've learned something today: for
docker login ghcr.ioyou can only use Personal Access Tokens that you manually generate and additionally SSO for your org. Right now it seems that you cannot use the token produced bygh auth loginsince that's technically an OAuth token (and not a PAT). 🤔I will ask internally whether this restriction is intentional or not.
mislav commentedon Feb 8, 2022
This is not resolved, but I'm going to fold this into #5150 so we have a single issue to track Docker authentication stuff.