registry: treat basic-auth 401 as unauthorized

[locker95]

daemon-less docker login was turning a 401 into a plain error, so Auth() tried the next endpoint. against a Basic-Auth registry that can print Login Succeeded for a wrong password (the HTTP fallback answering 200).

mark 401 as unauthorized and stop.

Fixes #7237

[thaJeztah]

Shouldn't translateV2AuthError handle this already?

cli/internal/registry/errors.go

Lines 14 to 23 in ff3273f

	func translateV2AuthError(err error) error {
	var e *url.Error
	if errors.As(err, &e) {
	var e2 errcode.Error
	if errors.As(e, &e2) && errors.Is(e2.Code, errcode.ErrorCodeUnauthorized) {
	return unauthorizedErr{err}
	}
	}
	return err
	}

[locker95]

it only unwraps a url.Error from Do() (the distribution errcode path). a 401 status never hits that, so I switched this to errhttp.ToNative.

[thaJeztah]

Possibly we should use github.com/containerd/errdefs/errhttp.ToNative here

cli/vendor/github.com/containerd/errdefs/pkg/errhttp/http.go

Lines 68 to 96 in ff3273f

	// ToNative returns the error best matching the HTTP status code
	func ToNative(statusCode int) error {
	switch statusCode {
	case http.StatusNotFound:
	return errdefs.ErrNotFound
	case http.StatusBadRequest:
	return errdefs.ErrInvalidArgument
	case http.StatusConflict:
	return errdefs.ErrConflict
	case http.StatusPreconditionFailed:
	return errdefs.ErrFailedPrecondition
	case http.StatusUnauthorized:
	return errdefs.ErrUnauthenticated
	case http.StatusForbidden:
	return errdefs.ErrPermissionDenied
	case http.StatusNotModified:
	return errdefs.ErrNotModified
	case http.StatusTooManyRequests:
	return errdefs.ErrResourceExhausted
	case http.StatusInternalServerError:
	return errdefs.ErrInternal
	case http.StatusNotImplemented:
	return errdefs.ErrNotImplemented
	case http.StatusServiceUnavailable:
	return errdefs.ErrUnavailable
	default:
	return cause.ErrUnexpectedStatus{Status: statusCode}
	}
	}

But probably wrap / decorate it after that

func TestError(t *testing.T) {
	err := errhttp.ToNative(401)
	endpointStr := "example.com"
	err = fmt.Errorf("login attempt to %s failed: %w", endpointStr, err)
	assert.Check(t, is.ErrorType(err, errdefs.IsUnauthorized))
}

[locker95]

yeah, used that and wrapped it so the endpoint still shows up in the error.