Gang Wang 16d704d0ad fix(token): lowercase JSON tags on ClaimAccess so v3 accepts the scope ...

ClaimAccess fields had no `json:` tags, so the JWT's `access` array was
marshalled with the Go field names — `Type`/`Name`/`Actions`. Distribution
v2.8.1 happened to accept that (Go's encoding/json does a case-insensitive
fallback), but distribution v3 uses go-jose v3's JSON fork which dropped
that fallback. v3 parsed the access entries as empty and returned
"insufficient scope" on blob HEAD/GET, even though registry-auth had
signed a token covering pull,push.

Tag the fields with the lowercase keys mandated by the Docker token spec
(type/name/actions) and extend TestSign_EmitsX5cHeaderAndVerifies to
assert the raw payload uses those keys, so this can't regress.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-26 03:44:30 +00:00

..

app

fix: AIT-50130, support multi addresses (#13)

2024-09-04 22:43:58 +08:00

server

fix(token): lowercase JSON tags on ClaimAccess so v3 accepts the scope

2026-05-26 03:44:30 +00:00