Unable to attach/push files/accessories to an proxy-project artifact using Oras

[bedla]

Hi,

I found out that when I have proxy-project (eg Docker Hub proxy) I am unable to attach any files to artifacts.

Example command (simpler variant also works):
oras attach --artifact-type artifact/type --annotation-file annotations.json localhost/docker-proxy/bedla/sample-spring-boot:ivos-latest hi.txt:layer/media-type.

What I also found out is that when you click "Generate SBOM" in the Harbor UI, it attaches generated JSON without problems.
For example:

		  harbor-aws.internal.pbk-lab.tech/personal-ivo_smid/sample-spring-boot@sha256:065...35c
		  └── application/vnd.goharbor.harbor.sbom.v1
		      └── sha256:e4124546e76a144cd21bcb12d1a3a5dbe134fe6a64d9b80c9add994dee311220
		          ├── Descriptor
		          │   ├── MediaType: application/vnd.oci.image.manifest.v1+json
		          │   └── Size: 763
		          ├── Annotations
		          │   ├── created: "2025-08-25T13:00:10Z"
		          │   ├── created-by: Harbor
		          │   ├── org.opencontainers.artifact.created: "2025-08-25T13:00:10Z"
		          │   └── org.opencontainers.artifact.description: SPDX JSON SBOM
		          └── Layers
		              └── Layer[0]
		                  ├── digest: sha256:3dd185499e4a826032f3a5487a09095b221a28f4348de14971a20828bb325e76
		                  ├── mediaType: application/vnd.oci.image.layer.v1.tar
		                  └── size: 62126

It is because of special handling of internal attach calls and denying calls from outside (REST API calls).

There is check in the source code https://github.com/goharbor/harbor/blob/v2.13.2/src/server/middleware/repoproxy/proxy.go#L309-L313

Check if we are at proxy-project and have internal call.

		if p.IsProxy() && !isProxySession(ctx, art.ProjectName) {
			httpLib.SendError(w,
				errors.DeniedError(
					errors.Errorf("can not push artifact to a proxy project: %v", p.Name)))
			return
		}

And then check if we have internal call to the API isProxySession:

• IF username equals harbor#proxy-cache-service THEN access-allowed
• IF username prefix is "${robotPrefix}${projectName}+${scannerPrefix}" THEN access-allowed
  • example robot$docker-proxy+8OUcKtA8
  • (8OUcKtA8 is random 8 chars string generated during installation of Harbor)
  • (characted + is not valid char when creating robot account by hand in the UI)
• ELSE access-denied

PR for this business logic is here #12404 .

I understand reasoning behind this validation, BUT it does not allow me to attach files to proxy-projects. Is it something that cannot be changed, for example to have some special permission or something like that?

Note: I am using Harbor v2.13.2

Thank you for explanation.

Ivos

[wy65701436]

@bedla The proxy cache project is designed to disallow pushes. Could you try the attach operation with a normal project instead?

And please file an github feature request for it, and BTW describe the story why you need and how you use.

[bedla]

Normal project is working correctly.

"The proxy cache project is designed to disallow pushes" - but for Harbor generated SBOM it is allowed to attach. So, if it make sense to you it would be great to be abble to attach, maybe with special permission?